diff --git a/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.c b/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.c index eb01fb71..79222a6c 100644 --- a/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.c +++ b/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.c @@ -1,26 +1,24 @@ +#include +#include #include "curve25519_ref10.h" -#include "crypto_int32.h" -#include "crypto_int64.h" -#include "crypto_uint32.h" -#include "crypto_uint64.h" #include "crypto_verify_32.h" -static crypto_uint64 load_3(const unsigned char *in) +static uint64_t load_3(const unsigned char *in) { - crypto_uint64 result; - result = (crypto_uint64) in[0]; - result |= ((crypto_uint64) in[1]) << 8; - result |= ((crypto_uint64) in[2]) << 16; + uint64_t result; + result = (uint64_t) in[0]; + result |= ((uint64_t) in[1]) << 8; + result |= ((uint64_t) in[2]) << 16; return result; } -static crypto_uint64 load_4(const unsigned char *in) +static uint64_t load_4(const unsigned char *in) { - crypto_uint64 result; - result = (crypto_uint64) in[0]; - result |= ((crypto_uint64) in[1]) << 8; - result |= ((crypto_uint64) in[2]) << 16; - result |= ((crypto_uint64) in[3]) << 24; + uint64_t result; + result = (uint64_t) in[0]; + result |= ((uint64_t) in[1]) << 8; + result |= ((uint64_t) in[2]) << 16; + result |= ((uint64_t) in[3]) << 24; return result; } @@ -74,36 +72,36 @@ Postconditions: void fe_add(fe h,const fe f,const fe g) { - crypto_int32 f0 = f[0]; - crypto_int32 f1 = f[1]; - crypto_int32 f2 = f[2]; - crypto_int32 f3 = f[3]; - crypto_int32 f4 = f[4]; - crypto_int32 f5 = f[5]; - crypto_int32 f6 = f[6]; - crypto_int32 f7 = f[7]; - crypto_int32 f8 = f[8]; - crypto_int32 f9 = f[9]; - crypto_int32 g0 = g[0]; - crypto_int32 g1 = g[1]; - crypto_int32 g2 = g[2]; - crypto_int32 g3 = g[3]; - crypto_int32 g4 = g[4]; - crypto_int32 g5 = g[5]; - crypto_int32 g6 = g[6]; - crypto_int32 g7 = g[7]; - crypto_int32 g8 = g[8]; - crypto_int32 g9 = g[9]; - crypto_int32 h0 = f0 + g0; - crypto_int32 h1 = f1 + g1; - crypto_int32 h2 = f2 + g2; - crypto_int32 h3 = f3 + g3; - crypto_int32 h4 = f4 + g4; - crypto_int32 h5 = f5 + g5; - crypto_int32 h6 = f6 + g6; - crypto_int32 h7 = f7 + g7; - crypto_int32 h8 = f8 + g8; - crypto_int32 h9 = f9 + g9; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; + int32_t g0 = g[0]; + int32_t g1 = g[1]; + int32_t g2 = g[2]; + int32_t g3 = g[3]; + int32_t g4 = g[4]; + int32_t g5 = g[5]; + int32_t g6 = g[6]; + int32_t g7 = g[7]; + int32_t g8 = g[8]; + int32_t g9 = g[9]; + int32_t h0 = f0 + g0; + int32_t h1 = f1 + g1; + int32_t h2 = f2 + g2; + int32_t h3 = f3 + g3; + int32_t h4 = f4 + g4; + int32_t h5 = f5 + g5; + int32_t h6 = f6 + g6; + int32_t h7 = f7 + g7; + int32_t h8 = f8 + g8; + int32_t h9 = f9 + g9; h[0] = h0; h[1] = h1; h[2] = h2; @@ -125,36 +123,36 @@ Preconditions: b in {0,1}. void fe_cmov(fe f,const fe g,unsigned int b) { - crypto_int32 f0 = f[0]; - crypto_int32 f1 = f[1]; - crypto_int32 f2 = f[2]; - crypto_int32 f3 = f[3]; - crypto_int32 f4 = f[4]; - crypto_int32 f5 = f[5]; - crypto_int32 f6 = f[6]; - crypto_int32 f7 = f[7]; - crypto_int32 f8 = f[8]; - crypto_int32 f9 = f[9]; - crypto_int32 g0 = g[0]; - crypto_int32 g1 = g[1]; - crypto_int32 g2 = g[2]; - crypto_int32 g3 = g[3]; - crypto_int32 g4 = g[4]; - crypto_int32 g5 = g[5]; - crypto_int32 g6 = g[6]; - crypto_int32 g7 = g[7]; - crypto_int32 g8 = g[8]; - crypto_int32 g9 = g[9]; - crypto_int32 x0 = f0 ^ g0; - crypto_int32 x1 = f1 ^ g1; - crypto_int32 x2 = f2 ^ g2; - crypto_int32 x3 = f3 ^ g3; - crypto_int32 x4 = f4 ^ g4; - crypto_int32 x5 = f5 ^ g5; - crypto_int32 x6 = f6 ^ g6; - crypto_int32 x7 = f7 ^ g7; - crypto_int32 x8 = f8 ^ g8; - crypto_int32 x9 = f9 ^ g9; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; + int32_t g0 = g[0]; + int32_t g1 = g[1]; + int32_t g2 = g[2]; + int32_t g3 = g[3]; + int32_t g4 = g[4]; + int32_t g5 = g[5]; + int32_t g6 = g[6]; + int32_t g7 = g[7]; + int32_t g8 = g[8]; + int32_t g9 = g[9]; + int32_t x0 = f0 ^ g0; + int32_t x1 = f1 ^ g1; + int32_t x2 = f2 ^ g2; + int32_t x3 = f3 ^ g3; + int32_t x4 = f4 ^ g4; + int32_t x5 = f5 ^ g5; + int32_t x6 = f6 ^ g6; + int32_t x7 = f7 ^ g7; + int32_t x8 = f8 ^ g8; + int32_t x9 = f9 ^ g9; b = (unsigned int) (- (int) b); x0 &= b; x1 &= b; @@ -184,16 +182,16 @@ h = f void fe_copy(fe h,const fe f) { - crypto_int32 f0 = f[0]; - crypto_int32 f1 = f[1]; - crypto_int32 f2 = f[2]; - crypto_int32 f3 = f[3]; - crypto_int32 f4 = f[4]; - crypto_int32 f5 = f[5]; - crypto_int32 f6 = f[6]; - crypto_int32 f7 = f[7]; - crypto_int32 f8 = f[8]; - crypto_int32 f9 = f[9]; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; h[0] = f0; h[1] = f1; h[2] = f2; @@ -212,49 +210,49 @@ Ignores top bit of h. void fe_frombytes(fe h,const unsigned char *s) { - crypto_int64 h0 = load_4(s); - crypto_int64 h1 = load_3(s + 4) << 6; - crypto_int64 h2 = load_3(s + 7) << 5; - crypto_int64 h3 = load_3(s + 10) << 3; - crypto_int64 h4 = load_3(s + 13) << 2; - crypto_int64 h5 = load_4(s + 16); - crypto_int64 h6 = load_3(s + 20) << 7; - crypto_int64 h7 = load_3(s + 23) << 5; - crypto_int64 h8 = load_3(s + 26) << 4; - crypto_int64 h9 = (load_3(s + 29) & 8388607) << 2; - crypto_int64 carry0; - crypto_int64 carry1; - crypto_int64 carry2; - crypto_int64 carry3; - crypto_int64 carry4; - crypto_int64 carry5; - crypto_int64 carry6; - crypto_int64 carry7; - crypto_int64 carry8; - crypto_int64 carry9; + int64_t h0 = load_4(s); + int64_t h1 = load_3(s + 4) << 6; + int64_t h2 = load_3(s + 7) << 5; + int64_t h3 = load_3(s + 10) << 3; + int64_t h4 = load_3(s + 13) << 2; + int64_t h5 = load_4(s + 16); + int64_t h6 = load_3(s + 20) << 7; + int64_t h7 = load_3(s + 23) << 5; + int64_t h8 = load_3(s + 26) << 4; + int64_t h9 = (load_3(s + 29) & 8388607) << 2; + int64_t carry0; + int64_t carry1; + int64_t carry2; + int64_t carry3; + int64_t carry4; + int64_t carry5; + int64_t carry6; + int64_t carry7; + int64_t carry8; + int64_t carry9; - carry9 = (h9 + (crypto_int64) (1L << 24)) >> 25; h0 += carry9 * 19; h9 -= carry9 * ((crypto_uint64) 1L << 25); - carry1 = (h1 + (crypto_int64) (1L << 24)) >> 25; h2 += carry1; h1 -= carry1 * ((crypto_uint64) 1L << 25); - carry3 = (h3 + (crypto_int64) (1L << 24)) >> 25; h4 += carry3; h3 -= carry3 * ((crypto_uint64) 1L << 25); - carry5 = (h5 + (crypto_int64) (1L << 24)) >> 25; h6 += carry5; h5 -= carry5 * ((crypto_uint64) 1L << 25); - carry7 = (h7 + (crypto_int64) (1L << 24)) >> 25; h8 += carry7; h7 -= carry7 * ((crypto_uint64) 1L << 25); + carry9 = (h9 + (int64_t) (1L << 24)) >> 25; h0 += carry9 * 19; h9 -= carry9 * ((uint64_t) 1L << 25); + carry1 = (h1 + (int64_t) (1L << 24)) >> 25; h2 += carry1; h1 -= carry1 * ((uint64_t) 1L << 25); + carry3 = (h3 + (int64_t) (1L << 24)) >> 25; h4 += carry3; h3 -= carry3 * ((uint64_t) 1L << 25); + carry5 = (h5 + (int64_t) (1L << 24)) >> 25; h6 += carry5; h5 -= carry5 * ((uint64_t) 1L << 25); + carry7 = (h7 + (int64_t) (1L << 24)) >> 25; h8 += carry7; h7 -= carry7 * ((uint64_t) 1L << 25); - carry0 = (h0 + (crypto_int64) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((crypto_uint64) 1L << 26); - carry2 = (h2 + (crypto_int64) (1L << 25)) >> 26; h3 += carry2; h2 -= carry2 * ((crypto_uint64) 1L << 26); - carry4 = (h4 + (crypto_int64) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((crypto_uint64) 1L << 26); - carry6 = (h6 + (crypto_int64) (1L << 25)) >> 26; h7 += carry6; h6 -= carry6 * ((crypto_uint64) 1L << 26); - carry8 = (h8 + (crypto_int64) (1L << 25)) >> 26; h9 += carry8; h8 -= carry8 * ((crypto_uint64) 1L << 26); + carry0 = (h0 + (int64_t) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((uint64_t) 1L << 26); + carry2 = (h2 + (int64_t) (1L << 25)) >> 26; h3 += carry2; h2 -= carry2 * ((uint64_t) 1L << 26); + carry4 = (h4 + (int64_t) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((uint64_t) 1L << 26); + carry6 = (h6 + (int64_t) (1L << 25)) >> 26; h7 += carry6; h6 -= carry6 * ((uint64_t) 1L << 26); + carry8 = (h8 + (int64_t) (1L << 25)) >> 26; h9 += carry8; h8 -= carry8 * ((uint64_t) 1L << 26); - h[0] = (crypto_int32) h0; - h[1] = (crypto_int32) h1; - h[2] = (crypto_int32) h2; - h[3] = (crypto_int32) h3; - h[4] = (crypto_int32) h4; - h[5] = (crypto_int32) h5; - h[6] = (crypto_int32) h6; - h[7] = (crypto_int32) h7; - h[8] = (crypto_int32) h8; - h[9] = (crypto_int32) h9; + h[0] = (int32_t) h0; + h[1] = (int32_t) h1; + h[2] = (int32_t) h2; + h[3] = (int32_t) h3; + h[4] = (int32_t) h4; + h[5] = (int32_t) h5; + h[6] = (int32_t) h6; + h[7] = (int32_t) h7; + h[8] = (int32_t) h8; + h[9] = (int32_t) h9; } /* @@ -284,29 +282,29 @@ Proof: void fe_tobytes(unsigned char *s,const fe h) { - crypto_int32 h0 = h[0]; - crypto_int32 h1 = h[1]; - crypto_int32 h2 = h[2]; - crypto_int32 h3 = h[3]; - crypto_int32 h4 = h[4]; - crypto_int32 h5 = h[5]; - crypto_int32 h6 = h[6]; - crypto_int32 h7 = h[7]; - crypto_int32 h8 = h[8]; - crypto_int32 h9 = h[9]; - crypto_int32 q; - crypto_int32 carry0; - crypto_int32 carry1; - crypto_int32 carry2; - crypto_int32 carry3; - crypto_int32 carry4; - crypto_int32 carry5; - crypto_int32 carry6; - crypto_int32 carry7; - crypto_int32 carry8; - crypto_int32 carry9; + int32_t h0 = h[0]; + int32_t h1 = h[1]; + int32_t h2 = h[2]; + int32_t h3 = h[3]; + int32_t h4 = h[4]; + int32_t h5 = h[5]; + int32_t h6 = h[6]; + int32_t h7 = h[7]; + int32_t h8 = h[8]; + int32_t h9 = h[9]; + int32_t q; + int32_t carry0; + int32_t carry1; + int32_t carry2; + int32_t carry3; + int32_t carry4; + int32_t carry5; + int32_t carry6; + int32_t carry7; + int32_t carry8; + int32_t carry9; - q = (19 * h9 + ((crypto_uint32) 1L << 24)) >> 25; + q = (19 * h9 + ((uint32_t) 1L << 24)) >> 25; q = (h0 + q) >> 26; q = (h1 + q) >> 25; q = (h2 + q) >> 26; @@ -322,16 +320,16 @@ void fe_tobytes(unsigned char *s,const fe h) h0 += 19 * q; /* Goal: Output h-2^255 q, which is between 0 and 2^255-20. */ - carry0 = h0 >> 26; h1 += carry0; h0 -= carry0 * ((crypto_uint32) 1L << 26); - carry1 = h1 >> 25; h2 += carry1; h1 -= carry1 * ((crypto_uint32) 1L << 25); - carry2 = h2 >> 26; h3 += carry2; h2 -= carry2 * ((crypto_uint32) 1L << 26); - carry3 = h3 >> 25; h4 += carry3; h3 -= carry3 * ((crypto_uint32) 1L << 25); - carry4 = h4 >> 26; h5 += carry4; h4 -= carry4 * ((crypto_uint32) 1L << 26); - carry5 = h5 >> 25; h6 += carry5; h5 -= carry5 * ((crypto_uint32) 1L << 25); - carry6 = h6 >> 26; h7 += carry6; h6 -= carry6 * ((crypto_uint32) 1L << 26); - carry7 = h7 >> 25; h8 += carry7; h7 -= carry7 * ((crypto_uint32) 1L << 25); - carry8 = h8 >> 26; h9 += carry8; h8 -= carry8 * ((crypto_uint32) 1L << 26); - carry9 = h9 >> 25; h9 -= carry9 * ((crypto_uint32) 1L << 25); + carry0 = h0 >> 26; h1 += carry0; h0 -= carry0 * ((uint32_t) 1L << 26); + carry1 = h1 >> 25; h2 += carry1; h1 -= carry1 * ((uint32_t) 1L << 25); + carry2 = h2 >> 26; h3 += carry2; h2 -= carry2 * ((uint32_t) 1L << 26); + carry3 = h3 >> 25; h4 += carry3; h3 -= carry3 * ((uint32_t) 1L << 25); + carry4 = h4 >> 26; h5 += carry4; h4 -= carry4 * ((uint32_t) 1L << 26); + carry5 = h5 >> 25; h6 += carry5; h5 -= carry5 * ((uint32_t) 1L << 25); + carry6 = h6 >> 26; h7 += carry6; h6 -= carry6 * ((uint32_t) 1L << 26); + carry7 = h7 >> 25; h8 += carry7; h7 -= carry7 * ((uint32_t) 1L << 25); + carry8 = h8 >> 26; h9 += carry8; h8 -= carry8 * ((uint32_t) 1L << 26); + carry9 = h9 >> 25; h9 -= carry9 * ((uint32_t) 1L << 25); /* h10 = carry9 */ /* @@ -344,32 +342,32 @@ void fe_tobytes(unsigned char *s,const fe h) s[0] = h0 >> 0; s[1] = h0 >> 8; s[2] = h0 >> 16; - s[3] = (h0 >> 24) | (h1 * ((crypto_uint32) 1 << 2)); + s[3] = (h0 >> 24) | (h1 * ((uint32_t) 1 << 2)); s[4] = h1 >> 6; s[5] = h1 >> 14; - s[6] = (h1 >> 22) | (h2 * ((crypto_uint32) 1 << 3)); + s[6] = (h1 >> 22) | (h2 * ((uint32_t) 1 << 3)); s[7] = h2 >> 5; s[8] = h2 >> 13; - s[9] = (h2 >> 21) | (h3 * ((crypto_uint32) 1 << 5)); + s[9] = (h2 >> 21) | (h3 * ((uint32_t) 1 << 5)); s[10] = h3 >> 3; s[11] = h3 >> 11; - s[12] = (h3 >> 19) | (h4 * ((crypto_uint32) 1 << 6)); + s[12] = (h3 >> 19) | (h4 * ((uint32_t) 1 << 6)); s[13] = h4 >> 2; s[14] = h4 >> 10; s[15] = h4 >> 18; s[16] = h5 >> 0; s[17] = h5 >> 8; s[18] = h5 >> 16; - s[19] = (h5 >> 24) | (h6 * ((crypto_uint32) 1 << 1)); + s[19] = (h5 >> 24) | (h6 * ((uint32_t) 1 << 1)); s[20] = h6 >> 7; s[21] = h6 >> 15; - s[22] = (h6 >> 23) | (h7 * ((crypto_uint32) 1 << 3)); + s[22] = (h6 >> 23) | (h7 * ((uint32_t) 1 << 3)); s[23] = h7 >> 5; s[24] = h7 >> 13; - s[25] = (h7 >> 21) | (h8 * ((crypto_uint32) 1 << 4)); + s[25] = (h7 >> 21) | (h8 * ((uint32_t) 1 << 4)); s[26] = h8 >> 4; s[27] = h8 >> 12; - s[28] = (h8 >> 20) | (h9 * ((crypto_uint32) 1 << 6)); + s[28] = (h8 >> 20) | (h9 * ((uint32_t) 1 << 6)); s[29] = h9 >> 2; s[30] = h9 >> 10; s[31] = h9 >> 18; @@ -441,160 +439,160 @@ With tighter constraints on inputs can squeeze carries into int32. void fe_mul(fe h,const fe f,const fe g) { - crypto_int32 f0 = f[0]; - crypto_int32 f1 = f[1]; - crypto_int32 f2 = f[2]; - crypto_int32 f3 = f[3]; - crypto_int32 f4 = f[4]; - crypto_int32 f5 = f[5]; - crypto_int32 f6 = f[6]; - crypto_int32 f7 = f[7]; - crypto_int32 f8 = f[8]; - crypto_int32 f9 = f[9]; - crypto_int32 g0 = g[0]; - crypto_int32 g1 = g[1]; - crypto_int32 g2 = g[2]; - crypto_int32 g3 = g[3]; - crypto_int32 g4 = g[4]; - crypto_int32 g5 = g[5]; - crypto_int32 g6 = g[6]; - crypto_int32 g7 = g[7]; - crypto_int32 g8 = g[8]; - crypto_int32 g9 = g[9]; - crypto_int32 g1_19 = 19 * g1; /* 1.959375*2^29 */ - crypto_int32 g2_19 = 19 * g2; /* 1.959375*2^30; still ok */ - crypto_int32 g3_19 = 19 * g3; - crypto_int32 g4_19 = 19 * g4; - crypto_int32 g5_19 = 19 * g5; - crypto_int32 g6_19 = 19 * g6; - crypto_int32 g7_19 = 19 * g7; - crypto_int32 g8_19 = 19 * g8; - crypto_int32 g9_19 = 19 * g9; - crypto_int32 f1_2 = 2 * f1; - crypto_int32 f3_2 = 2 * f3; - crypto_int32 f5_2 = 2 * f5; - crypto_int32 f7_2 = 2 * f7; - crypto_int32 f9_2 = 2 * f9; - crypto_int64 f0g0 = f0 * (crypto_int64) g0; - crypto_int64 f0g1 = f0 * (crypto_int64) g1; - crypto_int64 f0g2 = f0 * (crypto_int64) g2; - crypto_int64 f0g3 = f0 * (crypto_int64) g3; - crypto_int64 f0g4 = f0 * (crypto_int64) g4; - crypto_int64 f0g5 = f0 * (crypto_int64) g5; - crypto_int64 f0g6 = f0 * (crypto_int64) g6; - crypto_int64 f0g7 = f0 * (crypto_int64) g7; - crypto_int64 f0g8 = f0 * (crypto_int64) g8; - crypto_int64 f0g9 = f0 * (crypto_int64) g9; - crypto_int64 f1g0 = f1 * (crypto_int64) g0; - crypto_int64 f1g1_2 = f1_2 * (crypto_int64) g1; - crypto_int64 f1g2 = f1 * (crypto_int64) g2; - crypto_int64 f1g3_2 = f1_2 * (crypto_int64) g3; - crypto_int64 f1g4 = f1 * (crypto_int64) g4; - crypto_int64 f1g5_2 = f1_2 * (crypto_int64) g5; - crypto_int64 f1g6 = f1 * (crypto_int64) g6; - crypto_int64 f1g7_2 = f1_2 * (crypto_int64) g7; - crypto_int64 f1g8 = f1 * (crypto_int64) g8; - crypto_int64 f1g9_38 = f1_2 * (crypto_int64) g9_19; - crypto_int64 f2g0 = f2 * (crypto_int64) g0; - crypto_int64 f2g1 = f2 * (crypto_int64) g1; - crypto_int64 f2g2 = f2 * (crypto_int64) g2; - crypto_int64 f2g3 = f2 * (crypto_int64) g3; - crypto_int64 f2g4 = f2 * (crypto_int64) g4; - crypto_int64 f2g5 = f2 * (crypto_int64) g5; - crypto_int64 f2g6 = f2 * (crypto_int64) g6; - crypto_int64 f2g7 = f2 * (crypto_int64) g7; - crypto_int64 f2g8_19 = f2 * (crypto_int64) g8_19; - crypto_int64 f2g9_19 = f2 * (crypto_int64) g9_19; - crypto_int64 f3g0 = f3 * (crypto_int64) g0; - crypto_int64 f3g1_2 = f3_2 * (crypto_int64) g1; - crypto_int64 f3g2 = f3 * (crypto_int64) g2; - crypto_int64 f3g3_2 = f3_2 * (crypto_int64) g3; - crypto_int64 f3g4 = f3 * (crypto_int64) g4; - crypto_int64 f3g5_2 = f3_2 * (crypto_int64) g5; - crypto_int64 f3g6 = f3 * (crypto_int64) g6; - crypto_int64 f3g7_38 = f3_2 * (crypto_int64) g7_19; - crypto_int64 f3g8_19 = f3 * (crypto_int64) g8_19; - crypto_int64 f3g9_38 = f3_2 * (crypto_int64) g9_19; - crypto_int64 f4g0 = f4 * (crypto_int64) g0; - crypto_int64 f4g1 = f4 * (crypto_int64) g1; - crypto_int64 f4g2 = f4 * (crypto_int64) g2; - crypto_int64 f4g3 = f4 * (crypto_int64) g3; - crypto_int64 f4g4 = f4 * (crypto_int64) g4; - crypto_int64 f4g5 = f4 * (crypto_int64) g5; - crypto_int64 f4g6_19 = f4 * (crypto_int64) g6_19; - crypto_int64 f4g7_19 = f4 * (crypto_int64) g7_19; - crypto_int64 f4g8_19 = f4 * (crypto_int64) g8_19; - crypto_int64 f4g9_19 = f4 * (crypto_int64) g9_19; - crypto_int64 f5g0 = f5 * (crypto_int64) g0; - crypto_int64 f5g1_2 = f5_2 * (crypto_int64) g1; - crypto_int64 f5g2 = f5 * (crypto_int64) g2; - crypto_int64 f5g3_2 = f5_2 * (crypto_int64) g3; - crypto_int64 f5g4 = f5 * (crypto_int64) g4; - crypto_int64 f5g5_38 = f5_2 * (crypto_int64) g5_19; - crypto_int64 f5g6_19 = f5 * (crypto_int64) g6_19; - crypto_int64 f5g7_38 = f5_2 * (crypto_int64) g7_19; - crypto_int64 f5g8_19 = f5 * (crypto_int64) g8_19; - crypto_int64 f5g9_38 = f5_2 * (crypto_int64) g9_19; - crypto_int64 f6g0 = f6 * (crypto_int64) g0; - crypto_int64 f6g1 = f6 * (crypto_int64) g1; - crypto_int64 f6g2 = f6 * (crypto_int64) g2; - crypto_int64 f6g3 = f6 * (crypto_int64) g3; - crypto_int64 f6g4_19 = f6 * (crypto_int64) g4_19; - crypto_int64 f6g5_19 = f6 * (crypto_int64) g5_19; - crypto_int64 f6g6_19 = f6 * (crypto_int64) g6_19; - crypto_int64 f6g7_19 = f6 * (crypto_int64) g7_19; - crypto_int64 f6g8_19 = f6 * (crypto_int64) g8_19; - crypto_int64 f6g9_19 = f6 * (crypto_int64) g9_19; - crypto_int64 f7g0 = f7 * (crypto_int64) g0; - crypto_int64 f7g1_2 = f7_2 * (crypto_int64) g1; - crypto_int64 f7g2 = f7 * (crypto_int64) g2; - crypto_int64 f7g3_38 = f7_2 * (crypto_int64) g3_19; - crypto_int64 f7g4_19 = f7 * (crypto_int64) g4_19; - crypto_int64 f7g5_38 = f7_2 * (crypto_int64) g5_19; - crypto_int64 f7g6_19 = f7 * (crypto_int64) g6_19; - crypto_int64 f7g7_38 = f7_2 * (crypto_int64) g7_19; - crypto_int64 f7g8_19 = f7 * (crypto_int64) g8_19; - crypto_int64 f7g9_38 = f7_2 * (crypto_int64) g9_19; - crypto_int64 f8g0 = f8 * (crypto_int64) g0; - crypto_int64 f8g1 = f8 * (crypto_int64) g1; - crypto_int64 f8g2_19 = f8 * (crypto_int64) g2_19; - crypto_int64 f8g3_19 = f8 * (crypto_int64) g3_19; - crypto_int64 f8g4_19 = f8 * (crypto_int64) g4_19; - crypto_int64 f8g5_19 = f8 * (crypto_int64) g5_19; - crypto_int64 f8g6_19 = f8 * (crypto_int64) g6_19; - crypto_int64 f8g7_19 = f8 * (crypto_int64) g7_19; - crypto_int64 f8g8_19 = f8 * (crypto_int64) g8_19; - crypto_int64 f8g9_19 = f8 * (crypto_int64) g9_19; - crypto_int64 f9g0 = f9 * (crypto_int64) g0; - crypto_int64 f9g1_38 = f9_2 * (crypto_int64) g1_19; - crypto_int64 f9g2_19 = f9 * (crypto_int64) g2_19; - crypto_int64 f9g3_38 = f9_2 * (crypto_int64) g3_19; - crypto_int64 f9g4_19 = f9 * (crypto_int64) g4_19; - crypto_int64 f9g5_38 = f9_2 * (crypto_int64) g5_19; - crypto_int64 f9g6_19 = f9 * (crypto_int64) g6_19; - crypto_int64 f9g7_38 = f9_2 * (crypto_int64) g7_19; - crypto_int64 f9g8_19 = f9 * (crypto_int64) g8_19; - crypto_int64 f9g9_38 = f9_2 * (crypto_int64) g9_19; - crypto_int64 h0 = f0g0+f1g9_38+f2g8_19+f3g7_38+f4g6_19+f5g5_38+f6g4_19+f7g3_38+f8g2_19+f9g1_38; - crypto_int64 h1 = f0g1+f1g0 +f2g9_19+f3g8_19+f4g7_19+f5g6_19+f6g5_19+f7g4_19+f8g3_19+f9g2_19; - crypto_int64 h2 = f0g2+f1g1_2 +f2g0 +f3g9_38+f4g8_19+f5g7_38+f6g6_19+f7g5_38+f8g4_19+f9g3_38; - crypto_int64 h3 = f0g3+f1g2 +f2g1 +f3g0 +f4g9_19+f5g8_19+f6g7_19+f7g6_19+f8g5_19+f9g4_19; - crypto_int64 h4 = f0g4+f1g3_2 +f2g2 +f3g1_2 +f4g0 +f5g9_38+f6g8_19+f7g7_38+f8g6_19+f9g5_38; - crypto_int64 h5 = f0g5+f1g4 +f2g3 +f3g2 +f4g1 +f5g0 +f6g9_19+f7g8_19+f8g7_19+f9g6_19; - crypto_int64 h6 = f0g6+f1g5_2 +f2g4 +f3g3_2 +f4g2 +f5g1_2 +f6g0 +f7g9_38+f8g8_19+f9g7_38; - crypto_int64 h7 = f0g7+f1g6 +f2g5 +f3g4 +f4g3 +f5g2 +f6g1 +f7g0 +f8g9_19+f9g8_19; - crypto_int64 h8 = f0g8+f1g7_2 +f2g6 +f3g5_2 +f4g4 +f5g3_2 +f6g2 +f7g1_2 +f8g0 +f9g9_38; - crypto_int64 h9 = f0g9+f1g8 +f2g7 +f3g6 +f4g5 +f5g4 +f6g3 +f7g2 +f8g1 +f9g0 ; - crypto_int64 carry0; - crypto_int64 carry1; - crypto_int64 carry2; - crypto_int64 carry3; - crypto_int64 carry4; - crypto_int64 carry5; - crypto_int64 carry6; - crypto_int64 carry7; - crypto_int64 carry8; - crypto_int64 carry9; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; + int32_t g0 = g[0]; + int32_t g1 = g[1]; + int32_t g2 = g[2]; + int32_t g3 = g[3]; + int32_t g4 = g[4]; + int32_t g5 = g[5]; + int32_t g6 = g[6]; + int32_t g7 = g[7]; + int32_t g8 = g[8]; + int32_t g9 = g[9]; + int32_t g1_19 = 19 * g1; /* 1.959375*2^29 */ + int32_t g2_19 = 19 * g2; /* 1.959375*2^30; still ok */ + int32_t g3_19 = 19 * g3; + int32_t g4_19 = 19 * g4; + int32_t g5_19 = 19 * g5; + int32_t g6_19 = 19 * g6; + int32_t g7_19 = 19 * g7; + int32_t g8_19 = 19 * g8; + int32_t g9_19 = 19 * g9; + int32_t f1_2 = 2 * f1; + int32_t f3_2 = 2 * f3; + int32_t f5_2 = 2 * f5; + int32_t f7_2 = 2 * f7; + int32_t f9_2 = 2 * f9; + int64_t f0g0 = f0 * (int64_t) g0; + int64_t f0g1 = f0 * (int64_t) g1; + int64_t f0g2 = f0 * (int64_t) g2; + int64_t f0g3 = f0 * (int64_t) g3; + int64_t f0g4 = f0 * (int64_t) g4; + int64_t f0g5 = f0 * (int64_t) g5; + int64_t f0g6 = f0 * (int64_t) g6; + int64_t f0g7 = f0 * (int64_t) g7; + int64_t f0g8 = f0 * (int64_t) g8; + int64_t f0g9 = f0 * (int64_t) g9; + int64_t f1g0 = f1 * (int64_t) g0; + int64_t f1g1_2 = f1_2 * (int64_t) g1; + int64_t f1g2 = f1 * (int64_t) g2; + int64_t f1g3_2 = f1_2 * (int64_t) g3; + int64_t f1g4 = f1 * (int64_t) g4; + int64_t f1g5_2 = f1_2 * (int64_t) g5; + int64_t f1g6 = f1 * (int64_t) g6; + int64_t f1g7_2 = f1_2 * (int64_t) g7; + int64_t f1g8 = f1 * (int64_t) g8; + int64_t f1g9_38 = f1_2 * (int64_t) g9_19; + int64_t f2g0 = f2 * (int64_t) g0; + int64_t f2g1 = f2 * (int64_t) g1; + int64_t f2g2 = f2 * (int64_t) g2; + int64_t f2g3 = f2 * (int64_t) g3; + int64_t f2g4 = f2 * (int64_t) g4; + int64_t f2g5 = f2 * (int64_t) g5; + int64_t f2g6 = f2 * (int64_t) g6; + int64_t f2g7 = f2 * (int64_t) g7; + int64_t f2g8_19 = f2 * (int64_t) g8_19; + int64_t f2g9_19 = f2 * (int64_t) g9_19; + int64_t f3g0 = f3 * (int64_t) g0; + int64_t f3g1_2 = f3_2 * (int64_t) g1; + int64_t f3g2 = f3 * (int64_t) g2; + int64_t f3g3_2 = f3_2 * (int64_t) g3; + int64_t f3g4 = f3 * (int64_t) g4; + int64_t f3g5_2 = f3_2 * (int64_t) g5; + int64_t f3g6 = f3 * (int64_t) g6; + int64_t f3g7_38 = f3_2 * (int64_t) g7_19; + int64_t f3g8_19 = f3 * (int64_t) g8_19; + int64_t f3g9_38 = f3_2 * (int64_t) g9_19; + int64_t f4g0 = f4 * (int64_t) g0; + int64_t f4g1 = f4 * (int64_t) g1; + int64_t f4g2 = f4 * (int64_t) g2; + int64_t f4g3 = f4 * (int64_t) g3; + int64_t f4g4 = f4 * (int64_t) g4; + int64_t f4g5 = f4 * (int64_t) g5; + int64_t f4g6_19 = f4 * (int64_t) g6_19; + int64_t f4g7_19 = f4 * (int64_t) g7_19; + int64_t f4g8_19 = f4 * (int64_t) g8_19; + int64_t f4g9_19 = f4 * (int64_t) g9_19; + int64_t f5g0 = f5 * (int64_t) g0; + int64_t f5g1_2 = f5_2 * (int64_t) g1; + int64_t f5g2 = f5 * (int64_t) g2; + int64_t f5g3_2 = f5_2 * (int64_t) g3; + int64_t f5g4 = f5 * (int64_t) g4; + int64_t f5g5_38 = f5_2 * (int64_t) g5_19; + int64_t f5g6_19 = f5 * (int64_t) g6_19; + int64_t f5g7_38 = f5_2 * (int64_t) g7_19; + int64_t f5g8_19 = f5 * (int64_t) g8_19; + int64_t f5g9_38 = f5_2 * (int64_t) g9_19; + int64_t f6g0 = f6 * (int64_t) g0; + int64_t f6g1 = f6 * (int64_t) g1; + int64_t f6g2 = f6 * (int64_t) g2; + int64_t f6g3 = f6 * (int64_t) g3; + int64_t f6g4_19 = f6 * (int64_t) g4_19; + int64_t f6g5_19 = f6 * (int64_t) g5_19; + int64_t f6g6_19 = f6 * (int64_t) g6_19; + int64_t f6g7_19 = f6 * (int64_t) g7_19; + int64_t f6g8_19 = f6 * (int64_t) g8_19; + int64_t f6g9_19 = f6 * (int64_t) g9_19; + int64_t f7g0 = f7 * (int64_t) g0; + int64_t f7g1_2 = f7_2 * (int64_t) g1; + int64_t f7g2 = f7 * (int64_t) g2; + int64_t f7g3_38 = f7_2 * (int64_t) g3_19; + int64_t f7g4_19 = f7 * (int64_t) g4_19; + int64_t f7g5_38 = f7_2 * (int64_t) g5_19; + int64_t f7g6_19 = f7 * (int64_t) g6_19; + int64_t f7g7_38 = f7_2 * (int64_t) g7_19; + int64_t f7g8_19 = f7 * (int64_t) g8_19; + int64_t f7g9_38 = f7_2 * (int64_t) g9_19; + int64_t f8g0 = f8 * (int64_t) g0; + int64_t f8g1 = f8 * (int64_t) g1; + int64_t f8g2_19 = f8 * (int64_t) g2_19; + int64_t f8g3_19 = f8 * (int64_t) g3_19; + int64_t f8g4_19 = f8 * (int64_t) g4_19; + int64_t f8g5_19 = f8 * (int64_t) g5_19; + int64_t f8g6_19 = f8 * (int64_t) g6_19; + int64_t f8g7_19 = f8 * (int64_t) g7_19; + int64_t f8g8_19 = f8 * (int64_t) g8_19; + int64_t f8g9_19 = f8 * (int64_t) g9_19; + int64_t f9g0 = f9 * (int64_t) g0; + int64_t f9g1_38 = f9_2 * (int64_t) g1_19; + int64_t f9g2_19 = f9 * (int64_t) g2_19; + int64_t f9g3_38 = f9_2 * (int64_t) g3_19; + int64_t f9g4_19 = f9 * (int64_t) g4_19; + int64_t f9g5_38 = f9_2 * (int64_t) g5_19; + int64_t f9g6_19 = f9 * (int64_t) g6_19; + int64_t f9g7_38 = f9_2 * (int64_t) g7_19; + int64_t f9g8_19 = f9 * (int64_t) g8_19; + int64_t f9g9_38 = f9_2 * (int64_t) g9_19; + int64_t h0 = f0g0+f1g9_38+f2g8_19+f3g7_38+f4g6_19+f5g5_38+f6g4_19+f7g3_38+f8g2_19+f9g1_38; + int64_t h1 = f0g1+f1g0 +f2g9_19+f3g8_19+f4g7_19+f5g6_19+f6g5_19+f7g4_19+f8g3_19+f9g2_19; + int64_t h2 = f0g2+f1g1_2 +f2g0 +f3g9_38+f4g8_19+f5g7_38+f6g6_19+f7g5_38+f8g4_19+f9g3_38; + int64_t h3 = f0g3+f1g2 +f2g1 +f3g0 +f4g9_19+f5g8_19+f6g7_19+f7g6_19+f8g5_19+f9g4_19; + int64_t h4 = f0g4+f1g3_2 +f2g2 +f3g1_2 +f4g0 +f5g9_38+f6g8_19+f7g7_38+f8g6_19+f9g5_38; + int64_t h5 = f0g5+f1g4 +f2g3 +f3g2 +f4g1 +f5g0 +f6g9_19+f7g8_19+f8g7_19+f9g6_19; + int64_t h6 = f0g6+f1g5_2 +f2g4 +f3g3_2 +f4g2 +f5g1_2 +f6g0 +f7g9_38+f8g8_19+f9g7_38; + int64_t h7 = f0g7+f1g6 +f2g5 +f3g4 +f4g3 +f5g2 +f6g1 +f7g0 +f8g9_19+f9g8_19; + int64_t h8 = f0g8+f1g7_2 +f2g6 +f3g5_2 +f4g4 +f5g3_2 +f6g2 +f7g1_2 +f8g0 +f9g9_38; + int64_t h9 = f0g9+f1g8 +f2g7 +f3g6 +f4g5 +f5g4 +f6g3 +f7g2 +f8g1 +f9g0 ; + int64_t carry0; + int64_t carry1; + int64_t carry2; + int64_t carry3; + int64_t carry4; + int64_t carry5; + int64_t carry6; + int64_t carry7; + int64_t carry8; + int64_t carry9; /* |h0| <= (1.65*1.65*2^52*(1+19+19+19+19)+1.65*1.65*2^50*(38+38+38+38+38)) @@ -603,59 +601,59 @@ void fe_mul(fe h,const fe f,const fe g) i.e. |h1| <= 1.7*2^59; narrower ranges for h3, h5, h7, h9 */ - carry0 = (h0 + (crypto_int64) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((crypto_uint64) 1L << 26); - carry4 = (h4 + (crypto_int64) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((crypto_uint64) 1L << 26); + carry0 = (h0 + (int64_t) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((uint64_t) 1L << 26); + carry4 = (h4 + (int64_t) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((uint64_t) 1L << 26); /* |h0| <= 2^25 */ /* |h4| <= 2^25 */ /* |h1| <= 1.71*2^59 */ /* |h5| <= 1.71*2^59 */ - carry1 = (h1 + (crypto_int64) (1L << 24)) >> 25; h2 += carry1; h1 -= carry1 * ((crypto_uint64) 1L << 25); - carry5 = (h5 + (crypto_int64) (1L << 24)) >> 25; h6 += carry5; h5 -= carry5 * ((crypto_uint64) 1L << 25); + carry1 = (h1 + (int64_t) (1L << 24)) >> 25; h2 += carry1; h1 -= carry1 * ((uint64_t) 1L << 25); + carry5 = (h5 + (int64_t) (1L << 24)) >> 25; h6 += carry5; h5 -= carry5 * ((uint64_t) 1L << 25); /* |h1| <= 2^24; from now on fits into int32 */ /* |h5| <= 2^24; from now on fits into int32 */ /* |h2| <= 1.41*2^60 */ /* |h6| <= 1.41*2^60 */ - carry2 = (h2 + (crypto_int64) (1L << 25)) >> 26; h3 += carry2; h2 -= carry2 * ((crypto_uint64) 1L << 26); - carry6 = (h6 + (crypto_int64) (1L << 25)) >> 26; h7 += carry6; h6 -= carry6 * ((crypto_uint64) 1L << 26); + carry2 = (h2 + (int64_t) (1L << 25)) >> 26; h3 += carry2; h2 -= carry2 * ((uint64_t) 1L << 26); + carry6 = (h6 + (int64_t) (1L << 25)) >> 26; h7 += carry6; h6 -= carry6 * ((uint64_t) 1L << 26); /* |h2| <= 2^25; from now on fits into int32 unchanged */ /* |h6| <= 2^25; from now on fits into int32 unchanged */ /* |h3| <= 1.71*2^59 */ /* |h7| <= 1.71*2^59 */ - carry3 = (h3 + (crypto_int64) (1L << 24)) >> 25; h4 += carry3; h3 -= carry3 * ((crypto_uint64) 1L << 25); - carry7 = (h7 + (crypto_int64) (1L << 24)) >> 25; h8 += carry7; h7 -= carry7 * ((crypto_uint64) 1L << 25); + carry3 = (h3 + (int64_t) (1L << 24)) >> 25; h4 += carry3; h3 -= carry3 * ((uint64_t) 1L << 25); + carry7 = (h7 + (int64_t) (1L << 24)) >> 25; h8 += carry7; h7 -= carry7 * ((uint64_t) 1L << 25); /* |h3| <= 2^24; from now on fits into int32 unchanged */ /* |h7| <= 2^24; from now on fits into int32 unchanged */ /* |h4| <= 1.72*2^34 */ /* |h8| <= 1.41*2^60 */ - carry4 = (h4 + (crypto_int64) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((crypto_uint64) 1L << 26); - carry8 = (h8 + (crypto_int64) (1L << 25)) >> 26; h9 += carry8; h8 -= carry8 * ((crypto_uint64) 1L << 26); + carry4 = (h4 + (int64_t) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((uint64_t) 1L << 26); + carry8 = (h8 + (int64_t) (1L << 25)) >> 26; h9 += carry8; h8 -= carry8 * ((uint64_t) 1L << 26); /* |h4| <= 2^25; from now on fits into int32 unchanged */ /* |h8| <= 2^25; from now on fits into int32 unchanged */ /* |h5| <= 1.01*2^24 */ /* |h9| <= 1.71*2^59 */ - carry9 = (h9 + (crypto_int64) (1L << 24)) >> 25; h0 += carry9 * 19; h9 -= carry9 * ((crypto_uint64) 1L << 25); + carry9 = (h9 + (int64_t) (1L << 24)) >> 25; h0 += carry9 * 19; h9 -= carry9 * ((uint64_t) 1L << 25); /* |h9| <= 2^24; from now on fits into int32 unchanged */ /* |h0| <= 1.1*2^39 */ - carry0 = (h0 + (crypto_int64) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((crypto_uint64) 1L << 26); + carry0 = (h0 + (int64_t) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((uint64_t) 1L << 26); /* |h0| <= 2^25; from now on fits into int32 unchanged */ /* |h1| <= 1.01*2^24 */ - h[0] = (crypto_int32) h0; - h[1] = (crypto_int32) h1; - h[2] = (crypto_int32) h2; - h[3] = (crypto_int32) h3; - h[4] = (crypto_int32) h4; - h[5] = (crypto_int32) h5; - h[6] = (crypto_int32) h6; - h[7] = (crypto_int32) h7; - h[8] = (crypto_int32) h8; - h[9] = (crypto_int32) h9; + h[0] = (int32_t) h0; + h[1] = (int32_t) h1; + h[2] = (int32_t) h2; + h[3] = (int32_t) h3; + h[4] = (int32_t) h4; + h[5] = (int32_t) h5; + h[6] = (int32_t) h6; + h[7] = (int32_t) h7; + h[8] = (int32_t) h8; + h[9] = (int32_t) h9; } /* @@ -670,26 +668,26 @@ Postconditions: void fe_neg(fe h,const fe f) { - crypto_int32 f0 = f[0]; - crypto_int32 f1 = f[1]; - crypto_int32 f2 = f[2]; - crypto_int32 f3 = f[3]; - crypto_int32 f4 = f[4]; - crypto_int32 f5 = f[5]; - crypto_int32 f6 = f[6]; - crypto_int32 f7 = f[7]; - crypto_int32 f8 = f[8]; - crypto_int32 f9 = f[9]; - crypto_int32 h0 = -f0; - crypto_int32 h1 = -f1; - crypto_int32 h2 = -f2; - crypto_int32 h3 = -f3; - crypto_int32 h4 = -f4; - crypto_int32 h5 = -f5; - crypto_int32 h6 = -f6; - crypto_int32 h7 = -f7; - crypto_int32 h8 = -f8; - crypto_int32 h9 = -f9; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; + int32_t h0 = -f0; + int32_t h1 = -f1; + int32_t h2 = -f2; + int32_t h3 = -f3; + int32_t h4 = -f4; + int32_t h5 = -f5; + int32_t h6 = -f6; + int32_t h7 = -f7; + int32_t h8 = -f8; + int32_t h9 = -f9; h[0] = h0; h[1] = h1; h[2] = h2; @@ -719,134 +717,134 @@ See fe_mul.c for discussion of implementation strategy. void fe_sq(fe h,const fe f) { - crypto_int32 f0 = f[0]; - crypto_int32 f1 = f[1]; - crypto_int32 f2 = f[2]; - crypto_int32 f3 = f[3]; - crypto_int32 f4 = f[4]; - crypto_int32 f5 = f[5]; - crypto_int32 f6 = f[6]; - crypto_int32 f7 = f[7]; - crypto_int32 f8 = f[8]; - crypto_int32 f9 = f[9]; - crypto_int32 f0_2 = 2 * f0; - crypto_int32 f1_2 = 2 * f1; - crypto_int32 f2_2 = 2 * f2; - crypto_int32 f3_2 = 2 * f3; - crypto_int32 f4_2 = 2 * f4; - crypto_int32 f5_2 = 2 * f5; - crypto_int32 f6_2 = 2 * f6; - crypto_int32 f7_2 = 2 * f7; - crypto_int32 f5_38 = 38 * f5; /* 1.959375*2^30 */ - crypto_int32 f6_19 = 19 * f6; /* 1.959375*2^30 */ - crypto_int32 f7_38 = 38 * f7; /* 1.959375*2^30 */ - crypto_int32 f8_19 = 19 * f8; /* 1.959375*2^30 */ - crypto_int32 f9_38 = 38 * f9; /* 1.959375*2^30 */ - crypto_int64 f0f0 = f0 * (crypto_int64) f0; - crypto_int64 f0f1_2 = f0_2 * (crypto_int64) f1; - crypto_int64 f0f2_2 = f0_2 * (crypto_int64) f2; - crypto_int64 f0f3_2 = f0_2 * (crypto_int64) f3; - crypto_int64 f0f4_2 = f0_2 * (crypto_int64) f4; - crypto_int64 f0f5_2 = f0_2 * (crypto_int64) f5; - crypto_int64 f0f6_2 = f0_2 * (crypto_int64) f6; - crypto_int64 f0f7_2 = f0_2 * (crypto_int64) f7; - crypto_int64 f0f8_2 = f0_2 * (crypto_int64) f8; - crypto_int64 f0f9_2 = f0_2 * (crypto_int64) f9; - crypto_int64 f1f1_2 = f1_2 * (crypto_int64) f1; - crypto_int64 f1f2_2 = f1_2 * (crypto_int64) f2; - crypto_int64 f1f3_4 = f1_2 * (crypto_int64) f3_2; - crypto_int64 f1f4_2 = f1_2 * (crypto_int64) f4; - crypto_int64 f1f5_4 = f1_2 * (crypto_int64) f5_2; - crypto_int64 f1f6_2 = f1_2 * (crypto_int64) f6; - crypto_int64 f1f7_4 = f1_2 * (crypto_int64) f7_2; - crypto_int64 f1f8_2 = f1_2 * (crypto_int64) f8; - crypto_int64 f1f9_76 = f1_2 * (crypto_int64) f9_38; - crypto_int64 f2f2 = f2 * (crypto_int64) f2; - crypto_int64 f2f3_2 = f2_2 * (crypto_int64) f3; - crypto_int64 f2f4_2 = f2_2 * (crypto_int64) f4; - crypto_int64 f2f5_2 = f2_2 * (crypto_int64) f5; - crypto_int64 f2f6_2 = f2_2 * (crypto_int64) f6; - crypto_int64 f2f7_2 = f2_2 * (crypto_int64) f7; - crypto_int64 f2f8_38 = f2_2 * (crypto_int64) f8_19; - crypto_int64 f2f9_38 = f2 * (crypto_int64) f9_38; - crypto_int64 f3f3_2 = f3_2 * (crypto_int64) f3; - crypto_int64 f3f4_2 = f3_2 * (crypto_int64) f4; - crypto_int64 f3f5_4 = f3_2 * (crypto_int64) f5_2; - crypto_int64 f3f6_2 = f3_2 * (crypto_int64) f6; - crypto_int64 f3f7_76 = f3_2 * (crypto_int64) f7_38; - crypto_int64 f3f8_38 = f3_2 * (crypto_int64) f8_19; - crypto_int64 f3f9_76 = f3_2 * (crypto_int64) f9_38; - crypto_int64 f4f4 = f4 * (crypto_int64) f4; - crypto_int64 f4f5_2 = f4_2 * (crypto_int64) f5; - crypto_int64 f4f6_38 = f4_2 * (crypto_int64) f6_19; - crypto_int64 f4f7_38 = f4 * (crypto_int64) f7_38; - crypto_int64 f4f8_38 = f4_2 * (crypto_int64) f8_19; - crypto_int64 f4f9_38 = f4 * (crypto_int64) f9_38; - crypto_int64 f5f5_38 = f5 * (crypto_int64) f5_38; - crypto_int64 f5f6_38 = f5_2 * (crypto_int64) f6_19; - crypto_int64 f5f7_76 = f5_2 * (crypto_int64) f7_38; - crypto_int64 f5f8_38 = f5_2 * (crypto_int64) f8_19; - crypto_int64 f5f9_76 = f5_2 * (crypto_int64) f9_38; - crypto_int64 f6f6_19 = f6 * (crypto_int64) f6_19; - crypto_int64 f6f7_38 = f6 * (crypto_int64) f7_38; - crypto_int64 f6f8_38 = f6_2 * (crypto_int64) f8_19; - crypto_int64 f6f9_38 = f6 * (crypto_int64) f9_38; - crypto_int64 f7f7_38 = f7 * (crypto_int64) f7_38; - crypto_int64 f7f8_38 = f7_2 * (crypto_int64) f8_19; - crypto_int64 f7f9_76 = f7_2 * (crypto_int64) f9_38; - crypto_int64 f8f8_19 = f8 * (crypto_int64) f8_19; - crypto_int64 f8f9_38 = f8 * (crypto_int64) f9_38; - crypto_int64 f9f9_38 = f9 * (crypto_int64) f9_38; - crypto_int64 h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38; - crypto_int64 h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38; - crypto_int64 h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19; - crypto_int64 h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38; - crypto_int64 h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38; - crypto_int64 h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38; - crypto_int64 h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19; - crypto_int64 h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38; - crypto_int64 h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38; - crypto_int64 h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2; - crypto_int64 carry0; - crypto_int64 carry1; - crypto_int64 carry2; - crypto_int64 carry3; - crypto_int64 carry4; - crypto_int64 carry5; - crypto_int64 carry6; - crypto_int64 carry7; - crypto_int64 carry8; - crypto_int64 carry9; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; + int32_t f0_2 = 2 * f0; + int32_t f1_2 = 2 * f1; + int32_t f2_2 = 2 * f2; + int32_t f3_2 = 2 * f3; + int32_t f4_2 = 2 * f4; + int32_t f5_2 = 2 * f5; + int32_t f6_2 = 2 * f6; + int32_t f7_2 = 2 * f7; + int32_t f5_38 = 38 * f5; /* 1.959375*2^30 */ + int32_t f6_19 = 19 * f6; /* 1.959375*2^30 */ + int32_t f7_38 = 38 * f7; /* 1.959375*2^30 */ + int32_t f8_19 = 19 * f8; /* 1.959375*2^30 */ + int32_t f9_38 = 38 * f9; /* 1.959375*2^30 */ + int64_t f0f0 = f0 * (int64_t) f0; + int64_t f0f1_2 = f0_2 * (int64_t) f1; + int64_t f0f2_2 = f0_2 * (int64_t) f2; + int64_t f0f3_2 = f0_2 * (int64_t) f3; + int64_t f0f4_2 = f0_2 * (int64_t) f4; + int64_t f0f5_2 = f0_2 * (int64_t) f5; + int64_t f0f6_2 = f0_2 * (int64_t) f6; + int64_t f0f7_2 = f0_2 * (int64_t) f7; + int64_t f0f8_2 = f0_2 * (int64_t) f8; + int64_t f0f9_2 = f0_2 * (int64_t) f9; + int64_t f1f1_2 = f1_2 * (int64_t) f1; + int64_t f1f2_2 = f1_2 * (int64_t) f2; + int64_t f1f3_4 = f1_2 * (int64_t) f3_2; + int64_t f1f4_2 = f1_2 * (int64_t) f4; + int64_t f1f5_4 = f1_2 * (int64_t) f5_2; + int64_t f1f6_2 = f1_2 * (int64_t) f6; + int64_t f1f7_4 = f1_2 * (int64_t) f7_2; + int64_t f1f8_2 = f1_2 * (int64_t) f8; + int64_t f1f9_76 = f1_2 * (int64_t) f9_38; + int64_t f2f2 = f2 * (int64_t) f2; + int64_t f2f3_2 = f2_2 * (int64_t) f3; + int64_t f2f4_2 = f2_2 * (int64_t) f4; + int64_t f2f5_2 = f2_2 * (int64_t) f5; + int64_t f2f6_2 = f2_2 * (int64_t) f6; + int64_t f2f7_2 = f2_2 * (int64_t) f7; + int64_t f2f8_38 = f2_2 * (int64_t) f8_19; + int64_t f2f9_38 = f2 * (int64_t) f9_38; + int64_t f3f3_2 = f3_2 * (int64_t) f3; + int64_t f3f4_2 = f3_2 * (int64_t) f4; + int64_t f3f5_4 = f3_2 * (int64_t) f5_2; + int64_t f3f6_2 = f3_2 * (int64_t) f6; + int64_t f3f7_76 = f3_2 * (int64_t) f7_38; + int64_t f3f8_38 = f3_2 * (int64_t) f8_19; + int64_t f3f9_76 = f3_2 * (int64_t) f9_38; + int64_t f4f4 = f4 * (int64_t) f4; + int64_t f4f5_2 = f4_2 * (int64_t) f5; + int64_t f4f6_38 = f4_2 * (int64_t) f6_19; + int64_t f4f7_38 = f4 * (int64_t) f7_38; + int64_t f4f8_38 = f4_2 * (int64_t) f8_19; + int64_t f4f9_38 = f4 * (int64_t) f9_38; + int64_t f5f5_38 = f5 * (int64_t) f5_38; + int64_t f5f6_38 = f5_2 * (int64_t) f6_19; + int64_t f5f7_76 = f5_2 * (int64_t) f7_38; + int64_t f5f8_38 = f5_2 * (int64_t) f8_19; + int64_t f5f9_76 = f5_2 * (int64_t) f9_38; + int64_t f6f6_19 = f6 * (int64_t) f6_19; + int64_t f6f7_38 = f6 * (int64_t) f7_38; + int64_t f6f8_38 = f6_2 * (int64_t) f8_19; + int64_t f6f9_38 = f6 * (int64_t) f9_38; + int64_t f7f7_38 = f7 * (int64_t) f7_38; + int64_t f7f8_38 = f7_2 * (int64_t) f8_19; + int64_t f7f9_76 = f7_2 * (int64_t) f9_38; + int64_t f8f8_19 = f8 * (int64_t) f8_19; + int64_t f8f9_38 = f8 * (int64_t) f9_38; + int64_t f9f9_38 = f9 * (int64_t) f9_38; + int64_t h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38; + int64_t h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38; + int64_t h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19; + int64_t h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38; + int64_t h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38; + int64_t h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38; + int64_t h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19; + int64_t h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38; + int64_t h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38; + int64_t h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2; + int64_t carry0; + int64_t carry1; + int64_t carry2; + int64_t carry3; + int64_t carry4; + int64_t carry5; + int64_t carry6; + int64_t carry7; + int64_t carry8; + int64_t carry9; - carry0 = (h0 + (crypto_int64) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((crypto_uint64) 1L << 26); - carry4 = (h4 + (crypto_int64) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((crypto_uint64) 1L << 26); + carry0 = (h0 + (int64_t) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((uint64_t) 1L << 26); + carry4 = (h4 + (int64_t) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((uint64_t) 1L << 26); - carry1 = (h1 + (crypto_int64) (1L << 24)) >> 25; h2 += carry1; h1 -= carry1 * ((crypto_uint64) 1L << 25); - carry5 = (h5 + (crypto_int64) (1L << 24)) >> 25; h6 += carry5; h5 -= carry5 * ((crypto_uint64) 1L << 25); + carry1 = (h1 + (int64_t) (1L << 24)) >> 25; h2 += carry1; h1 -= carry1 * ((uint64_t) 1L << 25); + carry5 = (h5 + (int64_t) (1L << 24)) >> 25; h6 += carry5; h5 -= carry5 * ((uint64_t) 1L << 25); - carry2 = (h2 + (crypto_int64) (1L << 25)) >> 26; h3 += carry2; h2 -= carry2 * ((crypto_uint64) 1L << 26); - carry6 = (h6 + (crypto_int64) (1L << 25)) >> 26; h7 += carry6; h6 -= carry6 * ((crypto_uint64) 1L << 26); + carry2 = (h2 + (int64_t) (1L << 25)) >> 26; h3 += carry2; h2 -= carry2 * ((uint64_t) 1L << 26); + carry6 = (h6 + (int64_t) (1L << 25)) >> 26; h7 += carry6; h6 -= carry6 * ((uint64_t) 1L << 26); - carry3 = (h3 + (crypto_int64) (1L << 24)) >> 25; h4 += carry3; h3 -= carry3 * ((crypto_uint64) 1L << 25); - carry7 = (h7 + (crypto_int64) (1L << 24)) >> 25; h8 += carry7; h7 -= carry7 * ((crypto_uint64) 1L << 25); + carry3 = (h3 + (int64_t) (1L << 24)) >> 25; h4 += carry3; h3 -= carry3 * ((uint64_t) 1L << 25); + carry7 = (h7 + (int64_t) (1L << 24)) >> 25; h8 += carry7; h7 -= carry7 * ((uint64_t) 1L << 25); - carry4 = (h4 + (crypto_int64) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((crypto_uint64) 1L << 26); - carry8 = (h8 + (crypto_int64) (1L << 25)) >> 26; h9 += carry8; h8 -= carry8 * ((crypto_uint64) 1L << 26); + carry4 = (h4 + (int64_t) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((uint64_t) 1L << 26); + carry8 = (h8 + (int64_t) (1L << 25)) >> 26; h9 += carry8; h8 -= carry8 * ((uint64_t) 1L << 26); - carry9 = (h9 + (crypto_int64) (1L << 24)) >> 25; h0 += carry9 * 19; h9 -= carry9 * ((crypto_uint64) 1L << 25); + carry9 = (h9 + (int64_t) (1L << 24)) >> 25; h0 += carry9 * 19; h9 -= carry9 * ((uint64_t) 1L << 25); - carry0 = (h0 + (crypto_int64) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((crypto_uint64) 1L << 26); + carry0 = (h0 + (int64_t) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((uint64_t) 1L << 26); - h[0] = (crypto_int32) h0; - h[1] = (crypto_int32) h1; - h[2] = (crypto_int32) h2; - h[3] = (crypto_int32) h3; - h[4] = (crypto_int32) h4; - h[5] = (crypto_int32) h5; - h[6] = (crypto_int32) h6; - h[7] = (crypto_int32) h7; - h[8] = (crypto_int32) h8; - h[9] = (crypto_int32) h9; + h[0] = (int32_t) h0; + h[1] = (int32_t) h1; + h[2] = (int32_t) h2; + h[3] = (int32_t) h3; + h[4] = (int32_t) h4; + h[5] = (int32_t) h5; + h[6] = (int32_t) h6; + h[7] = (int32_t) h7; + h[8] = (int32_t) h8; + h[9] = (int32_t) h9; } /* @@ -866,104 +864,104 @@ See fe_mul.c for discussion of implementation strategy. void fe_sq2(fe h,const fe f) { - crypto_int32 f0 = f[0]; - crypto_int32 f1 = f[1]; - crypto_int32 f2 = f[2]; - crypto_int32 f3 = f[3]; - crypto_int32 f4 = f[4]; - crypto_int32 f5 = f[5]; - crypto_int32 f6 = f[6]; - crypto_int32 f7 = f[7]; - crypto_int32 f8 = f[8]; - crypto_int32 f9 = f[9]; - crypto_int32 f0_2 = 2 * f0; - crypto_int32 f1_2 = 2 * f1; - crypto_int32 f2_2 = 2 * f2; - crypto_int32 f3_2 = 2 * f3; - crypto_int32 f4_2 = 2 * f4; - crypto_int32 f5_2 = 2 * f5; - crypto_int32 f6_2 = 2 * f6; - crypto_int32 f7_2 = 2 * f7; - crypto_int32 f5_38 = 38 * f5; /* 1.959375*2^30 */ - crypto_int32 f6_19 = 19 * f6; /* 1.959375*2^30 */ - crypto_int32 f7_38 = 38 * f7; /* 1.959375*2^30 */ - crypto_int32 f8_19 = 19 * f8; /* 1.959375*2^30 */ - crypto_int32 f9_38 = 38 * f9; /* 1.959375*2^30 */ - crypto_int64 f0f0 = f0 * (crypto_int64) f0; - crypto_int64 f0f1_2 = f0_2 * (crypto_int64) f1; - crypto_int64 f0f2_2 = f0_2 * (crypto_int64) f2; - crypto_int64 f0f3_2 = f0_2 * (crypto_int64) f3; - crypto_int64 f0f4_2 = f0_2 * (crypto_int64) f4; - crypto_int64 f0f5_2 = f0_2 * (crypto_int64) f5; - crypto_int64 f0f6_2 = f0_2 * (crypto_int64) f6; - crypto_int64 f0f7_2 = f0_2 * (crypto_int64) f7; - crypto_int64 f0f8_2 = f0_2 * (crypto_int64) f8; - crypto_int64 f0f9_2 = f0_2 * (crypto_int64) f9; - crypto_int64 f1f1_2 = f1_2 * (crypto_int64) f1; - crypto_int64 f1f2_2 = f1_2 * (crypto_int64) f2; - crypto_int64 f1f3_4 = f1_2 * (crypto_int64) f3_2; - crypto_int64 f1f4_2 = f1_2 * (crypto_int64) f4; - crypto_int64 f1f5_4 = f1_2 * (crypto_int64) f5_2; - crypto_int64 f1f6_2 = f1_2 * (crypto_int64) f6; - crypto_int64 f1f7_4 = f1_2 * (crypto_int64) f7_2; - crypto_int64 f1f8_2 = f1_2 * (crypto_int64) f8; - crypto_int64 f1f9_76 = f1_2 * (crypto_int64) f9_38; - crypto_int64 f2f2 = f2 * (crypto_int64) f2; - crypto_int64 f2f3_2 = f2_2 * (crypto_int64) f3; - crypto_int64 f2f4_2 = f2_2 * (crypto_int64) f4; - crypto_int64 f2f5_2 = f2_2 * (crypto_int64) f5; - crypto_int64 f2f6_2 = f2_2 * (crypto_int64) f6; - crypto_int64 f2f7_2 = f2_2 * (crypto_int64) f7; - crypto_int64 f2f8_38 = f2_2 * (crypto_int64) f8_19; - crypto_int64 f2f9_38 = f2 * (crypto_int64) f9_38; - crypto_int64 f3f3_2 = f3_2 * (crypto_int64) f3; - crypto_int64 f3f4_2 = f3_2 * (crypto_int64) f4; - crypto_int64 f3f5_4 = f3_2 * (crypto_int64) f5_2; - crypto_int64 f3f6_2 = f3_2 * (crypto_int64) f6; - crypto_int64 f3f7_76 = f3_2 * (crypto_int64) f7_38; - crypto_int64 f3f8_38 = f3_2 * (crypto_int64) f8_19; - crypto_int64 f3f9_76 = f3_2 * (crypto_int64) f9_38; - crypto_int64 f4f4 = f4 * (crypto_int64) f4; - crypto_int64 f4f5_2 = f4_2 * (crypto_int64) f5; - crypto_int64 f4f6_38 = f4_2 * (crypto_int64) f6_19; - crypto_int64 f4f7_38 = f4 * (crypto_int64) f7_38; - crypto_int64 f4f8_38 = f4_2 * (crypto_int64) f8_19; - crypto_int64 f4f9_38 = f4 * (crypto_int64) f9_38; - crypto_int64 f5f5_38 = f5 * (crypto_int64) f5_38; - crypto_int64 f5f6_38 = f5_2 * (crypto_int64) f6_19; - crypto_int64 f5f7_76 = f5_2 * (crypto_int64) f7_38; - crypto_int64 f5f8_38 = f5_2 * (crypto_int64) f8_19; - crypto_int64 f5f9_76 = f5_2 * (crypto_int64) f9_38; - crypto_int64 f6f6_19 = f6 * (crypto_int64) f6_19; - crypto_int64 f6f7_38 = f6 * (crypto_int64) f7_38; - crypto_int64 f6f8_38 = f6_2 * (crypto_int64) f8_19; - crypto_int64 f6f9_38 = f6 * (crypto_int64) f9_38; - crypto_int64 f7f7_38 = f7 * (crypto_int64) f7_38; - crypto_int64 f7f8_38 = f7_2 * (crypto_int64) f8_19; - crypto_int64 f7f9_76 = f7_2 * (crypto_int64) f9_38; - crypto_int64 f8f8_19 = f8 * (crypto_int64) f8_19; - crypto_int64 f8f9_38 = f8 * (crypto_int64) f9_38; - crypto_int64 f9f9_38 = f9 * (crypto_int64) f9_38; - crypto_int64 h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38; - crypto_int64 h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38; - crypto_int64 h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19; - crypto_int64 h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38; - crypto_int64 h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38; - crypto_int64 h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38; - crypto_int64 h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19; - crypto_int64 h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38; - crypto_int64 h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38; - crypto_int64 h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2; - crypto_int64 carry0; - crypto_int64 carry1; - crypto_int64 carry2; - crypto_int64 carry3; - crypto_int64 carry4; - crypto_int64 carry5; - crypto_int64 carry6; - crypto_int64 carry7; - crypto_int64 carry8; - crypto_int64 carry9; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; + int32_t f0_2 = 2 * f0; + int32_t f1_2 = 2 * f1; + int32_t f2_2 = 2 * f2; + int32_t f3_2 = 2 * f3; + int32_t f4_2 = 2 * f4; + int32_t f5_2 = 2 * f5; + int32_t f6_2 = 2 * f6; + int32_t f7_2 = 2 * f7; + int32_t f5_38 = 38 * f5; /* 1.959375*2^30 */ + int32_t f6_19 = 19 * f6; /* 1.959375*2^30 */ + int32_t f7_38 = 38 * f7; /* 1.959375*2^30 */ + int32_t f8_19 = 19 * f8; /* 1.959375*2^30 */ + int32_t f9_38 = 38 * f9; /* 1.959375*2^30 */ + int64_t f0f0 = f0 * (int64_t) f0; + int64_t f0f1_2 = f0_2 * (int64_t) f1; + int64_t f0f2_2 = f0_2 * (int64_t) f2; + int64_t f0f3_2 = f0_2 * (int64_t) f3; + int64_t f0f4_2 = f0_2 * (int64_t) f4; + int64_t f0f5_2 = f0_2 * (int64_t) f5; + int64_t f0f6_2 = f0_2 * (int64_t) f6; + int64_t f0f7_2 = f0_2 * (int64_t) f7; + int64_t f0f8_2 = f0_2 * (int64_t) f8; + int64_t f0f9_2 = f0_2 * (int64_t) f9; + int64_t f1f1_2 = f1_2 * (int64_t) f1; + int64_t f1f2_2 = f1_2 * (int64_t) f2; + int64_t f1f3_4 = f1_2 * (int64_t) f3_2; + int64_t f1f4_2 = f1_2 * (int64_t) f4; + int64_t f1f5_4 = f1_2 * (int64_t) f5_2; + int64_t f1f6_2 = f1_2 * (int64_t) f6; + int64_t f1f7_4 = f1_2 * (int64_t) f7_2; + int64_t f1f8_2 = f1_2 * (int64_t) f8; + int64_t f1f9_76 = f1_2 * (int64_t) f9_38; + int64_t f2f2 = f2 * (int64_t) f2; + int64_t f2f3_2 = f2_2 * (int64_t) f3; + int64_t f2f4_2 = f2_2 * (int64_t) f4; + int64_t f2f5_2 = f2_2 * (int64_t) f5; + int64_t f2f6_2 = f2_2 * (int64_t) f6; + int64_t f2f7_2 = f2_2 * (int64_t) f7; + int64_t f2f8_38 = f2_2 * (int64_t) f8_19; + int64_t f2f9_38 = f2 * (int64_t) f9_38; + int64_t f3f3_2 = f3_2 * (int64_t) f3; + int64_t f3f4_2 = f3_2 * (int64_t) f4; + int64_t f3f5_4 = f3_2 * (int64_t) f5_2; + int64_t f3f6_2 = f3_2 * (int64_t) f6; + int64_t f3f7_76 = f3_2 * (int64_t) f7_38; + int64_t f3f8_38 = f3_2 * (int64_t) f8_19; + int64_t f3f9_76 = f3_2 * (int64_t) f9_38; + int64_t f4f4 = f4 * (int64_t) f4; + int64_t f4f5_2 = f4_2 * (int64_t) f5; + int64_t f4f6_38 = f4_2 * (int64_t) f6_19; + int64_t f4f7_38 = f4 * (int64_t) f7_38; + int64_t f4f8_38 = f4_2 * (int64_t) f8_19; + int64_t f4f9_38 = f4 * (int64_t) f9_38; + int64_t f5f5_38 = f5 * (int64_t) f5_38; + int64_t f5f6_38 = f5_2 * (int64_t) f6_19; + int64_t f5f7_76 = f5_2 * (int64_t) f7_38; + int64_t f5f8_38 = f5_2 * (int64_t) f8_19; + int64_t f5f9_76 = f5_2 * (int64_t) f9_38; + int64_t f6f6_19 = f6 * (int64_t) f6_19; + int64_t f6f7_38 = f6 * (int64_t) f7_38; + int64_t f6f8_38 = f6_2 * (int64_t) f8_19; + int64_t f6f9_38 = f6 * (int64_t) f9_38; + int64_t f7f7_38 = f7 * (int64_t) f7_38; + int64_t f7f8_38 = f7_2 * (int64_t) f8_19; + int64_t f7f9_76 = f7_2 * (int64_t) f9_38; + int64_t f8f8_19 = f8 * (int64_t) f8_19; + int64_t f8f9_38 = f8 * (int64_t) f9_38; + int64_t f9f9_38 = f9 * (int64_t) f9_38; + int64_t h0 = f0f0 +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38; + int64_t h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38; + int64_t h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19; + int64_t h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38; + int64_t h4 = f0f4_2+f1f3_4 +f2f2 +f5f9_76+f6f8_38+f7f7_38; + int64_t h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38; + int64_t h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19; + int64_t h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38; + int64_t h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4 +f9f9_38; + int64_t h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2; + int64_t carry0; + int64_t carry1; + int64_t carry2; + int64_t carry3; + int64_t carry4; + int64_t carry5; + int64_t carry6; + int64_t carry7; + int64_t carry8; + int64_t carry9; h0 += h0; h1 += h1; @@ -976,35 +974,35 @@ void fe_sq2(fe h,const fe f) h8 += h8; h9 += h9; - carry0 = (h0 + (crypto_int64) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((crypto_uint64) 1L << 26); - carry4 = (h4 + (crypto_int64) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((crypto_uint64) 1L << 26); + carry0 = (h0 + (int64_t) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((uint64_t) 1L << 26); + carry4 = (h4 + (int64_t) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((uint64_t) 1L << 26); - carry1 = (h1 + (crypto_int64) (1L << 24)) >> 25; h2 += carry1; h1 -= carry1 * ((crypto_uint64) 1L << 25); - carry5 = (h5 + (crypto_int64) (1L << 24)) >> 25; h6 += carry5; h5 -= carry5 * ((crypto_uint64) 1L << 25); + carry1 = (h1 + (int64_t) (1L << 24)) >> 25; h2 += carry1; h1 -= carry1 * ((uint64_t) 1L << 25); + carry5 = (h5 + (int64_t) (1L << 24)) >> 25; h6 += carry5; h5 -= carry5 * ((uint64_t) 1L << 25); - carry2 = (h2 + (crypto_int64) (1L << 25)) >> 26; h3 += carry2; h2 -= carry2 * ((crypto_uint64) 1L << 26); - carry6 = (h6 + (crypto_int64) (1L << 25)) >> 26; h7 += carry6; h6 -= carry6 * ((crypto_uint64) 1L << 26); + carry2 = (h2 + (int64_t) (1L << 25)) >> 26; h3 += carry2; h2 -= carry2 * ((uint64_t) 1L << 26); + carry6 = (h6 + (int64_t) (1L << 25)) >> 26; h7 += carry6; h6 -= carry6 * ((uint64_t) 1L << 26); - carry3 = (h3 + (crypto_int64) (1L << 24)) >> 25; h4 += carry3; h3 -= carry3 * ((crypto_uint64) 1L << 25); - carry7 = (h7 + (crypto_int64) (1L << 24)) >> 25; h8 += carry7; h7 -= carry7 * ((crypto_uint64) 1L << 25); + carry3 = (h3 + (int64_t) (1L << 24)) >> 25; h4 += carry3; h3 -= carry3 * ((uint64_t) 1L << 25); + carry7 = (h7 + (int64_t) (1L << 24)) >> 25; h8 += carry7; h7 -= carry7 * ((uint64_t) 1L << 25); - carry4 = (h4 + (crypto_int64) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((crypto_uint64) 1L << 26); - carry8 = (h8 + (crypto_int64) (1L << 25)) >> 26; h9 += carry8; h8 -= carry8 * ((crypto_uint64) 1L << 26); + carry4 = (h4 + (int64_t) (1L << 25)) >> 26; h5 += carry4; h4 -= carry4 * ((uint64_t) 1L << 26); + carry8 = (h8 + (int64_t) (1L << 25)) >> 26; h9 += carry8; h8 -= carry8 * ((uint64_t) 1L << 26); - carry9 = (h9 + (crypto_int64) (1L << 24)) >> 25; h0 += carry9 * 19; h9 -= carry9 * ((crypto_uint64) 1L << 25); + carry9 = (h9 + (int64_t) (1L << 24)) >> 25; h0 += carry9 * 19; h9 -= carry9 * ((uint64_t) 1L << 25); - carry0 = (h0 + (crypto_int64) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((crypto_uint64) 1L << 26); + carry0 = (h0 + (int64_t) (1L << 25)) >> 26; h1 += carry0; h0 -= carry0 * ((uint64_t) 1L << 26); - h[0] = (crypto_int32) h0; - h[1] = (crypto_int32) h1; - h[2] = (crypto_int32) h2; - h[3] = (crypto_int32) h3; - h[4] = (crypto_int32) h4; - h[5] = (crypto_int32) h5; - h[6] = (crypto_int32) h6; - h[7] = (crypto_int32) h7; - h[8] = (crypto_int32) h8; - h[9] = (crypto_int32) h9; + h[0] = (int32_t) h0; + h[1] = (int32_t) h1; + h[2] = (int32_t) h2; + h[3] = (int32_t) h3; + h[4] = (int32_t) h4; + h[5] = (int32_t) h5; + h[6] = (int32_t) h6; + h[7] = (int32_t) h7; + h[8] = (int32_t) h8; + h[9] = (int32_t) h9; } void fe_invert(fe out,const fe z) @@ -1150,36 +1148,36 @@ Postconditions: void fe_sub(fe h,const fe f,const fe g) { - crypto_int32 f0 = f[0]; - crypto_int32 f1 = f[1]; - crypto_int32 f2 = f[2]; - crypto_int32 f3 = f[3]; - crypto_int32 f4 = f[4]; - crypto_int32 f5 = f[5]; - crypto_int32 f6 = f[6]; - crypto_int32 f7 = f[7]; - crypto_int32 f8 = f[8]; - crypto_int32 f9 = f[9]; - crypto_int32 g0 = g[0]; - crypto_int32 g1 = g[1]; - crypto_int32 g2 = g[2]; - crypto_int32 g3 = g[3]; - crypto_int32 g4 = g[4]; - crypto_int32 g5 = g[5]; - crypto_int32 g6 = g[6]; - crypto_int32 g7 = g[7]; - crypto_int32 g8 = g[8]; - crypto_int32 g9 = g[9]; - crypto_int32 h0 = f0 - g0; - crypto_int32 h1 = f1 - g1; - crypto_int32 h2 = f2 - g2; - crypto_int32 h3 = f3 - g3; - crypto_int32 h4 = f4 - g4; - crypto_int32 h5 = f5 - g5; - crypto_int32 h6 = f6 - g6; - crypto_int32 h7 = f7 - g7; - crypto_int32 h8 = f8 - g8; - crypto_int32 h9 = f9 - g9; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; + int32_t g0 = g[0]; + int32_t g1 = g[1]; + int32_t g2 = g[2]; + int32_t g3 = g[3]; + int32_t g4 = g[4]; + int32_t g5 = g[5]; + int32_t g6 = g[6]; + int32_t g7 = g[7]; + int32_t g8 = g[8]; + int32_t g9 = g[9]; + int32_t h0 = f0 - g0; + int32_t h1 = f1 - g1; + int32_t h2 = f2 - g2; + int32_t h3 = f3 - g3; + int32_t h4 = f4 - g4; + int32_t h5 = f5 - g5; + int32_t h6 = f6 - g6; + int32_t h7 = f7 - g7; + int32_t h8 = f8 - g8; + int32_t h9 = f9 - g9; h[0] = h0; h[1] = h1; h[2] = h2; @@ -1458,7 +1456,7 @@ static unsigned char equal(signed char b,signed char c) unsigned char ub = b; unsigned char uc = c; unsigned char x = ub ^ uc; /* 0: yes; 1..255: no */ - crypto_uint32 y = x; /* 0: yes; 1..255: no */ + uint32_t y = x; /* 0: yes; 1..255: no */ y -= 1; /* 4294967295: yes; 0..254: no */ y >>= 31; /* 1: yes; 0: no */ return y; @@ -1466,7 +1464,7 @@ static unsigned char equal(signed char b,signed char c) static unsigned char negative(signed char b) { - crypto_uint64 x = b; /* 18446744073709551361..18446744073709551615: yes; 0..255: no */ + uint64_t x = b; /* 18446744073709551361..18446744073709551615: yes; 0..255: no */ x >>= 63; /* 1: yes; 0: no */ return x; } @@ -1704,89 +1702,89 @@ Output: void sc_muladd(unsigned char *s,const unsigned char *a,const unsigned char *b,const unsigned char *c) { - crypto_int64 a0 = 2097151 & load_3(a); - crypto_int64 a1 = 2097151 & (load_4(a + 2) >> 5); - crypto_int64 a2 = 2097151 & (load_3(a + 5) >> 2); - crypto_int64 a3 = 2097151 & (load_4(a + 7) >> 7); - crypto_int64 a4 = 2097151 & (load_4(a + 10) >> 4); - crypto_int64 a5 = 2097151 & (load_3(a + 13) >> 1); - crypto_int64 a6 = 2097151 & (load_4(a + 15) >> 6); - crypto_int64 a7 = 2097151 & (load_3(a + 18) >> 3); - crypto_int64 a8 = 2097151 & load_3(a + 21); - crypto_int64 a9 = 2097151 & (load_4(a + 23) >> 5); - crypto_int64 a10 = 2097151 & (load_3(a + 26) >> 2); - crypto_int64 a11 = (load_4(a + 28) >> 7); - crypto_int64 b0 = 2097151 & load_3(b); - crypto_int64 b1 = 2097151 & (load_4(b + 2) >> 5); - crypto_int64 b2 = 2097151 & (load_3(b + 5) >> 2); - crypto_int64 b3 = 2097151 & (load_4(b + 7) >> 7); - crypto_int64 b4 = 2097151 & (load_4(b + 10) >> 4); - crypto_int64 b5 = 2097151 & (load_3(b + 13) >> 1); - crypto_int64 b6 = 2097151 & (load_4(b + 15) >> 6); - crypto_int64 b7 = 2097151 & (load_3(b + 18) >> 3); - crypto_int64 b8 = 2097151 & load_3(b + 21); - crypto_int64 b9 = 2097151 & (load_4(b + 23) >> 5); - crypto_int64 b10 = 2097151 & (load_3(b + 26) >> 2); - crypto_int64 b11 = (load_4(b + 28) >> 7); - crypto_int64 c0 = 2097151 & load_3(c); - crypto_int64 c1 = 2097151 & (load_4(c + 2) >> 5); - crypto_int64 c2 = 2097151 & (load_3(c + 5) >> 2); - crypto_int64 c3 = 2097151 & (load_4(c + 7) >> 7); - crypto_int64 c4 = 2097151 & (load_4(c + 10) >> 4); - crypto_int64 c5 = 2097151 & (load_3(c + 13) >> 1); - crypto_int64 c6 = 2097151 & (load_4(c + 15) >> 6); - crypto_int64 c7 = 2097151 & (load_3(c + 18) >> 3); - crypto_int64 c8 = 2097151 & load_3(c + 21); - crypto_int64 c9 = 2097151 & (load_4(c + 23) >> 5); - crypto_int64 c10 = 2097151 & (load_3(c + 26) >> 2); - crypto_int64 c11 = (load_4(c + 28) >> 7); - crypto_int64 s0; - crypto_int64 s1; - crypto_int64 s2; - crypto_int64 s3; - crypto_int64 s4; - crypto_int64 s5; - crypto_int64 s6; - crypto_int64 s7; - crypto_int64 s8; - crypto_int64 s9; - crypto_int64 s10; - crypto_int64 s11; - crypto_int64 s12; - crypto_int64 s13; - crypto_int64 s14; - crypto_int64 s15; - crypto_int64 s16; - crypto_int64 s17; - crypto_int64 s18; - crypto_int64 s19; - crypto_int64 s20; - crypto_int64 s21; - crypto_int64 s22; - crypto_int64 s23; - crypto_int64 carry0; - crypto_int64 carry1; - crypto_int64 carry2; - crypto_int64 carry3; - crypto_int64 carry4; - crypto_int64 carry5; - crypto_int64 carry6; - crypto_int64 carry7; - crypto_int64 carry8; - crypto_int64 carry9; - crypto_int64 carry10; - crypto_int64 carry11; - crypto_int64 carry12; - crypto_int64 carry13; - crypto_int64 carry14; - crypto_int64 carry15; - crypto_int64 carry16; - crypto_int64 carry17; - crypto_int64 carry18; - crypto_int64 carry19; - crypto_int64 carry20; - crypto_int64 carry21; - crypto_int64 carry22; + int64_t a0 = 2097151 & load_3(a); + int64_t a1 = 2097151 & (load_4(a + 2) >> 5); + int64_t a2 = 2097151 & (load_3(a + 5) >> 2); + int64_t a3 = 2097151 & (load_4(a + 7) >> 7); + int64_t a4 = 2097151 & (load_4(a + 10) >> 4); + int64_t a5 = 2097151 & (load_3(a + 13) >> 1); + int64_t a6 = 2097151 & (load_4(a + 15) >> 6); + int64_t a7 = 2097151 & (load_3(a + 18) >> 3); + int64_t a8 = 2097151 & load_3(a + 21); + int64_t a9 = 2097151 & (load_4(a + 23) >> 5); + int64_t a10 = 2097151 & (load_3(a + 26) >> 2); + int64_t a11 = (load_4(a + 28) >> 7); + int64_t b0 = 2097151 & load_3(b); + int64_t b1 = 2097151 & (load_4(b + 2) >> 5); + int64_t b2 = 2097151 & (load_3(b + 5) >> 2); + int64_t b3 = 2097151 & (load_4(b + 7) >> 7); + int64_t b4 = 2097151 & (load_4(b + 10) >> 4); + int64_t b5 = 2097151 & (load_3(b + 13) >> 1); + int64_t b6 = 2097151 & (load_4(b + 15) >> 6); + int64_t b7 = 2097151 & (load_3(b + 18) >> 3); + int64_t b8 = 2097151 & load_3(b + 21); + int64_t b9 = 2097151 & (load_4(b + 23) >> 5); + int64_t b10 = 2097151 & (load_3(b + 26) >> 2); + int64_t b11 = (load_4(b + 28) >> 7); + int64_t c0 = 2097151 & load_3(c); + int64_t c1 = 2097151 & (load_4(c + 2) >> 5); + int64_t c2 = 2097151 & (load_3(c + 5) >> 2); + int64_t c3 = 2097151 & (load_4(c + 7) >> 7); + int64_t c4 = 2097151 & (load_4(c + 10) >> 4); + int64_t c5 = 2097151 & (load_3(c + 13) >> 1); + int64_t c6 = 2097151 & (load_4(c + 15) >> 6); + int64_t c7 = 2097151 & (load_3(c + 18) >> 3); + int64_t c8 = 2097151 & load_3(c + 21); + int64_t c9 = 2097151 & (load_4(c + 23) >> 5); + int64_t c10 = 2097151 & (load_3(c + 26) >> 2); + int64_t c11 = (load_4(c + 28) >> 7); + int64_t s0; + int64_t s1; + int64_t s2; + int64_t s3; + int64_t s4; + int64_t s5; + int64_t s6; + int64_t s7; + int64_t s8; + int64_t s9; + int64_t s10; + int64_t s11; + int64_t s12; + int64_t s13; + int64_t s14; + int64_t s15; + int64_t s16; + int64_t s17; + int64_t s18; + int64_t s19; + int64_t s20; + int64_t s21; + int64_t s22; + int64_t s23; + int64_t carry0; + int64_t carry1; + int64_t carry2; + int64_t carry3; + int64_t carry4; + int64_t carry5; + int64_t carry6; + int64_t carry7; + int64_t carry8; + int64_t carry9; + int64_t carry10; + int64_t carry11; + int64_t carry12; + int64_t carry13; + int64_t carry14; + int64_t carry15; + int64_t carry16; + int64_t carry17; + int64_t carry18; + int64_t carry19; + int64_t carry20; + int64_t carry21; + int64_t carry22; s0 = c0 + a0*b0; s1 = c1 + a0*b1 + a1*b0; @@ -1813,30 +1811,30 @@ void sc_muladd(unsigned char *s,const unsigned char *a,const unsigned char *b,co s22 = a11*b11; s23 = 0; - carry0 = (s0 + (crypto_int64) (1L << 20)) >> 21; s1 += carry0; s0 -= carry0 * ((crypto_uint64) 1L << 21); - carry2 = (s2 + (crypto_int64) (1L << 20)) >> 21; s3 += carry2; s2 -= carry2 * ((crypto_uint64) 1L << 21); - carry4 = (s4 + (crypto_int64) (1L << 20)) >> 21; s5 += carry4; s4 -= carry4 * ((crypto_uint64) 1L << 21); - carry6 = (s6 + (crypto_int64) (1L << 20)) >> 21; s7 += carry6; s6 -= carry6 * ((crypto_uint64) 1L << 21); - carry8 = (s8 + (crypto_int64) (1L << 20)) >> 21; s9 += carry8; s8 -= carry8 * ((crypto_uint64) 1L << 21); - carry10 = (s10 + (crypto_int64) (1L << 20)) >> 21; s11 += carry10; s10 -= carry10 * ((crypto_uint64) 1L << 21); - carry12 = (s12 + (crypto_int64) (1L << 20)) >> 21; s13 += carry12; s12 -= carry12 * ((crypto_uint64) 1L << 21); - carry14 = (s14 + (crypto_int64) (1L << 20)) >> 21; s15 += carry14; s14 -= carry14 * ((crypto_uint64) 1L << 21); - carry16 = (s16 + (crypto_int64) (1L << 20)) >> 21; s17 += carry16; s16 -= carry16 * ((crypto_uint64) 1L << 21); - carry18 = (s18 + (crypto_int64) (1L << 20)) >> 21; s19 += carry18; s18 -= carry18 * ((crypto_uint64) 1L << 21); - carry20 = (s20 + (crypto_int64) (1L << 20)) >> 21; s21 += carry20; s20 -= carry20 * ((crypto_uint64) 1L << 21); - carry22 = (s22 + (crypto_int64) (1L << 20)) >> 21; s23 += carry22; s22 -= carry22 * ((crypto_uint64) 1L << 21); + carry0 = (s0 + (int64_t) (1L << 20)) >> 21; s1 += carry0; s0 -= carry0 * ((uint64_t) 1L << 21); + carry2 = (s2 + (int64_t) (1L << 20)) >> 21; s3 += carry2; s2 -= carry2 * ((uint64_t) 1L << 21); + carry4 = (s4 + (int64_t) (1L << 20)) >> 21; s5 += carry4; s4 -= carry4 * ((uint64_t) 1L << 21); + carry6 = (s6 + (int64_t) (1L << 20)) >> 21; s7 += carry6; s6 -= carry6 * ((uint64_t) 1L << 21); + carry8 = (s8 + (int64_t) (1L << 20)) >> 21; s9 += carry8; s8 -= carry8 * ((uint64_t) 1L << 21); + carry10 = (s10 + (int64_t) (1L << 20)) >> 21; s11 += carry10; s10 -= carry10 * ((uint64_t) 1L << 21); + carry12 = (s12 + (int64_t) (1L << 20)) >> 21; s13 += carry12; s12 -= carry12 * ((uint64_t) 1L << 21); + carry14 = (s14 + (int64_t) (1L << 20)) >> 21; s15 += carry14; s14 -= carry14 * ((uint64_t) 1L << 21); + carry16 = (s16 + (int64_t) (1L << 20)) >> 21; s17 += carry16; s16 -= carry16 * ((uint64_t) 1L << 21); + carry18 = (s18 + (int64_t) (1L << 20)) >> 21; s19 += carry18; s18 -= carry18 * ((uint64_t) 1L << 21); + carry20 = (s20 + (int64_t) (1L << 20)) >> 21; s21 += carry20; s20 -= carry20 * ((uint64_t) 1L << 21); + carry22 = (s22 + (int64_t) (1L << 20)) >> 21; s23 += carry22; s22 -= carry22 * ((uint64_t) 1L << 21); - carry1 = (s1 + (crypto_int64) (1L << 20)) >> 21; s2 += carry1; s1 -= carry1 * ((crypto_uint64) 1L << 21); - carry3 = (s3 + (crypto_int64) (1L << 20)) >> 21; s4 += carry3; s3 -= carry3 * ((crypto_uint64) 1L << 21); - carry5 = (s5 + (crypto_int64) (1L << 20)) >> 21; s6 += carry5; s5 -= carry5 * ((crypto_uint64) 1L << 21); - carry7 = (s7 + (crypto_int64) (1L << 20)) >> 21; s8 += carry7; s7 -= carry7 * ((crypto_uint64) 1L << 21); - carry9 = (s9 + (crypto_int64) (1L << 20)) >> 21; s10 += carry9; s9 -= carry9 * ((crypto_uint64) 1L << 21); - carry11 = (s11 + (crypto_int64) (1L << 20)) >> 21; s12 += carry11; s11 -= carry11 * ((crypto_uint64) 1L << 21); - carry13 = (s13 + (crypto_int64) (1L << 20)) >> 21; s14 += carry13; s13 -= carry13 * ((crypto_uint64) 1L << 21); - carry15 = (s15 + (crypto_int64) (1L << 20)) >> 21; s16 += carry15; s15 -= carry15 * ((crypto_uint64) 1L << 21); - carry17 = (s17 + (crypto_int64) (1L << 20)) >> 21; s18 += carry17; s17 -= carry17 * ((crypto_uint64) 1L << 21); - carry19 = (s19 + (crypto_int64) (1L << 20)) >> 21; s20 += carry19; s19 -= carry19 * ((crypto_uint64) 1L << 21); - carry21 = (s21 + (crypto_int64) (1L << 20)) >> 21; s22 += carry21; s21 -= carry21 * ((crypto_uint64) 1L << 21); + carry1 = (s1 + (int64_t) (1L << 20)) >> 21; s2 += carry1; s1 -= carry1 * ((uint64_t) 1L << 21); + carry3 = (s3 + (int64_t) (1L << 20)) >> 21; s4 += carry3; s3 -= carry3 * ((uint64_t) 1L << 21); + carry5 = (s5 + (int64_t) (1L << 20)) >> 21; s6 += carry5; s5 -= carry5 * ((uint64_t) 1L << 21); + carry7 = (s7 + (int64_t) (1L << 20)) >> 21; s8 += carry7; s7 -= carry7 * ((uint64_t) 1L << 21); + carry9 = (s9 + (int64_t) (1L << 20)) >> 21; s10 += carry9; s9 -= carry9 * ((uint64_t) 1L << 21); + carry11 = (s11 + (int64_t) (1L << 20)) >> 21; s12 += carry11; s11 -= carry11 * ((uint64_t) 1L << 21); + carry13 = (s13 + (int64_t) (1L << 20)) >> 21; s14 += carry13; s13 -= carry13 * ((uint64_t) 1L << 21); + carry15 = (s15 + (int64_t) (1L << 20)) >> 21; s16 += carry15; s15 -= carry15 * ((uint64_t) 1L << 21); + carry17 = (s17 + (int64_t) (1L << 20)) >> 21; s18 += carry17; s17 -= carry17 * ((uint64_t) 1L << 21); + carry19 = (s19 + (int64_t) (1L << 20)) >> 21; s20 += carry19; s19 -= carry19 * ((uint64_t) 1L << 21); + carry21 = (s21 + (int64_t) (1L << 20)) >> 21; s22 += carry21; s21 -= carry21 * ((uint64_t) 1L << 21); s11 += s23 * 666643; s12 += s23 * 470296; @@ -1880,18 +1878,18 @@ void sc_muladd(unsigned char *s,const unsigned char *a,const unsigned char *b,co s10 += s18 * 136657; s11 -= s18 * 683901; - carry6 = (s6 + (crypto_int64) (1L << 20)) >> 21; s7 += carry6; s6 -= carry6 * ((crypto_uint64) 1L << 21); - carry8 = (s8 + (crypto_int64) (1L << 20)) >> 21; s9 += carry8; s8 -= carry8 * ((crypto_uint64) 1L << 21); - carry10 = (s10 + (crypto_int64) (1L << 20)) >> 21; s11 += carry10; s10 -= carry10 * ((crypto_uint64) 1L << 21); - carry12 = (s12 + (crypto_int64) (1L << 20)) >> 21; s13 += carry12; s12 -= carry12 * ((crypto_uint64) 1L << 21); - carry14 = (s14 + (crypto_int64) (1L << 20)) >> 21; s15 += carry14; s14 -= carry14 * ((crypto_uint64) 1L << 21); - carry16 = (s16 + (crypto_int64) (1L << 20)) >> 21; s17 += carry16; s16 -= carry16 * ((crypto_uint64) 1L << 21); + carry6 = (s6 + (int64_t) (1L << 20)) >> 21; s7 += carry6; s6 -= carry6 * ((uint64_t) 1L << 21); + carry8 = (s8 + (int64_t) (1L << 20)) >> 21; s9 += carry8; s8 -= carry8 * ((uint64_t) 1L << 21); + carry10 = (s10 + (int64_t) (1L << 20)) >> 21; s11 += carry10; s10 -= carry10 * ((uint64_t) 1L << 21); + carry12 = (s12 + (int64_t) (1L << 20)) >> 21; s13 += carry12; s12 -= carry12 * ((uint64_t) 1L << 21); + carry14 = (s14 + (int64_t) (1L << 20)) >> 21; s15 += carry14; s14 -= carry14 * ((uint64_t) 1L << 21); + carry16 = (s16 + (int64_t) (1L << 20)) >> 21; s17 += carry16; s16 -= carry16 * ((uint64_t) 1L << 21); - carry7 = (s7 + (crypto_int64) (1L << 20)) >> 21; s8 += carry7; s7 -= carry7 * ((crypto_uint64) 1L << 21); - carry9 = (s9 + (crypto_int64) (1L << 20)) >> 21; s10 += carry9; s9 -= carry9 * ((crypto_uint64) 1L << 21); - carry11 = (s11 + (crypto_int64) (1L << 20)) >> 21; s12 += carry11; s11 -= carry11 * ((crypto_uint64) 1L << 21); - carry13 = (s13 + (crypto_int64) (1L << 20)) >> 21; s14 += carry13; s13 -= carry13 * ((crypto_uint64) 1L << 21); - carry15 = (s15 + (crypto_int64) (1L << 20)) >> 21; s16 += carry15; s15 -= carry15 * ((crypto_uint64) 1L << 21); + carry7 = (s7 + (int64_t) (1L << 20)) >> 21; s8 += carry7; s7 -= carry7 * ((uint64_t) 1L << 21); + carry9 = (s9 + (int64_t) (1L << 20)) >> 21; s10 += carry9; s9 -= carry9 * ((uint64_t) 1L << 21); + carry11 = (s11 + (int64_t) (1L << 20)) >> 21; s12 += carry11; s11 -= carry11 * ((uint64_t) 1L << 21); + carry13 = (s13 + (int64_t) (1L << 20)) >> 21; s14 += carry13; s13 -= carry13 * ((uint64_t) 1L << 21); + carry15 = (s15 + (int64_t) (1L << 20)) >> 21; s16 += carry15; s15 -= carry15 * ((uint64_t) 1L << 21); s5 += s17 * 666643; s6 += s17 * 470296; @@ -1936,19 +1934,19 @@ void sc_muladd(unsigned char *s,const unsigned char *a,const unsigned char *b,co s5 -= s12 * 683901; s12 = 0; - carry0 = (s0 + (crypto_int64) (1L << 20)) >> 21; s1 += carry0; s0 -= carry0 * ((crypto_uint64) 1L << 21); - carry2 = (s2 + (crypto_int64) (1L << 20)) >> 21; s3 += carry2; s2 -= carry2 * ((crypto_uint64) 1L << 21); - carry4 = (s4 + (crypto_int64) (1L << 20)) >> 21; s5 += carry4; s4 -= carry4 * ((crypto_uint64) 1L << 21); - carry6 = (s6 + (crypto_int64) (1L << 20)) >> 21; s7 += carry6; s6 -= carry6 * ((crypto_uint64) 1L << 21); - carry8 = (s8 + (crypto_int64) (1L << 20)) >> 21; s9 += carry8; s8 -= carry8 * ((crypto_uint64) 1L << 21); - carry10 = (s10 + (crypto_int64) (1L << 20)) >> 21; s11 += carry10; s10 -= carry10 * ((crypto_uint64) 1L << 21); + carry0 = (s0 + (int64_t) (1L << 20)) >> 21; s1 += carry0; s0 -= carry0 * ((uint64_t) 1L << 21); + carry2 = (s2 + (int64_t) (1L << 20)) >> 21; s3 += carry2; s2 -= carry2 * ((uint64_t) 1L << 21); + carry4 = (s4 + (int64_t) (1L << 20)) >> 21; s5 += carry4; s4 -= carry4 * ((uint64_t) 1L << 21); + carry6 = (s6 + (int64_t) (1L << 20)) >> 21; s7 += carry6; s6 -= carry6 * ((uint64_t) 1L << 21); + carry8 = (s8 + (int64_t) (1L << 20)) >> 21; s9 += carry8; s8 -= carry8 * ((uint64_t) 1L << 21); + carry10 = (s10 + (int64_t) (1L << 20)) >> 21; s11 += carry10; s10 -= carry10 * ((uint64_t) 1L << 21); - carry1 = (s1 + (crypto_int64) (1L << 20)) >> 21; s2 += carry1; s1 -= carry1 * ((crypto_uint64) 1L << 21); - carry3 = (s3 + (crypto_int64) (1L << 20)) >> 21; s4 += carry3; s3 -= carry3 * ((crypto_uint64) 1L << 21); - carry5 = (s5 + (crypto_int64) (1L << 20)) >> 21; s6 += carry5; s5 -= carry5 * ((crypto_uint64) 1L << 21); - carry7 = (s7 + (crypto_int64) (1L << 20)) >> 21; s8 += carry7; s7 -= carry7 * ((crypto_uint64) 1L << 21); - carry9 = (s9 + (crypto_int64) (1L << 20)) >> 21; s10 += carry9; s9 -= carry9 * ((crypto_uint64) 1L << 21); - carry11 = (s11 + (crypto_int64) (1L << 20)) >> 21; s12 += carry11; s11 -= carry11 * ((crypto_uint64) 1L << 21); + carry1 = (s1 + (int64_t) (1L << 20)) >> 21; s2 += carry1; s1 -= carry1 * ((uint64_t) 1L << 21); + carry3 = (s3 + (int64_t) (1L << 20)) >> 21; s4 += carry3; s3 -= carry3 * ((uint64_t) 1L << 21); + carry5 = (s5 + (int64_t) (1L << 20)) >> 21; s6 += carry5; s5 -= carry5 * ((uint64_t) 1L << 21); + carry7 = (s7 + (int64_t) (1L << 20)) >> 21; s8 += carry7; s7 -= carry7 * ((uint64_t) 1L << 21); + carry9 = (s9 + (int64_t) (1L << 20)) >> 21; s10 += carry9; s9 -= carry9 * ((uint64_t) 1L << 21); + carry11 = (s11 + (int64_t) (1L << 20)) >> 21; s12 += carry11; s11 -= carry11 * ((uint64_t) 1L << 21); s0 += s12 * 666643; s1 += s12 * 470296; @@ -1958,18 +1956,18 @@ void sc_muladd(unsigned char *s,const unsigned char *a,const unsigned char *b,co s5 -= s12 * 683901; s12 = 0; - carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 * ((crypto_uint64) 1L << 21); - carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 * ((crypto_uint64) 1L << 21); - carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 * ((crypto_uint64) 1L << 21); - carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 * ((crypto_uint64) 1L << 21); - carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 * ((crypto_uint64) 1L << 21); - carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 * ((crypto_uint64) 1L << 21); - carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 * ((crypto_uint64) 1L << 21); - carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 * ((crypto_uint64) 1L << 21); - carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 * ((crypto_uint64) 1L << 21); - carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 * ((crypto_uint64) 1L << 21); - carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 * ((crypto_uint64) 1L << 21); - carry11 = s11 >> 21; s12 += carry11; s11 -= carry11 * ((crypto_uint64) 1L << 21); + carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 * ((uint64_t) 1L << 21); + carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 * ((uint64_t) 1L << 21); + carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 * ((uint64_t) 1L << 21); + carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 * ((uint64_t) 1L << 21); + carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 * ((uint64_t) 1L << 21); + carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 * ((uint64_t) 1L << 21); + carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 * ((uint64_t) 1L << 21); + carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 * ((uint64_t) 1L << 21); + carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 * ((uint64_t) 1L << 21); + carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 * ((uint64_t) 1L << 21); + carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 * ((uint64_t) 1L << 21); + carry11 = s11 >> 21; s12 += carry11; s11 -= carry11 * ((uint64_t) 1L << 21); s0 += s12 * 666643; s1 += s12 * 470296; @@ -1978,47 +1976,47 @@ void sc_muladd(unsigned char *s,const unsigned char *a,const unsigned char *b,co s4 += s12 * 136657; s5 -= s12 * 683901; - carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 * ((crypto_uint64) 1L << 21); - carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 * ((crypto_uint64) 1L << 21); - carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 * ((crypto_uint64) 1L << 21); - carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 * ((crypto_uint64) 1L << 21); - carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 * ((crypto_uint64) 1L << 21); - carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 * ((crypto_uint64) 1L << 21); - carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 * ((crypto_uint64) 1L << 21); - carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 * ((crypto_uint64) 1L << 21); - carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 * ((crypto_uint64) 1L << 21); - carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 * ((crypto_uint64) 1L << 21); - carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 * ((crypto_uint64) 1L << 21); + carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 * ((uint64_t) 1L << 21); + carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 * ((uint64_t) 1L << 21); + carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 * ((uint64_t) 1L << 21); + carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 * ((uint64_t) 1L << 21); + carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 * ((uint64_t) 1L << 21); + carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 * ((uint64_t) 1L << 21); + carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 * ((uint64_t) 1L << 21); + carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 * ((uint64_t) 1L << 21); + carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 * ((uint64_t) 1L << 21); + carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 * ((uint64_t) 1L << 21); + carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 * ((uint64_t) 1L << 21); s[0] = s0 >> 0; s[1] = s0 >> 8; - s[2] = (s0 >> 16) | (s1 * ((crypto_uint64) 1 << 5)); + s[2] = (s0 >> 16) | (s1 * ((uint64_t) 1 << 5)); s[3] = s1 >> 3; s[4] = s1 >> 11; - s[5] = (s1 >> 19) | (s2 * ((crypto_uint64) 1 << 2)); + s[5] = (s1 >> 19) | (s2 * ((uint64_t) 1 << 2)); s[6] = s2 >> 6; - s[7] = (s2 >> 14) | (s3 * ((crypto_uint64) 1 << 7)); + s[7] = (s2 >> 14) | (s3 * ((uint64_t) 1 << 7)); s[8] = s3 >> 1; s[9] = s3 >> 9; - s[10] = (s3 >> 17) | (s4 * ((crypto_uint64) 1 << 4)); + s[10] = (s3 >> 17) | (s4 * ((uint64_t) 1 << 4)); s[11] = s4 >> 4; s[12] = s4 >> 12; - s[13] = (s4 >> 20) | (s5 * ((crypto_uint64) 1 << 1)); + s[13] = (s4 >> 20) | (s5 * ((uint64_t) 1 << 1)); s[14] = s5 >> 7; - s[15] = (s5 >> 15) | (s6 * ((crypto_uint64) 1 << 6)); + s[15] = (s5 >> 15) | (s6 * ((uint64_t) 1 << 6)); s[16] = s6 >> 2; s[17] = s6 >> 10; - s[18] = (s6 >> 18) | (s7 * ((crypto_uint64) 1 << 3)); + s[18] = (s6 >> 18) | (s7 * ((uint64_t) 1 << 3)); s[19] = s7 >> 5; s[20] = s7 >> 13; s[21] = s8 >> 0; s[22] = s8 >> 8; - s[23] = (s8 >> 16) | (s9 * ((crypto_uint64) 1 << 5)); + s[23] = (s8 >> 16) | (s9 * ((uint64_t) 1 << 5)); s[24] = s9 >> 3; s[25] = s9 >> 11; - s[26] = (s9 >> 19) | (s10 * ((crypto_uint64) 1 << 2)); + s[26] = (s9 >> 19) | (s10 * ((uint64_t) 1 << 2)); s[27] = s10 >> 6; - s[28] = (s10 >> 14) | (s11 * ((crypto_uint64) 1 << 7)); + s[28] = (s10 >> 14) | (s11 * ((uint64_t) 1 << 7)); s[29] = s11 >> 1; s[30] = s11 >> 9; s[31] = s11 >> 17; @@ -2036,47 +2034,47 @@ Output: void sc_reduce(unsigned char *s) { - crypto_int64 s0 = 2097151 & load_3(s); - crypto_int64 s1 = 2097151 & (load_4(s + 2) >> 5); - crypto_int64 s2 = 2097151 & (load_3(s + 5) >> 2); - crypto_int64 s3 = 2097151 & (load_4(s + 7) >> 7); - crypto_int64 s4 = 2097151 & (load_4(s + 10) >> 4); - crypto_int64 s5 = 2097151 & (load_3(s + 13) >> 1); - crypto_int64 s6 = 2097151 & (load_4(s + 15) >> 6); - crypto_int64 s7 = 2097151 & (load_3(s + 18) >> 3); - crypto_int64 s8 = 2097151 & load_3(s + 21); - crypto_int64 s9 = 2097151 & (load_4(s + 23) >> 5); - crypto_int64 s10 = 2097151 & (load_3(s + 26) >> 2); - crypto_int64 s11 = 2097151 & (load_4(s + 28) >> 7); - crypto_int64 s12 = 2097151 & (load_4(s + 31) >> 4); - crypto_int64 s13 = 2097151 & (load_3(s + 34) >> 1); - crypto_int64 s14 = 2097151 & (load_4(s + 36) >> 6); - crypto_int64 s15 = 2097151 & (load_3(s + 39) >> 3); - crypto_int64 s16 = 2097151 & load_3(s + 42); - crypto_int64 s17 = 2097151 & (load_4(s + 44) >> 5); - crypto_int64 s18 = 2097151 & (load_3(s + 47) >> 2); - crypto_int64 s19 = 2097151 & (load_4(s + 49) >> 7); - crypto_int64 s20 = 2097151 & (load_4(s + 52) >> 4); - crypto_int64 s21 = 2097151 & (load_3(s + 55) >> 1); - crypto_int64 s22 = 2097151 & (load_4(s + 57) >> 6); - crypto_int64 s23 = (load_4(s + 60) >> 3); - crypto_int64 carry0; - crypto_int64 carry1; - crypto_int64 carry2; - crypto_int64 carry3; - crypto_int64 carry4; - crypto_int64 carry5; - crypto_int64 carry6; - crypto_int64 carry7; - crypto_int64 carry8; - crypto_int64 carry9; - crypto_int64 carry10; - crypto_int64 carry11; - crypto_int64 carry12; - crypto_int64 carry13; - crypto_int64 carry14; - crypto_int64 carry15; - crypto_int64 carry16; + int64_t s0 = 2097151 & load_3(s); + int64_t s1 = 2097151 & (load_4(s + 2) >> 5); + int64_t s2 = 2097151 & (load_3(s + 5) >> 2); + int64_t s3 = 2097151 & (load_4(s + 7) >> 7); + int64_t s4 = 2097151 & (load_4(s + 10) >> 4); + int64_t s5 = 2097151 & (load_3(s + 13) >> 1); + int64_t s6 = 2097151 & (load_4(s + 15) >> 6); + int64_t s7 = 2097151 & (load_3(s + 18) >> 3); + int64_t s8 = 2097151 & load_3(s + 21); + int64_t s9 = 2097151 & (load_4(s + 23) >> 5); + int64_t s10 = 2097151 & (load_3(s + 26) >> 2); + int64_t s11 = 2097151 & (load_4(s + 28) >> 7); + int64_t s12 = 2097151 & (load_4(s + 31) >> 4); + int64_t s13 = 2097151 & (load_3(s + 34) >> 1); + int64_t s14 = 2097151 & (load_4(s + 36) >> 6); + int64_t s15 = 2097151 & (load_3(s + 39) >> 3); + int64_t s16 = 2097151 & load_3(s + 42); + int64_t s17 = 2097151 & (load_4(s + 44) >> 5); + int64_t s18 = 2097151 & (load_3(s + 47) >> 2); + int64_t s19 = 2097151 & (load_4(s + 49) >> 7); + int64_t s20 = 2097151 & (load_4(s + 52) >> 4); + int64_t s21 = 2097151 & (load_3(s + 55) >> 1); + int64_t s22 = 2097151 & (load_4(s + 57) >> 6); + int64_t s23 = (load_4(s + 60) >> 3); + int64_t carry0; + int64_t carry1; + int64_t carry2; + int64_t carry3; + int64_t carry4; + int64_t carry5; + int64_t carry6; + int64_t carry7; + int64_t carry8; + int64_t carry9; + int64_t carry10; + int64_t carry11; + int64_t carry12; + int64_t carry13; + int64_t carry14; + int64_t carry15; + int64_t carry16; s11 += s23 * 666643; s12 += s23 * 470296; @@ -2120,18 +2118,18 @@ void sc_reduce(unsigned char *s) s10 += s18 * 136657; s11 -= s18 * 683901; - carry6 = (s6 + (crypto_int64) (1L << 20)) >> 21; s7 += carry6; s6 -= carry6 * ((crypto_uint64) 1L << 21); - carry8 = (s8 + (crypto_int64) (1L << 20)) >> 21; s9 += carry8; s8 -= carry8 * ((crypto_uint64) 1L << 21); - carry10 = (s10 + (crypto_int64) (1L << 20)) >> 21; s11 += carry10; s10 -= carry10 * ((crypto_uint64) 1L << 21); - carry12 = (s12 + (crypto_int64) (1L << 20)) >> 21; s13 += carry12; s12 -= carry12 * ((crypto_uint64) 1L << 21); - carry14 = (s14 + (crypto_int64) (1L << 20)) >> 21; s15 += carry14; s14 -= carry14 * ((crypto_uint64) 1L << 21); - carry16 = (s16 + (crypto_int64) (1L << 20)) >> 21; s17 += carry16; s16 -= carry16 * ((crypto_uint64) 1L << 21); + carry6 = (s6 + (int64_t) (1L << 20)) >> 21; s7 += carry6; s6 -= carry6 * ((uint64_t) 1L << 21); + carry8 = (s8 + (int64_t) (1L << 20)) >> 21; s9 += carry8; s8 -= carry8 * ((uint64_t) 1L << 21); + carry10 = (s10 + (int64_t) (1L << 20)) >> 21; s11 += carry10; s10 -= carry10 * ((uint64_t) 1L << 21); + carry12 = (s12 + (int64_t) (1L << 20)) >> 21; s13 += carry12; s12 -= carry12 * ((uint64_t) 1L << 21); + carry14 = (s14 + (int64_t) (1L << 20)) >> 21; s15 += carry14; s14 -= carry14 * ((uint64_t) 1L << 21); + carry16 = (s16 + (int64_t) (1L << 20)) >> 21; s17 += carry16; s16 -= carry16 * ((uint64_t) 1L << 21); - carry7 = (s7 + (crypto_int64) (1L << 20)) >> 21; s8 += carry7; s7 -= carry7 * ((crypto_uint64) 1L << 21); - carry9 = (s9 + (crypto_int64) (1L << 20)) >> 21; s10 += carry9; s9 -= carry9 * ((crypto_uint64) 1L << 21); - carry11 = (s11 + (crypto_int64) (1L << 20)) >> 21; s12 += carry11; s11 -= carry11 * ((crypto_uint64) 1L << 21); - carry13 = (s13 + (crypto_int64) (1L << 20)) >> 21; s14 += carry13; s13 -= carry13 * ((crypto_uint64) 1L << 21); - carry15 = (s15 + (crypto_int64) (1L << 20)) >> 21; s16 += carry15; s15 -= carry15 * ((crypto_uint64) 1L << 21); + carry7 = (s7 + (int64_t) (1L << 20)) >> 21; s8 += carry7; s7 -= carry7 * ((uint64_t) 1L << 21); + carry9 = (s9 + (int64_t) (1L << 20)) >> 21; s10 += carry9; s9 -= carry9 * ((uint64_t) 1L << 21); + carry11 = (s11 + (int64_t) (1L << 20)) >> 21; s12 += carry11; s11 -= carry11 * ((uint64_t) 1L << 21); + carry13 = (s13 + (int64_t) (1L << 20)) >> 21; s14 += carry13; s13 -= carry13 * ((uint64_t) 1L << 21); + carry15 = (s15 + (int64_t) (1L << 20)) >> 21; s16 += carry15; s15 -= carry15 * ((uint64_t) 1L << 21); s5 += s17 * 666643; s6 += s17 * 470296; @@ -2176,19 +2174,19 @@ void sc_reduce(unsigned char *s) s5 -= s12 * 683901; s12 = 0; - carry0 = (s0 + (crypto_int64) (1L << 20)) >> 21; s1 += carry0; s0 -= carry0 * ((crypto_uint64) 1L << 21); - carry2 = (s2 + (crypto_int64) (1L << 20)) >> 21; s3 += carry2; s2 -= carry2 * ((crypto_uint64) 1L << 21); - carry4 = (s4 + (crypto_int64) (1L << 20)) >> 21; s5 += carry4; s4 -= carry4 * ((crypto_uint64) 1L << 21); - carry6 = (s6 + (crypto_int64) (1L << 20)) >> 21; s7 += carry6; s6 -= carry6 * ((crypto_uint64) 1L << 21); - carry8 = (s8 + (crypto_int64) (1L << 20)) >> 21; s9 += carry8; s8 -= carry8 * ((crypto_uint64) 1L << 21); - carry10 = (s10 + (crypto_int64) (1L << 20)) >> 21; s11 += carry10; s10 -= carry10 * ((crypto_uint64) 1L << 21); + carry0 = (s0 + (int64_t) (1L << 20)) >> 21; s1 += carry0; s0 -= carry0 * ((uint64_t) 1L << 21); + carry2 = (s2 + (int64_t) (1L << 20)) >> 21; s3 += carry2; s2 -= carry2 * ((uint64_t) 1L << 21); + carry4 = (s4 + (int64_t) (1L << 20)) >> 21; s5 += carry4; s4 -= carry4 * ((uint64_t) 1L << 21); + carry6 = (s6 + (int64_t) (1L << 20)) >> 21; s7 += carry6; s6 -= carry6 * ((uint64_t) 1L << 21); + carry8 = (s8 + (int64_t) (1L << 20)) >> 21; s9 += carry8; s8 -= carry8 * ((uint64_t) 1L << 21); + carry10 = (s10 + (int64_t) (1L << 20)) >> 21; s11 += carry10; s10 -= carry10 * ((uint64_t) 1L << 21); - carry1 = (s1 + (crypto_int64) (1L << 20)) >> 21; s2 += carry1; s1 -= carry1 * ((crypto_uint64) 1L << 21); - carry3 = (s3 + (crypto_int64) (1L << 20)) >> 21; s4 += carry3; s3 -= carry3 * ((crypto_uint64) 1L << 21); - carry5 = (s5 + (crypto_int64) (1L << 20)) >> 21; s6 += carry5; s5 -= carry5 * ((crypto_uint64) 1L << 21); - carry7 = (s7 + (crypto_int64) (1L << 20)) >> 21; s8 += carry7; s7 -= carry7 * ((crypto_uint64) 1L << 21); - carry9 = (s9 + (crypto_int64) (1L << 20)) >> 21; s10 += carry9; s9 -= carry9 * ((crypto_uint64) 1L << 21); - carry11 = (s11 + (crypto_int64) (1L << 20)) >> 21; s12 += carry11; s11 -= carry11 * ((crypto_uint64) 1L << 21); + carry1 = (s1 + (int64_t) (1L << 20)) >> 21; s2 += carry1; s1 -= carry1 * ((uint64_t) 1L << 21); + carry3 = (s3 + (int64_t) (1L << 20)) >> 21; s4 += carry3; s3 -= carry3 * ((uint64_t) 1L << 21); + carry5 = (s5 + (int64_t) (1L << 20)) >> 21; s6 += carry5; s5 -= carry5 * ((uint64_t) 1L << 21); + carry7 = (s7 + (int64_t) (1L << 20)) >> 21; s8 += carry7; s7 -= carry7 * ((uint64_t) 1L << 21); + carry9 = (s9 + (int64_t) (1L << 20)) >> 21; s10 += carry9; s9 -= carry9 * ((uint64_t) 1L << 21); + carry11 = (s11 + (int64_t) (1L << 20)) >> 21; s12 += carry11; s11 -= carry11 * ((uint64_t) 1L << 21); s0 += s12 * 666643; s1 += s12 * 470296; @@ -2198,18 +2196,18 @@ void sc_reduce(unsigned char *s) s5 -= s12 * 683901; s12 = 0; - carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 * ((crypto_uint64) 1L << 21); - carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 * ((crypto_uint64) 1L << 21); - carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 * ((crypto_uint64) 1L << 21); - carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 * ((crypto_uint64) 1L << 21); - carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 * ((crypto_uint64) 1L << 21); - carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 * ((crypto_uint64) 1L << 21); - carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 * ((crypto_uint64) 1L << 21); - carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 * ((crypto_uint64) 1L << 21); - carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 * ((crypto_uint64) 1L << 21); - carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 * ((crypto_uint64) 1L << 21); - carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 * ((crypto_uint64) 1L << 21); - carry11 = s11 >> 21; s12 += carry11; s11 -= carry11 * ((crypto_uint64) 1L << 21); + carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 * ((uint64_t) 1L << 21); + carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 * ((uint64_t) 1L << 21); + carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 * ((uint64_t) 1L << 21); + carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 * ((uint64_t) 1L << 21); + carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 * ((uint64_t) 1L << 21); + carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 * ((uint64_t) 1L << 21); + carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 * ((uint64_t) 1L << 21); + carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 * ((uint64_t) 1L << 21); + carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 * ((uint64_t) 1L << 21); + carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 * ((uint64_t) 1L << 21); + carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 * ((uint64_t) 1L << 21); + carry11 = s11 >> 21; s12 += carry11; s11 -= carry11 * ((uint64_t) 1L << 21); s0 += s12 * 666643; s1 += s12 * 470296; @@ -2218,47 +2216,47 @@ void sc_reduce(unsigned char *s) s4 += s12 * 136657; s5 -= s12 * 683901; - carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 * ((crypto_uint64) 1L << 21); - carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 * ((crypto_uint64) 1L << 21); - carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 * ((crypto_uint64) 1L << 21); - carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 * ((crypto_uint64) 1L << 21); - carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 * ((crypto_uint64) 1L << 21); - carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 * ((crypto_uint64) 1L << 21); - carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 * ((crypto_uint64) 1L << 21); - carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 * ((crypto_uint64) 1L << 21); - carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 * ((crypto_uint64) 1L << 21); - carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 * ((crypto_uint64) 1L << 21); - carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 * ((crypto_uint64) 1L << 21); + carry0 = s0 >> 21; s1 += carry0; s0 -= carry0 * ((uint64_t) 1L << 21); + carry1 = s1 >> 21; s2 += carry1; s1 -= carry1 * ((uint64_t) 1L << 21); + carry2 = s2 >> 21; s3 += carry2; s2 -= carry2 * ((uint64_t) 1L << 21); + carry3 = s3 >> 21; s4 += carry3; s3 -= carry3 * ((uint64_t) 1L << 21); + carry4 = s4 >> 21; s5 += carry4; s4 -= carry4 * ((uint64_t) 1L << 21); + carry5 = s5 >> 21; s6 += carry5; s5 -= carry5 * ((uint64_t) 1L << 21); + carry6 = s6 >> 21; s7 += carry6; s6 -= carry6 * ((uint64_t) 1L << 21); + carry7 = s7 >> 21; s8 += carry7; s7 -= carry7 * ((uint64_t) 1L << 21); + carry8 = s8 >> 21; s9 += carry8; s8 -= carry8 * ((uint64_t) 1L << 21); + carry9 = s9 >> 21; s10 += carry9; s9 -= carry9 * ((uint64_t) 1L << 21); + carry10 = s10 >> 21; s11 += carry10; s10 -= carry10 * ((uint64_t) 1L << 21); s[0] = s0 >> 0; s[1] = s0 >> 8; - s[2] = (s0 >> 16) | (s1 * ((crypto_uint64) 1 << 5)); + s[2] = (s0 >> 16) | (s1 * ((uint64_t) 1 << 5)); s[3] = s1 >> 3; s[4] = s1 >> 11; - s[5] = (s1 >> 19) | (s2 * ((crypto_uint64) 1 << 2)); + s[5] = (s1 >> 19) | (s2 * ((uint64_t) 1 << 2)); s[6] = s2 >> 6; - s[7] = (s2 >> 14) | (s3 * ((crypto_uint64) 1 << 7)); + s[7] = (s2 >> 14) | (s3 * ((uint64_t) 1 << 7)); s[8] = s3 >> 1; s[9] = s3 >> 9; - s[10] = (s3 >> 17) | (s4 * ((crypto_uint64) 1 << 4)); + s[10] = (s3 >> 17) | (s4 * ((uint64_t) 1 << 4)); s[11] = s4 >> 4; s[12] = s4 >> 12; - s[13] = (s4 >> 20) | (s5 * ((crypto_uint64) 1 << 1)); + s[13] = (s4 >> 20) | (s5 * ((uint64_t) 1 << 1)); s[14] = s5 >> 7; - s[15] = (s5 >> 15) | (s6 * ((crypto_uint64) 1 << 6)); + s[15] = (s5 >> 15) | (s6 * ((uint64_t) 1 << 6)); s[16] = s6 >> 2; s[17] = s6 >> 10; - s[18] = (s6 >> 18) | (s7 * ((crypto_uint64) 1 << 3)); + s[18] = (s6 >> 18) | (s7 * ((uint64_t) 1 << 3)); s[19] = s7 >> 5; s[20] = s7 >> 13; s[21] = s8 >> 0; s[22] = s8 >> 8; - s[23] = (s8 >> 16) | (s9 * ((crypto_uint64) 1 << 5)); + s[23] = (s8 >> 16) | (s9 * ((uint64_t) 1 << 5)); s[24] = s9 >> 3; s[25] = s9 >> 11; - s[26] = (s9 >> 19) | (s10 * ((crypto_uint64) 1 << 2)); + s[26] = (s9 >> 19) | (s10 * ((uint64_t) 1 << 2)); s[27] = s10 >> 6; - s[28] = (s10 >> 14) | (s11 * ((crypto_uint64) 1 << 7)); + s[28] = (s10 >> 14) | (s11 * ((uint64_t) 1 << 7)); s[29] = s11 >> 1; s[30] = s11 >> 9; s[31] = s11 >> 17; diff --git a/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.h b/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.h index d774a8a4..af0744e4 100644 --- a/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.h +++ b/src/libsodium/crypto_core/curve25519/ref10/curve25519_ref10.h @@ -1,10 +1,11 @@ #ifndef CURVE25519_REF10_H #define CURVE25519_REF10_H -#include "crypto_int32.h" +#include +#include #define fe crypto_core_curve25519_ref10_fe -typedef crypto_int32 fe[10]; +typedef int32_t fe[10]; /* fe means field element. diff --git a/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c b/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c index ac64fc6c..5f598437 100644 --- a/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c +++ b/src/libsodium/crypto_scalarmult/curve25519/ref10/x25519_ref10.c @@ -1,10 +1,9 @@ #include +#include #ifndef HAVE_TI_MODE -#include "crypto_int32.h" -#include "crypto_int64.h" #include "utils.h" #include "x25519_ref10.h" #include "../scalarmult_curve25519.h" @@ -20,36 +19,36 @@ Preconditions: b in {0,1}. static void fe_cswap(fe f,fe g,unsigned int b) { - crypto_int32 f0 = f[0]; - crypto_int32 f1 = f[1]; - crypto_int32 f2 = f[2]; - crypto_int32 f3 = f[3]; - crypto_int32 f4 = f[4]; - crypto_int32 f5 = f[5]; - crypto_int32 f6 = f[6]; - crypto_int32 f7 = f[7]; - crypto_int32 f8 = f[8]; - crypto_int32 f9 = f[9]; - crypto_int32 g0 = g[0]; - crypto_int32 g1 = g[1]; - crypto_int32 g2 = g[2]; - crypto_int32 g3 = g[3]; - crypto_int32 g4 = g[4]; - crypto_int32 g5 = g[5]; - crypto_int32 g6 = g[6]; - crypto_int32 g7 = g[7]; - crypto_int32 g8 = g[8]; - crypto_int32 g9 = g[9]; - crypto_int32 x0 = f0 ^ g0; - crypto_int32 x1 = f1 ^ g1; - crypto_int32 x2 = f2 ^ g2; - crypto_int32 x3 = f3 ^ g3; - crypto_int32 x4 = f4 ^ g4; - crypto_int32 x5 = f5 ^ g5; - crypto_int32 x6 = f6 ^ g6; - crypto_int32 x7 = f7 ^ g7; - crypto_int32 x8 = f8 ^ g8; - crypto_int32 x9 = f9 ^ g9; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; + int32_t g0 = g[0]; + int32_t g1 = g[1]; + int32_t g2 = g[2]; + int32_t g3 = g[3]; + int32_t g4 = g[4]; + int32_t g5 = g[5]; + int32_t g6 = g[6]; + int32_t g7 = g[7]; + int32_t g8 = g[8]; + int32_t g9 = g[9]; + int32_t x0 = f0 ^ g0; + int32_t x1 = f1 ^ g1; + int32_t x2 = f2 ^ g2; + int32_t x3 = f3 ^ g3; + int32_t x4 = f4 ^ g4; + int32_t x5 = f5 ^ g5; + int32_t x6 = f6 ^ g6; + int32_t x7 = f7 ^ g7; + int32_t x8 = f8 ^ g8; + int32_t x9 = f9 ^ g9; b = (unsigned int) (- (int) b); x0 &= b; x1 &= b; @@ -97,48 +96,48 @@ Postconditions: static void fe_mul121666(fe h,const fe f) { - crypto_int32 f0 = f[0]; - crypto_int32 f1 = f[1]; - crypto_int32 f2 = f[2]; - crypto_int32 f3 = f[3]; - crypto_int32 f4 = f[4]; - crypto_int32 f5 = f[5]; - crypto_int32 f6 = f[6]; - crypto_int32 f7 = f[7]; - crypto_int32 f8 = f[8]; - crypto_int32 f9 = f[9]; - crypto_int64 h0 = f0 * (crypto_int64) 121666; - crypto_int64 h1 = f1 * (crypto_int64) 121666; - crypto_int64 h2 = f2 * (crypto_int64) 121666; - crypto_int64 h3 = f3 * (crypto_int64) 121666; - crypto_int64 h4 = f4 * (crypto_int64) 121666; - crypto_int64 h5 = f5 * (crypto_int64) 121666; - crypto_int64 h6 = f6 * (crypto_int64) 121666; - crypto_int64 h7 = f7 * (crypto_int64) 121666; - crypto_int64 h8 = f8 * (crypto_int64) 121666; - crypto_int64 h9 = f9 * (crypto_int64) 121666; - crypto_int64 carry0; - crypto_int64 carry1; - crypto_int64 carry2; - crypto_int64 carry3; - crypto_int64 carry4; - crypto_int64 carry5; - crypto_int64 carry6; - crypto_int64 carry7; - crypto_int64 carry8; - crypto_int64 carry9; + int32_t f0 = f[0]; + int32_t f1 = f[1]; + int32_t f2 = f[2]; + int32_t f3 = f[3]; + int32_t f4 = f[4]; + int32_t f5 = f[5]; + int32_t f6 = f[6]; + int32_t f7 = f[7]; + int32_t f8 = f[8]; + int32_t f9 = f[9]; + int64_t h0 = f0 * (int64_t) 121666; + int64_t h1 = f1 * (int64_t) 121666; + int64_t h2 = f2 * (int64_t) 121666; + int64_t h3 = f3 * (int64_t) 121666; + int64_t h4 = f4 * (int64_t) 121666; + int64_t h5 = f5 * (int64_t) 121666; + int64_t h6 = f6 * (int64_t) 121666; + int64_t h7 = f7 * (int64_t) 121666; + int64_t h8 = f8 * (int64_t) 121666; + int64_t h9 = f9 * (int64_t) 121666; + int64_t carry0; + int64_t carry1; + int64_t carry2; + int64_t carry3; + int64_t carry4; + int64_t carry5; + int64_t carry6; + int64_t carry7; + int64_t carry8; + int64_t carry9; - carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25; - carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25; - carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25; - carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25; - carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25; + carry9 = (h9 + (int64_t) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25; + carry1 = (h1 + (int64_t) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25; + carry3 = (h3 + (int64_t) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25; + carry5 = (h5 + (int64_t) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25; + carry7 = (h7 + (int64_t) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25; - carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26; - carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26; - carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26; - carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26; - carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26; + carry0 = (h0 + (int64_t) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26; + carry2 = (h2 + (int64_t) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26; + carry4 = (h4 + (int64_t) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26; + carry6 = (h6 + (int64_t) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26; + carry8 = (h8 + (int64_t) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26; h[0] = h0; h[1] = h1;