From 1e1486ed1830c4dd6268e449030d196cc7db7bea Mon Sep 17 00:00:00 2001 From: Steve Cartmell Date: Mon, 26 Nov 2018 15:37:55 +0000 Subject: [PATCH] fix(pan-cordio): Replace the compiled uECC library with the sources --- .../thirdparty/uecc/libuECC.a | Bin 19752 -> 0 bytes .../thirdparty/uecc/uECC_ll.c | 1038 +++++++++++++++++ 2 files changed, 1038 insertions(+) delete mode 100644 features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/libuECC.a create mode 100644 features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/uECC_ll.c diff --git a/features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/libuECC.a b/features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/libuECC.a deleted file mode 100644 index 2fe52cc720cf3382238ec4fde316d4229dff6f9f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 19752 zcmd^mdw3Pqz4n@!y_21t5F+^koecyUA`(3}a-t}9*^;?%&Yi5!+wZ5~l`MO}(bcd3wCzej0Tr%nENv0W*Sx_AyS3Vd>6WUW>!|#b;Y{tI@?zYDYVtEj@7M>-BQ=pUEkU5No(wA?`~=D ziJg<&7H^GptK_cc`p#Grv^I7^u|thJ!>!Ak=Tz9*THK+WAlqJ6I=R%-_L4|s(j=sn zOrAKwYW?!y9W!g9nx?@8R?tMDNJ>JOGi17dqJ%;*Q&b@_J}YuigtCsCCz`IvI!bJv z@zrtZjGSoXa6;2?OT)uT(^tWzGk)>e`o8kC$YEoY$j^;b4*0_BD+XVP&oV~kMs9>O z?8)^NpS_^La$280%2$?K!t`=n_f-5D%&dc=-!x37&bwj2S9E`c?-l<`>nlEeL6}*G zHC*%izKmoYCQIb6uMj8$Zf?Z~H|VIZ=tSx#XN2fGm=WD{ASL?ce}D1i=~c#-&}!e7 z#?}5UyH}@d5m%jFow{XJv?bac)wgO}#a6ObMg7r|XhfC>tv0~+f$iVouR4t~7CY5u zRwbCL#FoZY+Lqm`bg7$c>Sn%wt8c3zOEiMDd)2Ph+LqJc`M%${`fb$UukwGNnnSBn zx7hklgBb#^akaiBv?>Lh-N^Oo3#~@2VC@F$G;Ia5XxM2NlWl4QZ#Qd|+Q>tjR{6mV zC9F)57VZY~H0y=0c7t_VvS7tltL~JosavSAXjn$gke7>|EQy-ZQ(EDWllck16%Fe@ z5L=TMlTO^}V7$N9g@Idd~5qCw32}9750kYJQ&x?jB5iGPgH9 zV@|(F+cTK*6yvqMnQ3$TMG%~4_Y9^!e?@Ob+T7mE;LfumWoLh`*wvq{KX&%0W*+}4 znowK%?!kc6wglR$`$f8~-IgC5OmXGIg6)ChD4DTmF!25`lv>)GmR{2@G9DaEb;+>A zC7&D+rz9V>kPl5i&7!8v2L}T`91bnZdV?9)_lrz;z$L>AE*Y9OOFp!aPtTQ~fTlE9 z`_o)#`Fd}9CjE!jxn#7?B}3Cr$%hv5>ECtK6hvzdjf9q3dK#XmU!5{q?~c_v;&(L&~vvvu_66YD`ksPy_H|}|YG3%N)_UN$Z z88n?UkK~xeJaW$)j2hRxLF-*IG@Ub#77qCCv1XEc=AeD9nS*iclA-IInIzkXndF{1 zXrF85pnWbGn$DR?vVHKmdoH1Uu0BBfTrxDB<8!nv18wnm*xdtMnP8RlRSi}X%*h;m zpSF$b{v`(vpY8i!$yGe#xYnPgEkDlHeAl3V6UyGRYcS=6T%oNMdpqphG^{re#0sP4 zcOmAtseOKY*Pw2%`)Rud4e8OP{UX4%i0jhg-gFt~x&+IEy9RxShWDmprOe3SDwBi! z}%Xt%X(hycs<`=)335nH!IA<<0301eQWe4YcI+rXe1*S7eqzEh(FxM+yI? z=TX9{CxCj=aL)+_pO3yX=yT*GElAdwDr-zh)c7XKz>2@4ejjH%?}4!39onHRKwqB9 z>CFt(s`Zs^NLuu+%hq!(+C8YlqIU*im$Ko_=(~eS`)uv-z4XLi^N_ug=&omv$yBe9vL;SFw;Dd~nc!eeVszN@bthV`m(epU<9$q&;UG_WU)U zpvJ&Y2905Ja+Y9(%*F^F-mA&`IpY}R!<;h433oc_81bqESH#?24dXo+P^;s!yOEpI ztI5%c8JOmtf$@VIv8x?|o$JNXY`Fuo_Gg@<`Ep0g*sAE5Xrasv9EcxIAC+73+AaFc zuWhWjc}ero;GH*f$Nlup_f+ic_lbVF=k}FhX6n^j<)&4I-&kSscXrWMCm__m~X<4U*vbVIJvFv;5 z%*lZb=7Nj0yc-A1h~76!*FMuf8dh=15z`c=nJ@D7{whQCS82XdUnEqOUzJy7R?$v9 z^x_4|W*iAdMg9WqJHr-g7b^WSExT5XqlGUYF+y7Cr)P#W>wTJdu@b*}xpv{QzR(ZO zjBM_!OzG27eEq(lK1uXx#zKsb0?oH~ji$@<;DiyUbA0=TVf<-Q_Q9KTWsmt}f5(4e zA=5FU^r_deRaaI~E|ole`(lhev^=71$1F#?G1~lO`OqH=BHVf)o*(|! z%;=enpZnB^ubA`JfbUzD?+YHW#+?=_jOI$avK7mGGIyV4(ZMqr+h0q~dD)sTx!bbP zI{(SseHCgh85p~UENg5R#Z7d)re$?WUZWGR{aO@ z^aD@Os&kg(8H-$#%MJ!={85o-M(2NWsFU6^qaq{*eAkYN9zI(p*Kd|7djI1Y<7z@{ zwQ+gT@h6R!^l{TqYNr2`IYN3on)9eIb&l|F<&DUn%`~krHTua5Trqt88v-NdJ~Oaq zdESUf^qGOZ>zIE9QXUp1(Q;}3hJgbMu8O~L=H-EhBbUq-<1&uy3GEDps>EpVgQd-K zT=gH2y(|It+bt?>|h$&8Hnadd#TUz z2uf;xj2m}b2P*Sw-Wu4vIVHML`i1_X%_0|ZY9s3&CzTK&!f_Qx{=XO~lF8d5$KW7LW#LK_D9B8Sfo ztkGMJiSN@(?}Sc;j4G_py6A7xmNxfAsM9#`j|09z zmeA%vJ|d1ZDIE_yz3r8mlYjil&I!Fm-@4tn`J?hZjqkp9Xkb>w_&FM?QP+ z(3dJuy&bnvRVhJJ`Gz3`9^xYSv;clHevF)5x)8HvqV=OsM}n3ic^OF3b{L;A#gHix zE9DBNyaRPY?2sw?e=y}WnKE9c`0ilJKACbnG&T zL7E>4q#a;Vx-J4+sFwZ~Vl$&VQoC98CQVEInDVWf7M#b(`=sRJ(sl%=FyS>OSgr|f zVP$Nm<-Z;24^YW*Em%wDA!b~L3q?1P`4|(jWJ2m%F!WbbwA3sV(We_)u!$+tNV#58 z_?%zpIsBcAOWToAO6?CZ!5Rs{R#x-BnZVJY?HKZ1Bruq`AU>c(YY1eXU>3qBG-k&| z|BYx=CO|AS4nlj@P?U%xjn!&Lb^nWy-$opHLi;X$Wy(gR%65beDL-S&lPo!ts#xMW zOP&Im?$>4-7Z-rL26BY5?5&Hn(V3T|8=1p1Z@TWvx_x15vkfGuyTYbxr9X*r`Mv(Q;LOC+g27$wbRUW7-tJsby9a)vF0qK zGzS$k-C{~r>2?}bWh4xBQic>OgV>hLV$HIyJV(}a(Fn*3wVN)dwKPA=nIOc)Y>k}{ zx4nZ49z>9ffGftK!oV@az;0mRIAq{NXW$5C;Lv8^EMVZIVc;BN;KXFew;)l@R5Ir@ z1BV#HNeko{W0WJ6!LIM9l#+a|R}35u3^t!}4$iN`t~jm@%08yYadGzF=1J$U+JNf~ zTpZ)hV0-HSCI38vM(N^aG*j0GGlvMg7^9bPX~oOh8e&aF9bL;-#Ok|yI%8eSqBCbK zx@qCex{8{a%kUa-Wvshv*`gT>XU$wxS2=%S)tvctH8sn+n_D`Y;&@4T%d(zWW23NM z3gTs5Bh}V-wbj*kwiUOuOA+%7p2pn#k%qNbNButCPP$whZH&+lHNnHg$AqI2;~3I&9oJwIVz!Z(cY&=E}&mc~&%H+)`W^o;V2Seh9EUeByr{xtF@pFiVAyODmzysWymTGqRy)_Cf+#m27))I@&8VGf{EIf%*#3=T<6YmKD-V?#_apkD@6Os+ri}_4o4+yF z_>=F>L&hege&L&Ye7*73?Tf38UHa7OQQ^CKU_teg3C2se7uOoarm?Vi`p9W{qw>N= z>0)C6s>+#K-CRA*SdHiiE4pHFxOUpgB}Uo`f*x?V??Fww#O2RjsT!26tj;TP4VJyB zTG%MO(^!g1$C_xut>N&gt=C#H{OYGAk!fHYXKNC@wKeBPG{FCY46a!p>N0tiCHY##}mM;kODjH_fUu&cy^$G3_%y;MG}U+4JLR7Cu9lVU zXh$6S=X*)vTbSt);tYMQ43m%+3?^Tw_~YVp~Vk zoc1*`+S%3IvZA|0##_3U#5y}`sy6? zHfXF{QQy@q{x97&mdUS95g^Dlr|V?-DTXLi#WeA zaem9gZ^?5iW6m3zPU(g?7Q3?uwRfQ8i`R z%^jVq?Yk#BzMd5nLFF>sIO{6vyU|s*)Wp`rTF=p^Oj%spxTLP7y`{UQzO~LW=X?!J z)bBRSYImYJ(ml$FH_9%wdP*hDV;9S=V?qPHx~SuN>10tKkGI}ZcdL;0VA@qCV$vy% zm}{LfhHr(0m{nOh#Vq8^T-4Fg+GVcj=rl14&6#QznhQER8ZkLKI=jqCMVzxm|5RGk z6USi3g#ACA$=pV8>&NplZcDdiW(;v{1-X5bMcen9vuq!gl^rthk z$J+!Tx7HPz1sl@t3f!Ig?UarFO}_6K_kcSiGj6=8XBL3tbM!uHmZErp}7iyn<6rf5ImumN%;PcO9ii&hsd%5jDr@gZ>vzRl;!`@ikm zXl#N$m(L^Mz^41O8#8@g+hSIU3`w1rrUz4o`m(i4wabkh z?Fwy}He4I&%g5mJ1ZN7~U47}y#`e)E3Ox1k$Z)zN7&vCq7s=og^dYryUh0lxC^?4k zd-#4a4C&-^-r|ga-()aEiie*fkDKIkF6+p51_Pfzy6s67V?iLF<6Ym<|T{oI7~RnBwhBVRg%93yy&hkOWclh^0_AI ziH8bglRwnMA1XE@oqVoII`W;tfEV5Rv&A+L$mjZ`yJidZU+UpsD)uYB<=;yoC4+%p zb?d)O96~nro49o3(_hK8ilZPI4BSoJ<#WVK$Yy!2d%EjxL;Hq#_`}2-iqAQ$BcJur zRx5BeB!dA<-1X&(kCDy#xJK#@OIgYgBR%|);x9-ipX;TLe0TdS{*^2&gO%TxnC2tx z42cH3EEqvk>?g zSVO)u7$WT9hlQ#5TyHhxJA)xgJp2+7R{V0wFLBagPpOArDy~s{Q}Rna{0ScZ1To#k zpWxwh)+d7@cvDLTLtK*-5HrMNk9@61o+j((+HM7|#>rsF)!8XumlO~)#0)VD_R{1G zTtkH^A0JZYNEnJ$rKN!e`z23s1(qfpx!gwsBsh-`_St|6 z&png5&k^LXcuzwy&MaNs@y?ET@dWo_0{J-NIr1ka@+*^PP9A0)oQUO>#_qLZCI4BW z&OS_w#-7eKvAS6b+ZD#uG0J%y^!#f>Tda+Kav!NKaMDVg9VOd+u5_M0UH|&v*5xjg zP-wmF2;#QFnH|LKe~QAz3Y!#uMi-i^@MtPFJ$>_;7I7>9Xp6+fOjgE z=ZZ|eY!9$Z<(I4cxk_H7@aqbjiQsoC`8Flrt>pWN@RPIy^-6ouKF&+pV**FQzQ4;J zEF%@v2fJ$&{sR&9FDD{j+JpAE>;Yfe1Kws;j{6a|dzX?QR`^RIct@3dj0pRoLgG|~ z3l%O=*r2eLI7ZcvH$C5^jCwW_?fN1AP|31>$g+OeFY5;$Wj-oBp?EJ7k^ZK_KN8{3 zPl@PUJi(RqWD!wrm_ojdqg+fx{bfonC!$@m6)sS?gh=~|SSY_qg#IUpczO9LaT5HY zTk>Ke^fwcszf<8_BHF)>2tD_y^dBmGoCrNn5mDc7iLmFS!nYOvQQ@aV=)qzyF+jWm zwl3!z{37QW^jxp{5k;iFyNTtniwNE>g^vTN=Lup1 z)&XK2ILse!&1+(z;&DEYgbde+Anb?`p^taYAncf}aFN1QL?~OU@LnM6+pO?@BI>1G zY+pW*cA^T&3nb^);dHU zcLe&4>U;_L2FeSBpx>C^NSr4`yOMi|bFFzt{DDf}LB!$hCrbVqu}Fv~m3)*qR)}Yn z{IbH=iP*Nhr{w=4P84E5$$T+KI|9V3gt$b>xe7-sl3!Q&2O>JOHke;LDT!p4Wm@Lb|G>I@xVwu9J z3TG4HuNs9gLHccx!o@`RPtH5wa?0>ylfq^q{E4Y7F;0YEyA`e_!oRmETt|eTHz?dl z#5liK;btQIe!s$PL^NiH!kt9Sw>=8?644(ID?C6%zdWw+31UR8pTMJ(CkpY5!ed1A z*K-O_647rjD}03rKfj^y6tPNuvH?6x8U6X8!agGU^%I2yMD*|H3I*rc0`#XsxqhI( zGbjUjKWD#ZE8M_x=%1~`0Pa^r^uw=-=!ZWL;s4Kw*+N{(a`1PA2tV_jMF0Mtn1|=_ z!~(3poHy{}WFq|6NQB?`Nf7114{m!$n~bU>z20e`UYTkr-jXS4DV#|Mv*T= zMR7w{mnddJvGcv8mBRBSPrylu=isDdoraULIuj=oc;ZV+d`+5^>{D_v-Yq9nljmhm zy7Sn4PL}fkoy@e4(n;;^19dXpeXLGuxWEBBNwDAGiDZ&0<2`gI33i!EMl*wP;TOkd|`rmRq7$QkJHu}{I60jRFhj#;#|&QSS%aJXAV*`hi9?p z=|gd6hfKDgLb&C26m;fev~g@T#Tt56;w+#C7k#7fEU&zDzCV1!TH$De<>e~yRX)6QT{c$Zw&h{>VeL2XdeH>r5 zeak)ijzQl8$hU)SANLhbea+Ap2Z{Qq*VfnN(YJhvbtbp<+4k{yw^QFM4*y{rl+bs- zN8i2BchXh{wC&@Vbm|*`zMaUYeH_=eecb2ZFR>0S!(eiLx@+6VeUVe&Hat@*L}k=B z(xH$0B&WUw=zO>^5o~?jS2^_^#h~JRpgt3qZQp5+zGcwo90#_(w>kZ%XuKK@sVQ{MvUTMQEQ(Lc6*JkLAZn~`muslECdJo@%RAJ+lu!?ro0?_Q6- zsnB=6{^j!mr+rU2^o@7u`x$ubcYBGN4SjqkX9v5zM^(K}o}EXo9q0bpS?@8_Ymck2 z;!*yc(g%>C2KAP!IKkHUu7`Ioc;oevq6vL`u1s?xxEP+o zyO`}rvjg*ZHF|ipAtBb;B*h^wu6TCV8{qknW(V6;{vVXH-}+$GPAH&#d`4=w_jd5` z7q`ow!XiNb+JSX45aF&w$iYT$XDZI^Na@5yeVnJP6Z#V2iDDuCXe&Xg9laQFCvWpK LJVS6K*u4J%5-&Yq diff --git a/features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/uECC_ll.c b/features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/uECC_ll.c new file mode 100644 index 0000000000..c15cbcf1b7 --- /dev/null +++ b/features/FEATURE_BLE/targets/TARGET_CORDIO_LL/thirdparty/uecc/uECC_ll.c @@ -0,0 +1,1038 @@ +/* Copyright 2014, Kenneth MacKay. Licensed under the BSD 2-clause license. */ + +#include +#include "uECC_ll.h" + +#ifndef uECC_PLATFORM + #if defined(__AVR__) && __AVR__ + #define uECC_PLATFORM uECC_avr + #elif defined(__thumb2__) || defined(_M_ARMT) /* I think MSVC only supports Thumb-2 targets */ + #define uECC_PLATFORM uECC_arm_thumb2 + #elif defined(__thumb__) + #define uECC_PLATFORM uECC_arm_thumb + #elif defined(__arm__) || defined(_M_ARM) + #define uECC_PLATFORM uECC_arm + #elif defined(__i386__) || defined(_M_IX86) || defined(_X86_) || defined(__I86__) + #define uECC_PLATFORM uECC_x86 + #elif defined(__amd64__) || defined(_M_X64) + #define uECC_PLATFORM uECC_x86_64 + #else + #define uECC_PLATFORM uECC_arch_other + #endif +#endif + +#define uECC_WORD_SIZE 4 + +#if __STDC_VERSION__ >= 199901L + #define RESTRICT restrict +#else + #define RESTRICT +#endif + +#define SUPPORTS_INT128 0 + +#define MAX_TRIES 64 + +/* #if uECC_WORD_SIZE == 4 */ +typedef uint32_t uECC_word_t; +typedef uint64_t uECC_dword_t; +typedef unsigned wordcount_t; +typedef int swordcount_t; +typedef int bitcount_t; +typedef int cmpresult_t; + +#define HIGH_BIT_SET 0x80000000 +#define uECC_WORD_BITS 32 +#define uECC_WORD_BITS_SHIFT 5 +#define uECC_WORD_BITS_MASK 0x01F + +#define uECC_WORDS_1 5 +#define uECC_WORDS_2 6 +#define uECC_WORDS_3 8 +#define uECC_WORDS_4 8 +#define uECC_WORDS_5 7 + +#define uECC_N_WORDS_1 6 +#define uECC_N_WORDS_2 6 +#define uECC_N_WORDS_3 8 +#define uECC_N_WORDS_4 8 +#define uECC_N_WORDS_5 7 + +#define Curve_P_1 {0x7FFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} +#define Curve_P_2 {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFE, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} +#define Curve_P_3 {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, \ + 0x00000000, 0x00000000, 0x00000001, 0xFFFFFFFF} +#define Curve_P_4 {0xFFFFFC2F, 0xFFFFFFFE, 0xFFFFFFFF, 0xFFFFFFFF, \ + 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} +#define Curve_P_5 {0x00000001, 0x00000000, 0x00000000, 0xFFFFFFFF, \ + 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} + +#define Curve_B_1 {0xC565FA45, 0x81D4D4AD, 0x65ACF89F, 0x54BD7A8B, 0x1C97BEFC} +#define Curve_B_2 {0xC146B9B1, 0xFEB8DEEC, 0x72243049, 0x0FA7E9AB, 0xE59C80E7, 0x64210519} +#define Curve_B_3 {0x27D2604B, 0x3BCE3C3E, 0xCC53B0F6, 0x651D06B0, \ + 0x769886BC, 0xB3EBBD55, 0xAA3A93E7, 0x5AC635D8} +#define Curve_B_4 {0x00000007, 0x00000000, 0x00000000, 0x00000000, \ + 0x00000000, 0x00000000, 0x00000000, 0x00000000} +#define Curve_B_5 {0x2355FFB4, 0x270B3943, 0xD7BFD8BA, 0x5044B0B7, \ + 0xF5413256, 0x0C04B3AB, 0xB4050A85} + +#define Curve_G_1 { \ + {0x13CBFC82, 0x68C38BB9, 0x46646989, 0x8EF57328, 0x4A96B568}, \ + {0x7AC5FB32, 0x04235137, 0x59DCC912, 0x3168947D, 0x23A62855}} + +#define Curve_G_2 { \ + {0x82FF1012, 0xF4FF0AFD, 0x43A18800, 0x7CBF20EB, 0xB03090F6, 0x188DA80E}, \ + {0x1E794811, 0x73F977A1, 0x6B24CDD5, 0x631011ED, 0xFFC8DA78, 0x07192B95}} + +#define Curve_G_3 { \ + {0xD898C296, 0xF4A13945, 0x2DEB33A0, 0x77037D81, \ + 0x63A440F2, 0xF8BCE6E5, 0xE12C4247, 0x6B17D1F2}, \ + {0x37BF51F5, 0xCBB64068, 0x6B315ECE, 0x2BCE3357, \ + 0x7C0F9E16, 0x8EE7EB4A, 0xFE1A7F9B, 0x4FE342E2}} + +#define Curve_G_4 { \ + {0x16F81798, 0x59F2815B, 0x2DCE28D9, 0x029BFCDB, \ + 0xCE870B07, 0x55A06295, 0xF9DCBBAC, 0x79BE667E}, \ + {0xFB10D4B8, 0x9C47D08F, 0xA6855419, 0xFD17B448, \ + 0x0E1108A8, 0x5DA4FBFC, 0x26A3C465, 0x483ADA77}} + +#define Curve_G_5 { \ + {0x115C1D21, 0x343280D6, 0x56C21122, 0x4A03C1D3, \ + 0x321390B9, 0x6BB4BF7F, 0xB70E0CBD}, \ + {0x85007E34, 0x44D58199, 0x5A074764, 0xCD4375A0, \ + 0x4C22DFE6, 0xB5F723FB, 0xBD376388}} + +#define Curve_N_1 {0xCA752257, 0xF927AED3, 0x0001F4C8, 0x00000000, 0x00000000, 0x00000001} +#define Curve_N_2 {0xB4D22831, 0x146BC9B1, 0x99DEF836, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} +#define Curve_N_3 {0xFC632551, 0xF3B9CAC2, 0xA7179E84, 0xBCE6FAAD, \ + 0xFFFFFFFF, 0xFFFFFFFF, 0x00000000, 0xFFFFFFFF} +#define Curve_N_4 {0xD0364141, 0xBFD25E8C, 0xAF48A03B, 0xBAAEDCE6, \ + 0xFFFFFFFE, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} +#define Curve_N_5 {0x5C5C2A3D, 0x13DD2945, 0xE0B8F03E, 0xFFFF16A2, \ + 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF} + +/* #endif */ + +#define uECC_WORDS uECC_CONCAT(uECC_WORDS_, uECC_CURVE) +#define uECC_N_WORDS uECC_CONCAT(uECC_N_WORDS_, uECC_CURVE) + +typedef struct EccPoint { + uECC_word_t x[uECC_WORDS]; + uECC_word_t y[uECC_WORDS]; +} EccPoint; + +static const uECC_word_t curve_p[uECC_WORDS] = uECC_CONCAT(Curve_P_, uECC_CURVE); +static const EccPoint curve_G = uECC_CONCAT(Curve_G_, uECC_CURVE); +static const uECC_word_t curve_n[uECC_N_WORDS] = uECC_CONCAT(Curve_N_, uECC_CURVE); + +static void vli_clear(uECC_word_t *vli); +static uECC_word_t vli_isZero(const uECC_word_t *vli); +static uECC_word_t vli_testBit(const uECC_word_t *vli, bitcount_t bit); +static void vli_set(uECC_word_t *dest, const uECC_word_t *src); +static cmpresult_t vli_cmp(const uECC_word_t *left, const uECC_word_t *right); +static void vli_rshift1(uECC_word_t *vli); +static uECC_word_t vli_add(uECC_word_t *result, + const uECC_word_t *left, + const uECC_word_t *right); +static uECC_word_t vli_sub(uECC_word_t *result, + const uECC_word_t *left, + const uECC_word_t *right); +static void vli_mult(uECC_word_t *result, const uECC_word_t *left, const uECC_word_t *right); +static void vli_modAdd(uECC_word_t *result, + const uECC_word_t *left, + const uECC_word_t *right, + const uECC_word_t *mod); +static void vli_modSub(uECC_word_t *result, + const uECC_word_t *left, + const uECC_word_t *right, + const uECC_word_t *mod); +static void vli_mmod_fast(uECC_word_t *RESTRICT result, uECC_word_t *RESTRICT product); +static void vli_modMult_fast(uECC_word_t *result, + const uECC_word_t *left, + const uECC_word_t *right); +static void vli_modInv(uECC_word_t *result, const uECC_word_t *input, const uECC_word_t *mod); +#if uECC_SQUARE_FUNC +static void vli_square(uECC_word_t *result, const uECC_word_t *left); +static void vli_modSquare_fast(uECC_word_t *result, const uECC_word_t *left); +#endif + +static int default_RNG(uint8_t *dest, unsigned size) { + return 0; +} + + +static uECC_RNG_Function g_rng_function = &default_RNG; + +void uECC_set_rng(uECC_RNG_Function rng_function) { + g_rng_function = rng_function; +} + +#ifdef __GNUC__ /* Only support GCC inline asm for now */ + #if (uECC_ASM && (uECC_PLATFORM == uECC_arm || uECC_PLATFORM == uECC_arm_thumb || \ + uECC_PLATFORM == uECC_arm_thumb2)) + #include "asm_arm.inc" + #endif +#endif + +#if !defined(asm_clear) || !asm_clear +static void vli_clear(uECC_word_t *vli) { + wordcount_t i; + for (i = 0; i < uECC_WORDS; ++i) { + vli[i] = 0; + } +} +#endif + +/* Returns 1 if vli == 0, 0 otherwise. */ +#if !defined(asm_isZero) || !asm_isZero +static uECC_word_t vli_isZero(const uECC_word_t *vli) { + wordcount_t i; + for (i = 0; i < uECC_WORDS; ++i) { + if (vli[i]) { + return 0; + } + } + return 1; +} +#endif + +/* Returns nonzero if bit 'bit' of vli is set. */ +#if !defined(asm_testBit) || !asm_testBit +static uECC_word_t vli_testBit(const uECC_word_t *vli, bitcount_t bit) { + return (vli[bit >> uECC_WORD_BITS_SHIFT] & ((uECC_word_t)1 << (bit & uECC_WORD_BITS_MASK))); +} +#endif + +/* Sets dest = src. */ +#if !defined(asm_set) || !asm_set +static void vli_set(uECC_word_t *dest, const uECC_word_t *src) { + wordcount_t i; + for (i = 0; i < uECC_WORDS; ++i) { + dest[i] = src[i]; + } +} +#endif + +/* Returns sign of left - right. */ +#if !defined(asm_cmp) || !asm_cmp +static cmpresult_t vli_cmp(const uECC_word_t *left, const uECC_word_t *right) { + swordcount_t i; + for (i = uECC_WORDS - 1; i >= 0; --i) { + if (left[i] > right[i]) { + return 1; + } else if (left[i] < right[i]) { + return -1; + } + } + return 0; +} +#endif + +/* Computes vli = vli >> 1. */ +#if !defined(asm_rshift1) || !asm_rshift1 +static void vli_rshift1(uECC_word_t *vli) { + uECC_word_t *end = vli; + uECC_word_t carry = 0; + + vli += uECC_WORDS; + while (vli-- > end) { + uECC_word_t temp = *vli; + *vli = (temp >> 1) | carry; + carry = temp << (uECC_WORD_BITS - 1); + } +} +#endif + +/* Computes result = left + right, returning carry. Can modify in place. */ +#if !defined(asm_add) || !asm_add +static uECC_word_t vli_add(uECC_word_t *result, const uECC_word_t *left, const uECC_word_t *right) { + uECC_word_t carry = 0; + wordcount_t i; + for (i = 0; i < uECC_WORDS; ++i) { + uECC_word_t sum = left[i] + right[i] + carry; + if (sum != left[i]) { + carry = (sum < left[i]); + } + result[i] = sum; + } + return carry; +} +#endif + +/* Computes result = left - right, returning borrow. Can modify in place. */ +#if !defined(asm_sub) || !asm_sub +static uECC_word_t vli_sub(uECC_word_t *result, const uECC_word_t *left, const uECC_word_t *right) { + uECC_word_t borrow = 0; + wordcount_t i; + for (i = 0; i < uECC_WORDS; ++i) { + uECC_word_t diff = left[i] - right[i] - borrow; + if (diff != left[i]) { + borrow = (diff > left[i]); + } + result[i] = diff; + } + return borrow; +} +#endif + +#if (!asm_mult || (uECC_SQUARE_FUNC && !asm_square) || uECC_CURVE == uECC_secp256k1) +static void muladd(uECC_word_t a, + uECC_word_t b, + uECC_word_t *r0, + uECC_word_t *r1, + uECC_word_t *r2) { + uECC_dword_t p = (uECC_dword_t)a * b; + uECC_dword_t r01 = ((uECC_dword_t)(*r1) << uECC_WORD_BITS) | *r0; + r01 += p; + *r2 += (r01 < p); + *r1 = r01 >> uECC_WORD_BITS; + *r0 = (uECC_word_t)r01; +} +#define muladd_exists 1 +#endif + +#if !asm_mult +static void vli_mult(uECC_word_t *result, const uECC_word_t *left, const uECC_word_t *right) { + uECC_word_t r0 = 0; + uECC_word_t r1 = 0; + uECC_word_t r2 = 0; + wordcount_t i, k; + + /* Compute each digit of result in sequence, maintaining the carries. */ + for (k = 0; k < uECC_WORDS; ++k) { + for (i = 0; i <= k; ++i) { + muladd(left[i], right[k - i], &r0, &r1, &r2); + } + result[k] = r0; + r0 = r1; + r1 = r2; + r2 = 0; + } + for (k = uECC_WORDS; k < uECC_WORDS * 2 - 1; ++k) { + for (i = (k + 1) - uECC_WORDS; i < uECC_WORDS; ++i) { + muladd(left[i], right[k - i], &r0, &r1, &r2); + } + result[k] = r0; + r0 = r1; + r1 = r2; + r2 = 0; + } + result[uECC_WORDS * 2 - 1] = r0; +} +#endif + +#if uECC_SQUARE_FUNC + +#if !asm_square +static void mul2add(uECC_word_t a, + uECC_word_t b, + uECC_word_t *r0, + uECC_word_t *r1, + uECC_word_t *r2) { + uECC_dword_t p = (uECC_dword_t)a * b; + uECC_dword_t r01 = ((uECC_dword_t)(*r1) << uECC_WORD_BITS) | *r0; + *r2 += (p >> (uECC_WORD_BITS * 2 - 1)); + p *= 2; + r01 += p; + *r2 += (r01 < p); + *r1 = r01 >> uECC_WORD_BITS; + *r0 = (uECC_word_t)r01; +} + +static void vli_square(uECC_word_t *result, const uECC_word_t *left) { + uECC_word_t r0 = 0; + uECC_word_t r1 = 0; + uECC_word_t r2 = 0; + + wordcount_t i, k; + + for (k = 0; k < uECC_WORDS * 2 - 1; ++k) { + uECC_word_t min = (k < uECC_WORDS ? 0 : (k + 1) - uECC_WORDS); + for (i = min; i <= k && i <= k - i; ++i) { + if (i < k-i) { + mul2add(left[i], left[k - i], &r0, &r1, &r2); + } else { + muladd(left[i], left[k - i], &r0, &r1, &r2); + } + } + result[k] = r0; + r0 = r1; + r1 = r2; + r2 = 0; + } + + result[uECC_WORDS * 2 - 1] = r0; +} +#endif + +#else /* uECC_SQUARE_FUNC */ + +#define vli_square(result, left, size) vli_mult((result), (left), (left), (size)) + +#endif /* uECC_SQUARE_FUNC */ + + +/* Computes result = (left + right) % mod. + Assumes that left < mod and right < mod, and that result does not overlap mod. */ +#if !defined(asm_modAdd) || !asm_modAdd +static void vli_modAdd(uECC_word_t *result, + const uECC_word_t *left, + const uECC_word_t *right, + const uECC_word_t *mod) { + uECC_word_t carry = vli_add(result, left, right); + if (carry || vli_cmp(result, mod) >= 0) { + /* result > mod (result = mod + remainder), so subtract mod to get remainder. */ + vli_sub(result, result, mod); + } +} +#endif + +/* Computes result = (left - right) % mod. + Assumes that left < mod and right < mod, and that result does not overlap mod. */ +#if !defined(asm_modSub) || !asm_modSub +static void vli_modSub(uECC_word_t *result, + const uECC_word_t *left, + const uECC_word_t *right, + const uECC_word_t *mod) { + uECC_word_t l_borrow = vli_sub(result, left, right); + if (l_borrow) { + /* In this case, result == -diff == (max int) - diff. Since -x % d == d - x, + we can get the correct result from result + mod (with overflow). */ + vli_add(result, result, mod); + } +} +#endif + +#if !defined(asm_modSub_fast) || !asm_modSub_fast + #define vli_modSub_fast(result, left, right) vli_modSub((result), (left), (right), curve_p) +#endif + +#if !defined(asm_mmod_fast) || !asm_mmod_fast + +#if uECC_CURVE == uECC_secp256r1 + +/* Computes result = product % curve_p + from http://www.nsa.gov/ia/_files/nist-routines.pdf */ +#if uECC_WORD_SIZE == 4 +static void vli_mmod_fast(uint32_t *RESTRICT result, uint32_t *RESTRICT product) { + uint32_t tmp[uECC_WORDS]; + int carry; + + /* t */ + vli_set(result, product); + + /* s1 */ + tmp[0] = tmp[1] = tmp[2] = 0; + tmp[3] = product[11]; + tmp[4] = product[12]; + tmp[5] = product[13]; + tmp[6] = product[14]; + tmp[7] = product[15]; + carry = vli_add(tmp, tmp, tmp); + carry += vli_add(result, result, tmp); + + /* s2 */ + tmp[3] = product[12]; + tmp[4] = product[13]; + tmp[5] = product[14]; + tmp[6] = product[15]; + tmp[7] = 0; + carry += vli_add(tmp, tmp, tmp); + carry += vli_add(result, result, tmp); + + /* s3 */ + tmp[0] = product[8]; + tmp[1] = product[9]; + tmp[2] = product[10]; + tmp[3] = tmp[4] = tmp[5] = 0; + tmp[6] = product[14]; + tmp[7] = product[15]; + carry += vli_add(result, result, tmp); + + /* s4 */ + tmp[0] = product[9]; + tmp[1] = product[10]; + tmp[2] = product[11]; + tmp[3] = product[13]; + tmp[4] = product[14]; + tmp[5] = product[15]; + tmp[6] = product[13]; + tmp[7] = product[8]; + carry += vli_add(result, result, tmp); + + /* d1 */ + tmp[0] = product[11]; + tmp[1] = product[12]; + tmp[2] = product[13]; + tmp[3] = tmp[4] = tmp[5] = 0; + tmp[6] = product[8]; + tmp[7] = product[10]; + carry -= vli_sub(result, result, tmp); + + /* d2 */ + tmp[0] = product[12]; + tmp[1] = product[13]; + tmp[2] = product[14]; + tmp[3] = product[15]; + tmp[4] = tmp[5] = 0; + tmp[6] = product[9]; + tmp[7] = product[11]; + carry -= vli_sub(result, result, tmp); + + /* d3 */ + tmp[0] = product[13]; + tmp[1] = product[14]; + tmp[2] = product[15]; + tmp[3] = product[8]; + tmp[4] = product[9]; + tmp[5] = product[10]; + tmp[6] = 0; + tmp[7] = product[12]; + carry -= vli_sub(result, result, tmp); + + /* d4 */ + tmp[0] = product[14]; + tmp[1] = product[15]; + tmp[2] = 0; + tmp[3] = product[9]; + tmp[4] = product[10]; + tmp[5] = product[11]; + tmp[6] = 0; + tmp[7] = product[13]; + carry -= vli_sub(result, result, tmp); + + if (carry < 0) { + do { + carry += vli_add(result, result, curve_p); + } while (carry < 0); + } else { + while (carry || vli_cmp(curve_p, result) != 1) { + carry -= vli_sub(result, result, curve_p); + } + } +} +#endif /* uECC_WORD_SIZE */ +#endif /* uECC_CURVE */ +#endif /* !asm_mmod_fast */ + +/* Computes result = (left * right) % curve_p. */ +static void vli_modMult_fast(uECC_word_t *result, + const uECC_word_t *left, + const uECC_word_t *right) { + uECC_word_t product[2 * uECC_WORDS]; + vli_mult(product, left, right); + vli_mmod_fast(result, product); +} + +#if uECC_SQUARE_FUNC + +/* Computes result = left^2 % curve_p. */ +static void vli_modSquare_fast(uECC_word_t *result, const uECC_word_t *left) { + uECC_word_t product[2 * uECC_WORDS]; + vli_square(product, left); + vli_mmod_fast(result, product); +} + +#else /* uECC_SQUARE_FUNC */ + +#define vli_modSquare_fast(result, left) vli_modMult_fast((result), (left), (left)) + +#endif /* uECC_SQUARE_FUNC */ + + +#define EVEN(vli) (!(vli[0] & 1)) +/* Computes result = (1 / input) % mod. All VLIs are the same size. + See "From Euclid's GCD to Montgomery Multiplication to the Great Divide" + https://labs.oracle.com/techrep/2001/smli_tr-2001-95.pdf */ +#if !defined(asm_modInv) || !asm_modInv +static void vli_modInv(uECC_word_t *result, const uECC_word_t *input, const uECC_word_t *mod) { + uECC_word_t a[uECC_WORDS], b[uECC_WORDS], u[uECC_WORDS], v[uECC_WORDS]; + uECC_word_t carry; + cmpresult_t cmpResult; + + if (vli_isZero(input)) { + vli_clear(result); + return; + } + + vli_set(a, input); + vli_set(b, mod); + vli_clear(u); + u[0] = 1; + vli_clear(v); + while ((cmpResult = vli_cmp(a, b)) != 0) { + carry = 0; + if (EVEN(a)) { + vli_rshift1(a); + if (!EVEN(u)) { + carry = vli_add(u, u, mod); + } + vli_rshift1(u); + if (carry) { + u[uECC_WORDS - 1] |= HIGH_BIT_SET; + } + } else if (EVEN(b)) { + vli_rshift1(b); + if (!EVEN(v)) { + carry = vli_add(v, v, mod); + } + vli_rshift1(v); + if (carry) { + v[uECC_WORDS - 1] |= HIGH_BIT_SET; + } + } else if (cmpResult > 0) { + vli_sub(a, a, b); + vli_rshift1(a); + if (vli_cmp(u, v) < 0) { + vli_add(u, u, mod); + } + vli_sub(u, u, v); + if (!EVEN(u)) { + carry = vli_add(u, u, mod); + } + vli_rshift1(u); + if (carry) { + u[uECC_WORDS - 1] |= HIGH_BIT_SET; + } + } else { + vli_sub(b, b, a); + vli_rshift1(b); + if (vli_cmp(v, u) < 0) { + vli_add(v, v, mod); + } + vli_sub(v, v, u); + if (!EVEN(v)) { + carry = vli_add(v, v, mod); + } + vli_rshift1(v); + if (carry) { + v[uECC_WORDS - 1] |= HIGH_BIT_SET; + } + } + } + vli_set(result, u); +} +#endif /* !asm_modInv */ + +/* ------ Point operations ------ */ + +/* Returns 1 if 'point' is the point at infinity, 0 otherwise. */ +static cmpresult_t EccPoint_isZero(const EccPoint *point) { + return (vli_isZero(point->x) && vli_isZero(point->y)); +} + +/* Point multiplication algorithm using Montgomery's ladder with co-Z coordinates. +From http://eprint.iacr.org/2011/338.pdf +*/ + +/* Double in place */ +static void EccPoint_double_jacobian(uECC_word_t * RESTRICT X1, + uECC_word_t * RESTRICT Y1, + uECC_word_t * RESTRICT Z1) { + /* t1 = X, t2 = Y, t3 = Z */ + uECC_word_t t4[uECC_WORDS]; + uECC_word_t t5[uECC_WORDS]; + + if (vli_isZero(Z1)) { + return; + } + + vli_modSquare_fast(t4, Y1); /* t4 = y1^2 */ + vli_modMult_fast(t5, X1, t4); /* t5 = x1*y1^2 = A */ + vli_modSquare_fast(t4, t4); /* t4 = y1^4 */ + vli_modMult_fast(Y1, Y1, Z1); /* t2 = y1*z1 = z3 */ + vli_modSquare_fast(Z1, Z1); /* t3 = z1^2 */ + + vli_modAdd(X1, X1, Z1, curve_p); /* t1 = x1 + z1^2 */ + vli_modAdd(Z1, Z1, Z1, curve_p); /* t3 = 2*z1^2 */ + vli_modSub_fast(Z1, X1, Z1); /* t3 = x1 - z1^2 */ + vli_modMult_fast(X1, X1, Z1); /* t1 = x1^2 - z1^4 */ + + vli_modAdd(Z1, X1, X1, curve_p); /* t3 = 2*(x1^2 - z1^4) */ + vli_modAdd(X1, X1, Z1, curve_p); /* t1 = 3*(x1^2 - z1^4) */ + if (vli_testBit(X1, 0)) { + uECC_word_t l_carry = vli_add(X1, X1, curve_p); + vli_rshift1(X1); + X1[uECC_WORDS - 1] |= l_carry << (uECC_WORD_BITS - 1); + } else { + vli_rshift1(X1); + } + /* t1 = 3/2*(x1^2 - z1^4) = B */ + + vli_modSquare_fast(Z1, X1); /* t3 = B^2 */ + vli_modSub_fast(Z1, Z1, t5); /* t3 = B^2 - A */ + vli_modSub_fast(Z1, Z1, t5); /* t3 = B^2 - 2A = x3 */ + vli_modSub_fast(t5, t5, Z1); /* t5 = A - x3 */ + vli_modMult_fast(X1, X1, t5); /* t1 = B * (A - x3) */ + vli_modSub_fast(t4, X1, t4); /* t4 = B * (A - x3) - y1^4 = y3 */ + + vli_set(X1, Z1); + vli_set(Z1, Y1); + vli_set(Y1, t4); +} + +/* Modify (x1, y1) => (x1 * z^2, y1 * z^3) */ +static void apply_z(uECC_word_t * RESTRICT X1, + uECC_word_t * RESTRICT Y1, + const uECC_word_t * RESTRICT Z) { + uECC_word_t t1[uECC_WORDS]; + + vli_modSquare_fast(t1, Z); /* z^2 */ + vli_modMult_fast(X1, X1, t1); /* x1 * z^2 */ + vli_modMult_fast(t1, t1, Z); /* z^3 */ + vli_modMult_fast(Y1, Y1, t1); /* y1 * z^3 */ +} + +/* P = (x1, y1) => 2P, (x2, y2) => P' */ +static void XYcZ_initial_double(uECC_word_t * RESTRICT X1, + uECC_word_t * RESTRICT Y1, + uECC_word_t * RESTRICT X2, + uECC_word_t * RESTRICT Y2, + const uECC_word_t * RESTRICT initial_Z) { + uECC_word_t z[uECC_WORDS]; + if (initial_Z) { + vli_set(z, initial_Z); + } else { + vli_clear(z); + z[0] = 1; + } + + vli_set(X2, X1); + vli_set(Y2, Y1); + + apply_z(X1, Y1, z); + EccPoint_double_jacobian(X1, Y1, z); + apply_z(X2, Y2, z); +} + +/* Input P = (x1, y1, Z), Q = (x2, y2, Z) + Output P' = (x1', y1', Z3), P + Q = (x3, y3, Z3) + or P => P', Q => P + Q +*/ +static void XYcZ_add(uECC_word_t * RESTRICT X1, + uECC_word_t * RESTRICT Y1, + uECC_word_t * RESTRICT X2, + uECC_word_t * RESTRICT Y2) { + /* t1 = X1, t2 = Y1, t3 = X2, t4 = Y2 */ + uECC_word_t t5[uECC_WORDS]; + + vli_modSub_fast(t5, X2, X1); /* t5 = x2 - x1 */ + vli_modSquare_fast(t5, t5); /* t5 = (x2 - x1)^2 = A */ + vli_modMult_fast(X1, X1, t5); /* t1 = x1*A = B */ + vli_modMult_fast(X2, X2, t5); /* t3 = x2*A = C */ + vli_modSub_fast(Y2, Y2, Y1); /* t4 = y2 - y1 */ + vli_modSquare_fast(t5, Y2); /* t5 = (y2 - y1)^2 = D */ + + vli_modSub_fast(t5, t5, X1); /* t5 = D - B */ + vli_modSub_fast(t5, t5, X2); /* t5 = D - B - C = x3 */ + vli_modSub_fast(X2, X2, X1); /* t3 = C - B */ + vli_modMult_fast(Y1, Y1, X2); /* t2 = y1*(C - B) */ + vli_modSub_fast(X2, X1, t5); /* t3 = B - x3 */ + vli_modMult_fast(Y2, Y2, X2); /* t4 = (y2 - y1)*(B - x3) */ + vli_modSub_fast(Y2, Y2, Y1); /* t4 = y3 */ + + vli_set(X2, t5); +} + +/* Input P = (x1, y1, Z), Q = (x2, y2, Z) + Output P + Q = (x3, y3, Z3), P - Q = (x3', y3', Z3) + or P => P - Q, Q => P + Q +*/ +static void XYcZ_addC(uECC_word_t * RESTRICT X1, + uECC_word_t * RESTRICT Y1, + uECC_word_t * RESTRICT X2, + uECC_word_t * RESTRICT Y2) { + /* t1 = X1, t2 = Y1, t3 = X2, t4 = Y2 */ + uECC_word_t t5[uECC_WORDS]; + uECC_word_t t6[uECC_WORDS]; + uECC_word_t t7[uECC_WORDS]; + + vli_modSub_fast(t5, X2, X1); /* t5 = x2 - x1 */ + vli_modSquare_fast(t5, t5); /* t5 = (x2 - x1)^2 = A */ + vli_modMult_fast(X1, X1, t5); /* t1 = x1*A = B */ + vli_modMult_fast(X2, X2, t5); /* t3 = x2*A = C */ + vli_modAdd(t5, Y2, Y1, curve_p); /* t5 = y2 + y1 */ + vli_modSub_fast(Y2, Y2, Y1); /* t4 = y2 - y1 */ + + vli_modSub_fast(t6, X2, X1); /* t6 = C - B */ + vli_modMult_fast(Y1, Y1, t6); /* t2 = y1 * (C - B) = E */ + vli_modAdd(t6, X1, X2, curve_p); /* t6 = B + C */ + vli_modSquare_fast(X2, Y2); /* t3 = (y2 - y1)^2 = D */ + vli_modSub_fast(X2, X2, t6); /* t3 = D - (B + C) = x3 */ + + vli_modSub_fast(t7, X1, X2); /* t7 = B - x3 */ + vli_modMult_fast(Y2, Y2, t7); /* t4 = (y2 - y1)*(B - x3) */ + vli_modSub_fast(Y2, Y2, Y1); /* t4 = (y2 - y1)*(B - x3) - E = y3 */ + + vli_modSquare_fast(t7, t5); /* t7 = (y2 + y1)^2 = F */ + vli_modSub_fast(t7, t7, t6); /* t7 = F - (B + C) = x3' */ + vli_modSub_fast(t6, t7, X1); /* t6 = x3' - B */ + vli_modMult_fast(t6, t6, t5); /* t6 = (y2 + y1)*(x3' - B) */ + vli_modSub_fast(Y1, t6, Y1); /* t2 = (y2 + y1)*(x3' - B) - E = y3' */ + + vli_set(X1, t7); +} + +enum +{ + ECC_POINT_MULT_STATE_INIT, + ECC_POINT_MULT_STATE_BIT_ADDC, + ECC_POINT_MULT_STATE_BIT_ADD, + ECC_POINT_MULT_STATE_EXIT_ADDC, + ECC_POINT_MULT_STATE_EXIT_ADD, + ECC_POINT_MULT_STATE_COMPLETE +}; + +typedef struct +{ + uint8_t state; + uECC_word_t Rx[2][uECC_WORDS]; + uECC_word_t Ry[2][uECC_WORDS]; + bitcount_t i; +} EccPointMultCtx; + +static int EccPoint_mult(EccPointMultCtx *pCtx, + EccPoint * RESTRICT result, + const EccPoint * RESTRICT point, + const uECC_word_t * RESTRICT scalar, + const uECC_word_t * RESTRICT initialZ, + bitcount_t numBits) { + uECC_word_t nb; + uECC_word_t z[uECC_WORDS]; + + switch (pCtx->state) { + case ECC_POINT_MULT_STATE_INIT: + vli_set(pCtx->Rx[1], point->x); + vli_set(pCtx->Ry[1], point->y); + + XYcZ_initial_double(pCtx->Rx[1], pCtx->Ry[1], pCtx->Rx[0], pCtx->Ry[0], initialZ); + + pCtx->i = numBits - 2; + pCtx->state = ECC_POINT_MULT_STATE_BIT_ADDC; + return 0; + + case ECC_POINT_MULT_STATE_BIT_ADDC: + nb = !vli_testBit(scalar, pCtx->i); + XYcZ_addC(pCtx->Rx[1 - nb], pCtx->Ry[1 - nb], pCtx->Rx[nb], pCtx->Ry[nb]); + + pCtx->state = ECC_POINT_MULT_STATE_BIT_ADD; + return 0; + + case ECC_POINT_MULT_STATE_BIT_ADD: + nb = !vli_testBit(scalar, pCtx->i); + XYcZ_add(pCtx->Rx[nb], pCtx->Ry[nb], pCtx->Rx[1 - nb], pCtx->Ry[1 - nb]); + + pCtx->i--; + pCtx->state = (pCtx->i > 0) ? ECC_POINT_MULT_STATE_BIT_ADDC : ECC_POINT_MULT_STATE_EXIT_ADDC; + return 0; + + case ECC_POINT_MULT_STATE_EXIT_ADDC: + nb = !vli_testBit(scalar, 0); + XYcZ_addC(pCtx->Rx[1 - nb], pCtx->Ry[1 - nb], pCtx->Rx[nb], pCtx->Ry[nb]); + + pCtx->state = ECC_POINT_MULT_STATE_EXIT_ADD; + return 0; + + case ECC_POINT_MULT_STATE_EXIT_ADD: + nb = !vli_testBit(scalar, 0); + + /* Find final 1/Z value. */ + vli_modSub_fast(z, pCtx->Rx[1], pCtx->Rx[0]); /* X1 - X0 */ + vli_modMult_fast(z, z, pCtx->Ry[1 - nb]); /* Yb * (X1 - X0) */ + vli_modMult_fast(z, z, point->x); /* xP * Yb * (X1 - X0) */ + vli_modInv(z, z, curve_p); /* 1 / (xP * Yb * (X1 - X0)) */ + vli_modMult_fast(z, z, point->y); /* yP / (xP * Yb * (X1 - X0)) */ + vli_modMult_fast(z, z, pCtx->Rx[1 - nb]); /* Xb * yP / (xP * Yb * (X1 - X0)) */ + /* End 1/Z calculation */ + + XYcZ_add(pCtx->Rx[nb], pCtx->Ry[nb], pCtx->Rx[1 - nb], pCtx->Ry[1 - nb]); + apply_z(pCtx->Rx[0], pCtx->Ry[0], z); + + vli_set(result->x, pCtx->Rx[0]); + vli_set(result->y, pCtx->Ry[0]); + + pCtx->state = ECC_POINT_MULT_STATE_COMPLETE; + return 1; + + case ECC_POINT_MULT_STATE_COMPLETE: + default: + return 1; + } +} + +#if uECC_WORD_SIZE == 4 + +static void vli_nativeToBytes(uint8_t *bytes, const uint32_t *native) { + unsigned i; + for (i = 0; i < uECC_WORDS; ++i) { + uint8_t *digit = bytes + 4 * (uECC_WORDS - 1 - i); + digit[0] = (uint8_t)(native[i] >> 24); + digit[1] = (uint8_t)(native[i] >> 16); + digit[2] = (uint8_t)(native[i] >> 8); + digit[3] = (uint8_t)(native[i]); + } +} + +static void vli_bytesToNative(uint32_t *native, const uint8_t *bytes) { + unsigned i; + for (i = 0; i < uECC_WORDS; ++i) { + const uint8_t *digit = bytes + 4 * (uECC_WORDS - 1 - i); + native[i] = ((uint32_t)digit[0] << 24) | ((uint32_t)digit[1] << 16) | + ((uint32_t)digit[2] << 8) | (uint32_t)digit[3]; + } +} + +#endif /* uECC_WORD_SIZE */ + +enum +{ + ECC_MAKE_KEY_STATE_INIT, + ECC_MAKE_KEY_STATE_ECC_POINT_MULT, + ECC_MAKE_KEY_STATE_EXIT, + ECC_MAKE_KEY_STATE_COMPLETE +}; + +typedef struct EccMakeKeyCtx { + uint8_t state; + uECC_word_t private[uECC_WORDS]; + EccPoint public; + uECC_word_t tmp1[uECC_WORDS]; + uECC_word_t tmp2[uECC_WORDS]; + uECC_word_t *p2[2]; + uECC_word_t carry; + + EccPointMultCtx pointMultCtx; +} EccMakeKeyCtx; + +typedef struct EccSharedSecretCtx { + uECC_word_t random[uECC_WORDS]; + uECC_word_t *initial_Z; + EccPoint public; + EccPoint product; + uECC_word_t private[uECC_WORDS]; + uECC_word_t tmp[uECC_WORDS]; + uECC_word_t *p2[2]; + uECC_word_t carry; + + EccPointMultCtx pointMultCtx; +} EccSharedSecretCtx; + +typedef union EccCtx { + EccMakeKeyCtx makeKey; + EccSharedSecretCtx sharedSecret; +} EccCtx; + +static EccCtx uECC_ctx; + +/************************************************************************************************** + Make Key +**************************************************************************************************/ + +void uECC_make_key_start(const uint8_t private_key[uECC_BYTES]) { + memset(&uECC_ctx, 0, sizeof(uECC_ctx)); + uECC_ctx.makeKey.state = ECC_MAKE_KEY_STATE_INIT; + vli_bytesToNative(uECC_ctx.makeKey.private, private_key); +} + +int uECC_make_key_continue(void) { + switch (uECC_ctx.makeKey.state) { + case ECC_MAKE_KEY_STATE_INIT: + /* Make sure the private key is in the range [1, n-1]. */ + if (vli_isZero(uECC_ctx.makeKey.private)) { + return 0; + } + + if (vli_cmp(curve_n, uECC_ctx.makeKey.private) != 1) { + return 0; + } + + // Regularize the bitcount for the private key so that attackers cannot use a side channel + // attack to learn the number of leading zeros. + uECC_ctx.makeKey.p2[0] = uECC_ctx.makeKey.tmp1; + uECC_ctx.makeKey.p2[1] = uECC_ctx.makeKey.tmp2; + uECC_ctx.makeKey.carry = vli_add(uECC_ctx.makeKey.tmp1, uECC_ctx.makeKey.private, curve_n); + vli_add(uECC_ctx.makeKey.tmp2, uECC_ctx.makeKey.tmp1, curve_n); + + uECC_ctx.makeKey.pointMultCtx.state = 0; + uECC_ctx.makeKey.state = ECC_MAKE_KEY_STATE_ECC_POINT_MULT; + return 0; + + case ECC_MAKE_KEY_STATE_ECC_POINT_MULT: + if (EccPoint_mult(&uECC_ctx.makeKey.pointMultCtx, + &uECC_ctx.makeKey.public, + &curve_G, + uECC_ctx.makeKey.p2[!uECC_ctx.makeKey.carry], + 0, + (uECC_BYTES * 8) + 1)) { + uECC_ctx.makeKey.state = ECC_MAKE_KEY_STATE_EXIT; + } + return 0; + + case ECC_MAKE_KEY_STATE_EXIT: + if (EccPoint_isZero(&uECC_ctx.makeKey.public)) { + uECC_ctx.makeKey.state = ECC_MAKE_KEY_STATE_INIT; + return 0; + } + + uECC_ctx.makeKey.state = ECC_MAKE_KEY_STATE_COMPLETE; + return 1; + + case ECC_MAKE_KEY_STATE_COMPLETE: + default: + return 1; + } +} + +void uECC_make_key_complete(uint8_t public_key[uECC_BYTES*2], uint8_t private_key[uECC_BYTES]) { + vli_nativeToBytes(private_key, uECC_ctx.makeKey.private); + vli_nativeToBytes(public_key, uECC_ctx.makeKey.public.x); + vli_nativeToBytes(public_key + uECC_BYTES, uECC_ctx.makeKey.public.y); +} + +/************************************************************************************************** + Shared Secret +**************************************************************************************************/ + +void uECC_shared_secret_start(const uint8_t public_key[uECC_BYTES*2], + const uint8_t private_key[uECC_BYTES]) { + uECC_word_t tries; + + memset(&uECC_ctx, 0, sizeof(uECC_ctx)); + + // Try to get a random initial Z value to improve protection against side-channel + // attacks. If the RNG fails every time (eg it was not defined), we continue so that + // uECC_shared_secret() can still work without an RNG defined. + uECC_ctx.sharedSecret.initial_Z = NULL; + for (tries = 0; tries < MAX_TRIES; ++tries) { + if (g_rng_function((uint8_t *)uECC_ctx.sharedSecret.random, sizeof(uECC_ctx.sharedSecret.random)) && !vli_isZero(uECC_ctx.sharedSecret.random)) { + uECC_ctx.sharedSecret.initial_Z = uECC_ctx.sharedSecret.random; + break; + } + } + + vli_bytesToNative(uECC_ctx.sharedSecret.private, private_key); + vli_bytesToNative(uECC_ctx.sharedSecret.public.x, public_key); + vli_bytesToNative(uECC_ctx.sharedSecret.public.y, public_key + uECC_BYTES); + + // Regularize the bitcount for the private key so that attackers cannot use a side channel + // attack to learn the number of leading zeros. + uECC_ctx.sharedSecret.p2[0] = uECC_ctx.sharedSecret.private; + uECC_ctx.sharedSecret.p2[1] = uECC_ctx.sharedSecret.tmp; + uECC_ctx.sharedSecret.carry = vli_add(uECC_ctx.sharedSecret.private, uECC_ctx.sharedSecret.private, curve_n); + vli_add(uECC_ctx.sharedSecret.tmp, uECC_ctx.sharedSecret.private, curve_n); + + uECC_ctx.sharedSecret.pointMultCtx.state = 0; +} + +int uECC_shared_secret_continue(void) { + return EccPoint_mult(&uECC_ctx.sharedSecret.pointMultCtx, + &uECC_ctx.sharedSecret.product, + &uECC_ctx.sharedSecret.public, + uECC_ctx.sharedSecret.p2[!uECC_ctx.sharedSecret.carry], + uECC_ctx.sharedSecret.initial_Z, + (uECC_BYTES * 8) + 1); +} + +void uECC_shared_secret_complete(uint8_t secret[uECC_BYTES]) { + vli_nativeToBytes(secret, uECC_ctx.sharedSecret.product.x); +}