1 /* $NetBSD: bn_fast_mp_montgomery_reduce.c,v 1.2 2017/01/28 21:31:47 christos Exp $ */
2
3 #include <tommath.h>
4 #ifdef BN_FAST_MP_MONTGOMERY_REDUCE_C
5 /* LibTomMath, multiple-precision integer library -- Tom St Denis
6 *
7 * LibTomMath is a library that provides multiple-precision
8 * integer arithmetic as well as number theoretic functionality.
9 *
10 * The library was designed directly after the MPI library by
11 * Michael Fromberger but has been written from scratch with
12 * additional optimizations in place.
13 *
14 * The library is free for all purposes without any express
15 * guarantee it works.
16 *
17 * Tom St Denis, tomstdenis@gmail.com, http://libtom.org
18 */
19
20 /* computes xR**-1 == x (mod N) via Montgomery Reduction
21 *
22 * This is an optimized implementation of montgomery_reduce
23 * which uses the comba method to quickly calculate the columns of the
24 * reduction.
25 *
26 * Based on Algorithm 14.32 on pp.601 of HAC.
27 */
fast_mp_montgomery_reduce(mp_int * x,mp_int * n,mp_digit rho)28 int fast_mp_montgomery_reduce (mp_int * x, mp_int * n, mp_digit rho)
29 {
30 int ix, res, olduse;
31 mp_word W[MP_WARRAY];
32
33 /* get old used count */
34 olduse = x->used;
35
36 /* grow a as required */
37 if (x->alloc < n->used + 1) {
38 if ((res = mp_grow (x, n->used + 1)) != MP_OKAY) {
39 return res;
40 }
41 }
42
43 /* first we have to get the digits of the input into
44 * an array of double precision words W[...]
45 */
46 {
47 register mp_word *_W;
48 register mp_digit *tmpx;
49
50 /* alias for the W[] array */
51 _W = W;
52
53 /* alias for the digits of x*/
54 tmpx = x->dp;
55
56 /* copy the digits of a into W[0..a->used-1] */
57 for (ix = 0; ix < x->used; ix++) {
58 *_W++ = *tmpx++;
59 }
60
61 /* zero the high words of W[a->used..m->used*2] */
62 for (; ix < n->used * 2 + 1; ix++) {
63 *_W++ = 0;
64 }
65 }
66
67 /* now we proceed to zero successive digits
68 * from the least significant upwards
69 */
70 for (ix = 0; ix < n->used; ix++) {
71 /* mu = ai * m' mod b
72 *
73 * We avoid a double precision multiplication (which isn't required)
74 * by casting the value down to a mp_digit. Note this requires
75 * that W[ix-1] have the carry cleared (see after the inner loop)
76 */
77 register mp_digit mu;
78 mu = (mp_digit) (((W[ix] & MP_MASK) * rho) & MP_MASK);
79
80 /* a = a + mu * m * b**i
81 *
82 * This is computed in place and on the fly. The multiplication
83 * by b**i is handled by offseting which columns the results
84 * are added to.
85 *
86 * Note the comba method normally doesn't handle carries in the
87 * inner loop In this case we fix the carry from the previous
88 * column since the Montgomery reduction requires digits of the
89 * result (so far) [see above] to work. This is
90 * handled by fixing up one carry after the inner loop. The
91 * carry fixups are done in order so after these loops the
92 * first m->used words of W[] have the carries fixed
93 */
94 {
95 register int iy;
96 register mp_digit *tmpn;
97 register mp_word *_W;
98
99 /* alias for the digits of the modulus */
100 tmpn = n->dp;
101
102 /* Alias for the columns set by an offset of ix */
103 _W = W + ix;
104
105 /* inner loop */
106 for (iy = 0; iy < n->used; iy++) {
107 *_W++ += ((mp_word)mu) * ((mp_word)*tmpn++);
108 }
109 }
110
111 /* now fix carry for next digit, W[ix+1] */
112 W[ix + 1] += W[ix] >> ((mp_word) DIGIT_BIT);
113 }
114
115 /* now we have to propagate the carries and
116 * shift the words downward [all those least
117 * significant digits we zeroed].
118 */
119 {
120 register mp_digit *tmpx;
121 register mp_word *_W, *_W1;
122
123 /* nox fix rest of carries */
124
125 /* alias for current word */
126 _W1 = W + ix;
127
128 /* alias for next word, where the carry goes */
129 _W = W + ++ix;
130
131 for (; ix <= n->used * 2 + 1; ix++) {
132 *_W++ += *_W1++ >> ((mp_word) DIGIT_BIT);
133 }
134
135 /* copy out, A = A/b**n
136 *
137 * The result is A/b**n but instead of converting from an
138 * array of mp_word to mp_digit than calling mp_rshd
139 * we just copy them in the right order
140 */
141
142 /* alias for destination word */
143 tmpx = x->dp;
144
145 /* alias for shifted double precision result */
146 _W = W + n->used;
147
148 for (ix = 0; ix < n->used + 1; ix++) {
149 *tmpx++ = (mp_digit)(*_W++ & ((mp_word) MP_MASK));
150 }
151
152 /* zero oldused digits, if the input a was larger than
153 * m->used+1 we'll have to clear the digits
154 */
155 for (; ix < olduse; ix++) {
156 *tmpx++ = 0;
157 }
158 }
159
160 /* set the max used and clamp */
161 x->used = n->used + 1;
162 mp_clamp (x);
163
164 /* if A >= m then A = A - m */
165 if (mp_cmp_mag (x, n) != MP_LT) {
166 return s_mp_sub (x, n, x);
167 }
168 return MP_OKAY;
169 }
170 #endif
171
172 /* Source: /cvs/libtom/libtommath/bn_fast_mp_montgomery_reduce.c,v */
173 /* Revision: 1.4 */
174 /* Date: 2006/12/28 01:25:13 */
175