crypto/ec/ecp_nistp521.c

488  * felem_mul sets |out| = |in1| * |in2|
491  *   in2[i] < 2^63
493  *   out[i] < 17 * max(in1[i]) * max(in2[i])
495 static void felem_mul(largefelem out, const felem in1, const felem in2)
498     felem_scalar(in2x2, in2, 2);
500     out[0] = ((uint128_t) in1[0]) * in2[0];
502     out[1] = ((uint128_t) in1[0]) * in2[1] + ((uint128_t) in1[1]) * in2[0];
504     out[2] = ((uint128_t) in1[0]) * in2[2] +
505         ((uint128_t) in1[1]) * in2[1] + ((uint128_t) in1[2]) * in2[0];
507     out[3] = ((uint128_t) in1[0]) * in2[3] +
508         ((uint128_t) in1[1]) * in2[2] +
509         ((uint128_t) in1[2]) * in2[1] + ((uint128_t) in1[3]) * in2[0];
511     out[4] = ((uint128_t) in1[0]) * in2[4] +
512         ((uint128_t) in1[1]) * in2[3] +
513         ((uint128_t) in1[2]) * in2[2] +
514         ((uint128_t) in1[3]) * in2[1] + ((uint128_t) in1[4]) * in2[0];
516     out[5] = ((uint128_t) in1[0]) * in2[5] +
517         ((uint128_t) in1[1]) * in2[4] +
518         ((uint128_t) in1[2]) * in2[3] +
519         ((uint128_t) in1[3]) * in2[2] +
520         ((uint128_t) in1[4]) * in2[1] + ((uint128_t) in1[5]) * in2[0];
522     out[6] = ((uint128_t) in1[0]) * in2[6] +
523         ((uint128_t) in1[1]) * in2[5] +
524         ((uint128_t) in1[2]) * in2[4] +
525         ((uint128_t) in1[3]) * in2[3] +
526         ((uint128_t) in1[4]) * in2[2] +
527         ((uint128_t) in1[5]) * in2[1] + ((uint128_t) in1[6]) * in2[0];
529     out[7] = ((uint128_t) in1[0]) * in2[7] +
530         ((uint128_t) in1[1]) * in2[6] +
531         ((uint128_t) in1[2]) * in2[5] +
532         ((uint128_t) in1[3]) * in2[4] +
533         ((uint128_t) in1[4]) * in2[3] +
534         ((uint128_t) in1[5]) * in2[2] +
535         ((uint128_t) in1[6]) * in2[1] + ((uint128_t) in1[7]) * in2[0];
537     out[8] = ((uint128_t) in1[0]) * in2[8] +
538         ((uint128_t) in1[1]) * in2[7] +
539         ((uint128_t) in1[2]) * in2[6] +
540         ((uint128_t) in1[3]) * in2[5] +
541         ((uint128_t) in1[4]) * in2[4] +
542         ((uint128_t) in1[5]) * in2[3] +
543         ((uint128_t) in1[6]) * in2[2] +
544         ((uint128_t) in1[7]) * in2[1] + ((uint128_t) in1[8]) * in2[0];
678 static void felem_mul_reduce(felem out, const felem in1, const felem in2)
681     felem_mul(tmp, in1, in2);