crypto/ec/ecp_nistp521.c

686     felem ftmp, ftmp2, ftmp3, ftmp4;
691     felem_reduce(ftmp, tmp);    /* 2^1 */
692     felem_mul(tmp, in, ftmp);
693     felem_reduce(ftmp, tmp);    /* 2^2 - 2^0 */
694     felem_assign(ftmp2, ftmp);
695     felem_square(tmp, ftmp);
696     felem_reduce(ftmp, tmp);    /* 2^3 - 2^1 */
697     felem_mul(tmp, in, ftmp);
698     felem_reduce(ftmp, tmp);    /* 2^3 - 2^0 */
699     felem_square(tmp, ftmp);
700     felem_reduce(ftmp, tmp);    /* 2^4 - 2^1 */
719     felem_mul(tmp, ftmp3, ftmp);
799     felem ftmp;
801     felem_assign(ftmp, in);
803     ftmp[0] += ftmp[8] >> 57;
804     ftmp[8] &= bottom57bits;
805     /* ftmp[8] < 2^57 */
806     ftmp[1] += ftmp[0] >> 58;
807     ftmp[0] &= bottom58bits;
808     ftmp[2] += ftmp[1] >> 58;
809     ftmp[1] &= bottom58bits;
810     ftmp[3] += ftmp[2] >> 58;
811     ftmp[2] &= bottom58bits;
812     ftmp[4] += ftmp[3] >> 58;
813     ftmp[3] &= bottom58bits;
814     ftmp[5] += ftmp[4] >> 58;
815     ftmp[4] &= bottom58bits;
816     ftmp[6] += ftmp[5] >> 58;
817     ftmp[5] &= bottom58bits;
818     ftmp[7] += ftmp[6] >> 58;
819     ftmp[6] &= bottom58bits;
820     ftmp[8] += ftmp[7] >> 58;
821     ftmp[7] &= bottom58bits;
822     /* ftmp[8] < 2^57 + 4 */
826      * than our bound for ftmp[8]. Therefore we only have to check if the
831     is_zero |= ftmp[0];
832     is_zero |= ftmp[1];
833     is_zero |= ftmp[2];
834     is_zero |= ftmp[3];
835     is_zero |= ftmp[4];
836     is_zero |= ftmp[5];
837     is_zero |= ftmp[6];
838     is_zero |= ftmp[7];
839     is_zero |= ftmp[8];
843      * We know that ftmp[i] < 2^63, therefore the only way that the top bit
848     is_p = ftmp[0] ^ kPrime[0];
849     is_p |= ftmp[1] ^ kPrime[1];
850     is_p |= ftmp[2] ^ kPrime[2];
851     is_p |= ftmp[3] ^ kPrime[3];
852     is_p |= ftmp[4] ^ kPrime[4];
853     is_p |= ftmp[5] ^ kPrime[5];
854     is_p |= ftmp[6] ^ kPrime[6];
855     is_p |= ftmp[7] ^ kPrime[7];
856     is_p |= ftmp[8] ^ kPrime[8];
1025     felem delta, gamma, beta, alpha, ftmp, ftmp2;
1027     felem_assign(ftmp, x_in);
1043     felem_diff64(ftmp, delta);
1044     /* ftmp[i] < 2^61 */
1049     felem_mul(tmp, ftmp, ftmp2);
1064     felem_assign(ftmp, beta);
1065     felem_scalar64(ftmp, 8);
1066     /* ftmp[i] < 2^62 + 2^17 */
1067     felem_diff_128_64(tmp, ftmp);
1074     felem_assign(ftmp, y_in);
1075     felem_sum64(ftmp, z_in);
1076     /* ftmp[i] < 2^60 + 2^15 */
1077     felem_square(tmp, ftmp);
1144     felem ftmp, ftmp2, ftmp3, ftmp4, ftmp5, ftmp6, x_out, y_out, z_out;
1151     /* ftmp = z1z1 = z1**2 */
1153     felem_reduce(ftmp, tmp);
1172         felem_diff_128_64(tmp, ftmp);
1201     felem_mul(tmp, x2, ftmp);
1215     /* ftmp = z1 * z1z1 */
1216     felem_mul(tmp, ftmp, z1);
1217     felem_reduce(ftmp, tmp);
1220     felem_mul(tmp, y2, ftmp);
1236     /* I = ftmp = (2h)**2 */
1237     felem_assign(ftmp, ftmp4);
1238     felem_scalar64(ftmp, 2);
1239     /* ftmp[i] < 2^61 */
1240     felem_square(tmp, ftmp);
1242     felem_reduce(ftmp, tmp);
1245     felem_mul(tmp, ftmp4, ftmp);
1249     felem_mul(tmp, ftmp3, ftmp);