libcrypto/curve25519/curve25519.c

69   int64_t h9 = (load_3(s + 29) & 8388607) << 2;
81   carry9 = h9 + (1 << 24); h0 += (carry9 >> 25) * 19; h9 -= carry9 & kTop39Bits;
91   carry8 = h8 + (1 << 25); h9 += carry8 >> 26; h8 -= carry8 & kTop38Bits;
102   h[9] = h9;
109  * Basic claim: q = floor(2^(-255)(h + 19 2^(-25)h9 + 2^(-1))).
113  *   Also have |h-2^230 h9|<2^231 so |19 2^(-255)(h-2^230 h9)|<1/4.
115  *   Write y=2^(-1)-19^2 2^(-255)q-19 2^(-255)(h-2^230 h9).
125  *   Have q+2^(-255)x = 2^(-255)(h + 19 2^(-25) h9 + 2^(-1))
126  *   so floor(2^(-255)(h + 19 2^(-25) h9 + 2^(-1))) = q. */
137   int32_t h9 = h[9];
140   q = (19 * h9 + (((int32_t) 1) << 24)) >> 25;
150   q = (h9 + q) >> 25;
164   h9 += h8 >> 26; h8 &= kBottom26Bits;
165                   h9 &= kBottom25Bits;
169    * Have h0+...+2^230 h9 between 0 and 2^255-1;
171    * Goal: Output h0+...+2^230 h9.  */
201   s[28] = (h8 >> 20) | ((uint32_t)(h9) << 6);
202   s[29] = h9 >> 2;
203   s[30] = h9 >> 10;
204   s[31] = h9 >> 18;
424   int64_t h9 = f0g9+f1g8   +f2g7   +f3g6   +f4g5   +f5g4   +f6g3   +f7g2   +f8g1   +f9g0   ;
439    *   i.e. |h1| <= 1.7*2^59; narrower ranges for h3, h5, h7, h9 */
470   carry8 = h8 + (1 << 25); h9 += carry8 >> 26; h8 -= carry8 & kTop38Bits;
474   /* |h9| <= 1.71*2^59 */
476   carry9 = h9 + (1 << 24); h0 += (carry9 >> 25) * 19; h9 -= carry9 & kTop39Bits;
477   /* |h9| <= 2^24; from now on fits into int32 unchanged */
493   h[9] = h9;
594   int64_t h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
619   carry8 = h8 + (1 << 25); h9 += carry8 >> 26; h8 -= carry8 & kTop38Bits;
621   carry9 = h9 + (1 << 24); h0 += (carry9 >> 25) * 19; h9 -= carry9 & kTop39Bits;
634   h[9] = h9;
845   int64_t h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
866   h9 += h9;
881   carry8 = h8 + (1 << 25); h9 += carry8 >> 26; h8 -= carry8 & kTop38Bits;
883   carry9 = h9 + (1 << 24); h0 += (carry9 >> 25) * 19; h9 -= carry9 & kTop39Bits;
896   h[9] = h9;
4785   int64_t h9 = f9 * (int64_t) 121666;
4797   carry9 = h9 + (1 << 24); h0 += (carry9 >> 25) * 19; h9 -= carry9 & kTop39Bits;
4807   carry8 = h8 + (1 << 25); h9 += carry8 >> 26; h8 -= carry8 & kTop38Bits;
4818   h[9] = h9;