usr.bin/ssh/ed25519.c

83 #define fe25519_mul          crypto_sign_ed25519_ref_fe25519_mul
118 static void fe25519_mul(fe25519 *r, const fe25519 *x, const fe25519 *y);
312 static void fe25519_mul(fe25519 *r, const fe25519 *x, const fe25519 *y)
331   fe25519_mul(r, x, x);
351 	/* 9 */ fe25519_mul(&z9,&t0,x);
352 	/* 11 */ fe25519_mul(&z11,&z9,&z2);
354 	/* 2^5 - 2^0 = 31 */ fe25519_mul(&z2_5_0,&t0,&z9);
361 	/* 2^10 - 2^0 */ fe25519_mul(&z2_10_0,&t0,&z2_5_0);
366 	/* 2^20 - 2^0 */ fe25519_mul(&z2_20_0,&t1,&z2_10_0);
371 	/* 2^40 - 2^0 */ fe25519_mul(&t0,&t1,&z2_20_0);
376 	/* 2^50 - 2^0 */ fe25519_mul(&z2_50_0,&t0,&z2_10_0);
381 	/* 2^100 - 2^0 */ fe25519_mul(&z2_100_0,&t1,&z2_50_0);
386 	/* 2^200 - 2^0 */ fe25519_mul(&t1,&t0,&z2_100_0);
391 	/* 2^250 - 2^0 */ fe25519_mul(&t0,&t1,&z2_50_0);
398 	/* 2^255 - 21 */ fe25519_mul(r,&t1,&z11);
417 	/* 9 */ fe25519_mul(&z9,&t,x);
418 	/* 11 */ fe25519_mul(&z11,&z9,&z2);
420 	/* 2^5 - 2^0 = 31 */ fe25519_mul(&z2_5_0,&t,&z9);
424 	/* 2^10 - 2^0 */ fe25519_mul(&z2_10_0,&t,&z2_5_0);
428 	/* 2^20 - 2^0 */ fe25519_mul(&z2_20_0,&t,&z2_10_0);
432 	/* 2^40 - 2^0 */ fe25519_mul(&t,&t,&z2_20_0);
436 	/* 2^50 - 2^0 */ fe25519_mul(&z2_50_0,&t,&z2_10_0);
440 	/* 2^100 - 2^0 */ fe25519_mul(&z2_100_0,&t,&z2_50_0);
444 	/* 2^200 - 2^0 */ fe25519_mul(&t,&t,&z2_100_0);
448 	/* 2^250 - 2^0 */ fe25519_mul(&t,&t,&z2_50_0);
452 	/* 2^252 - 3 */ fe25519_mul(r,&t,x);
1659   fe25519_mul(&r->x, &p->x, &p->t);
1660   fe25519_mul(&r->y, &p->y, &p->z);
1661   fe25519_mul(&r->z, &p->z, &p->t);
1667   fe25519_mul(&r->t, &p->x, &p->y);
1673   fe25519_mul(&qt, &q->x, &q->y);
1678   fe25519_mul(&a, &a, &t1);
1679   fe25519_mul(&b, &b, &t2);
1682   fe25519_mul(&c, &r->t, &qt); /* C = T1*k*T2 */
1683   fe25519_mul(&c, &c, &ge25519_ec2d);
1687   fe25519_mul(&r->x, &e, &f);
1688   fe25519_mul(&r->y, &h, &g);
1689   fe25519_mul(&r->z, &g, &f);
1690   fe25519_mul(&r->t, &e, &h);
1699   fe25519_mul(&a, &a, &t);
1702   fe25519_mul(&b, &b, &t);
1703   fe25519_mul(&c, &p->t, &q->t); /* C = T1*k*T2 */
1704   fe25519_mul(&c, &c, &ge25519_ec2d);
1705   fe25519_mul(&d, &p->z, &q->z); /* D = Z1*2*Z2 */
1791   fe25519_mul(&den, &num, &ge25519_ecd); /* den = dy^2 */
1799   fe25519_mul(&den6, &den4, &den2);
1800   fe25519_mul(&t, &den6, &num);
1801   fe25519_mul(&t, &t, &den);
1805   fe25519_mul(&t, &t, &num);
1806   fe25519_mul(&t, &t, &den);
1807   fe25519_mul(&t, &t, &den);
1808   fe25519_mul(&r->x, &t, &den);
1812   fe25519_mul(&chk, &chk, &den);
1814     fe25519_mul(&r->x, &r->x, &ge25519_sqrtm1);
1818   fe25519_mul(&chk, &chk, &den);
1826   fe25519_mul(&r->t, &r->x, &r->y);
1834   fe25519_mul(&tx, &p->x, &zi);
1835   fe25519_mul(&ty, &p->y, &zi);
1902   fe25519_mul(&r->t, &r->x, &r->y);