bn_lcl.h revision 280297
155714Skris/* crypto/bn/bn_lcl.h */ 255714Skris/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 355714Skris * All rights reserved. 455714Skris * 555714Skris * This package is an SSL implementation written 655714Skris * by Eric Young (eay@cryptsoft.com). 755714Skris * The implementation was written so as to conform with Netscapes SSL. 8280297Sjkim * 955714Skris * This library is free for commercial and non-commercial use as long as 1055714Skris * the following conditions are aheared to. The following conditions 1155714Skris * apply to all code found in this distribution, be it the RC4, RSA, 1255714Skris * lhash, DES, etc., code; not just the SSL code. The SSL documentation 1355714Skris * included with this distribution is covered by the same copyright terms 1455714Skris * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15280297Sjkim * 1655714Skris * Copyright remains Eric Young's, and as such any Copyright notices in 1755714Skris * the code are not to be removed. 1855714Skris * If this package is used in a product, Eric Young should be given attribution 1955714Skris * as the author of the parts of the library used. 2055714Skris * This can be in the form of a textual message at program startup or 2155714Skris * in documentation (online or textual) provided with the package. 22280297Sjkim * 2355714Skris * Redistribution and use in source and binary forms, with or without 2455714Skris * modification, are permitted provided that the following conditions 2555714Skris * are met: 2655714Skris * 1. Redistributions of source code must retain the copyright 2755714Skris * notice, this list of conditions and the following disclaimer. 2855714Skris * 2. Redistributions in binary form must reproduce the above copyright 2955714Skris * notice, this list of conditions and the following disclaimer in the 3055714Skris * documentation and/or other materials provided with the distribution. 3155714Skris * 3. All advertising materials mentioning features or use of this software 3255714Skris * must display the following acknowledgement: 3355714Skris * "This product includes cryptographic software written by 3455714Skris * Eric Young (eay@cryptsoft.com)" 3555714Skris * The word 'cryptographic' can be left out if the rouines from the library 3655714Skris * being used are not cryptographic related :-). 37280297Sjkim * 4. If you include any Windows specific code (or a derivative thereof) from 3855714Skris * the apps directory (application code) you must include an acknowledgement: 3955714Skris * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40280297Sjkim * 4155714Skris * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 4255714Skris * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 4355714Skris * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 4455714Skris * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 4555714Skris * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 4655714Skris * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 4755714Skris * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 4855714Skris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 4955714Skris * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 5055714Skris * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 5155714Skris * SUCH DAMAGE. 52280297Sjkim * 5355714Skris * The licence and distribution terms for any publically available version or 5455714Skris * derivative of this code cannot be changed. i.e. this code cannot simply be 5555714Skris * copied and put under another distribution licence 5655714Skris * [including the GNU Public Licence.] 5755714Skris */ 5868651Skris/* ==================================================================== 5968651Skris * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. 6068651Skris * 6168651Skris * Redistribution and use in source and binary forms, with or without 6268651Skris * modification, are permitted provided that the following conditions 6368651Skris * are met: 6468651Skris * 6568651Skris * 1. Redistributions of source code must retain the above copyright 66280297Sjkim * notice, this list of conditions and the following disclaimer. 6768651Skris * 6868651Skris * 2. Redistributions in binary form must reproduce the above copyright 6968651Skris * notice, this list of conditions and the following disclaimer in 7068651Skris * the documentation and/or other materials provided with the 7168651Skris * distribution. 7268651Skris * 7368651Skris * 3. All advertising materials mentioning features or use of this 7468651Skris * software must display the following acknowledgment: 7568651Skris * "This product includes software developed by the OpenSSL Project 7668651Skris * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 7768651Skris * 7868651Skris * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 7968651Skris * endorse or promote products derived from this software without 8068651Skris * prior written permission. For written permission, please contact 8168651Skris * openssl-core@openssl.org. 8268651Skris * 8368651Skris * 5. Products derived from this software may not be called "OpenSSL" 8468651Skris * nor may "OpenSSL" appear in their names without prior written 8568651Skris * permission of the OpenSSL Project. 8668651Skris * 8768651Skris * 6. Redistributions of any form whatsoever must retain the following 8868651Skris * acknowledgment: 8968651Skris * "This product includes software developed by the OpenSSL Project 9068651Skris * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 9168651Skris * 9268651Skris * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 9368651Skris * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 9468651Skris * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 9568651Skris * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 9668651Skris * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 9768651Skris * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 9868651Skris * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 9968651Skris * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 10068651Skris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 10168651Skris * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 10268651Skris * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 10368651Skris * OF THE POSSIBILITY OF SUCH DAMAGE. 10468651Skris * ==================================================================== 10568651Skris * 10668651Skris * This product includes cryptographic software written by Eric Young 10768651Skris * (eay@cryptsoft.com). This product includes software written by Tim 10868651Skris * Hudson (tjh@cryptsoft.com). 10968651Skris * 11068651Skris */ 11155714Skris 11255714Skris#ifndef HEADER_BN_LCL_H 113280297Sjkim# define HEADER_BN_LCL_H 11455714Skris 115280297Sjkim# include <openssl/bn.h> 11655714Skris 11755714Skris#ifdef __cplusplus 11855714Skrisextern "C" { 11955714Skris#endif 12055714Skris 121280297Sjkim/*- 12268651Skris * BN_window_bits_for_exponent_size -- macro for sliding window mod_exp functions 12368651Skris * 12468651Skris * 12568651Skris * For window size 'w' (w >= 2) and a random 'b' bits exponent, 12668651Skris * the number of multiplications is a constant plus on average 12768651Skris * 12868651Skris * 2^(w-1) + (b-w)/(w+1); 12968651Skris * 13068651Skris * here 2^(w-1) is for precomputing the table (we actually need 13168651Skris * entries only for windows that have the lowest bit set), and 13268651Skris * (b-w)/(w+1) is an approximation for the expected number of 13368651Skris * w-bit windows, not counting the first one. 13468651Skris * 13568651Skris * Thus we should use 13668651Skris * 13768651Skris * w >= 6 if b > 671 13868651Skris * w = 5 if 671 > b > 239 13968651Skris * w = 4 if 239 > b > 79 14068651Skris * w = 3 if 79 > b > 23 14168651Skris * w <= 2 if 23 > b 14268651Skris * 14368651Skris * (with draws in between). Very small exponents are often selected 14468651Skris * with low Hamming weight, so we use w = 1 for b <= 23. 14568651Skris */ 146280297Sjkim# if 1 147280297Sjkim# define BN_window_bits_for_exponent_size(b) \ 148280297Sjkim ((b) > 671 ? 6 : \ 149280297Sjkim (b) > 239 ? 5 : \ 150280297Sjkim (b) > 79 ? 4 : \ 151280297Sjkim (b) > 23 ? 3 : 1) 152280297Sjkim# else 153280297Sjkim/* 154280297Sjkim * Old SSLeay/OpenSSL table. Maximum window size was 5, so this table differs 155280297Sjkim * for b==1024; but it coincides for other interesting values (b==160, 156280297Sjkim * b==512). 15768651Skris */ 158280297Sjkim# define BN_window_bits_for_exponent_size(b) \ 159280297Sjkim ((b) > 255 ? 5 : \ 160280297Sjkim (b) > 127 ? 4 : \ 161280297Sjkim (b) > 17 ? 3 : 1) 162280297Sjkim# endif 16368651Skris 164280297Sjkim/* 165280297Sjkim * BN_mod_exp_mont_conttime is based on the assumption that the L1 data cache 166280297Sjkim * line width of the target processor is at least the following value. 167160814Ssimon */ 168280297Sjkim# define MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH ( 64 ) 169280297Sjkim# define MOD_EXP_CTIME_MIN_CACHE_LINE_MASK (MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH - 1) 170160814Ssimon 171280297Sjkim/* 172280297Sjkim * Window sizes optimized for fixed window size modular exponentiation 173280297Sjkim * algorithm (BN_mod_exp_mont_consttime). To achieve the security goals of 174280297Sjkim * BN_mode_exp_mont_consttime, the maximum size of the window must not exceed 175280297Sjkim * log_2(MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH). Window size thresholds are 176280297Sjkim * defined for cache line sizes of 32 and 64, cache line sizes where 177280297Sjkim * log_2(32)=5 and log_2(64)=6 respectively. A window size of 7 should only be 178280297Sjkim * used on processors that have a 128 byte or greater cache line size. 179160814Ssimon */ 180280297Sjkim# if MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH == 64 181160814Ssimon 182160814Ssimon# define BN_window_bits_for_ctime_exponent_size(b) \ 183280297Sjkim ((b) > 937 ? 6 : \ 184280297Sjkim (b) > 306 ? 5 : \ 185280297Sjkim (b) > 89 ? 4 : \ 186280297Sjkim (b) > 22 ? 3 : 1) 187280297Sjkim# define BN_MAX_WINDOW_BITS_FOR_CTIME_EXPONENT_SIZE (6) 188160814Ssimon 189280297Sjkim# elif MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH == 32 190160814Ssimon 191160814Ssimon# define BN_window_bits_for_ctime_exponent_size(b) \ 192280297Sjkim ((b) > 306 ? 5 : \ 193280297Sjkim (b) > 89 ? 4 : \ 194280297Sjkim (b) > 22 ? 3 : 1) 195280297Sjkim# define BN_MAX_WINDOW_BITS_FOR_CTIME_EXPONENT_SIZE (5) 196160814Ssimon 197280297Sjkim# endif 198160814Ssimon 19955714Skris/* Pentium pro 16,16,16,32,64 */ 20055714Skris/* Alpha 16,16,16,16.64 */ 201280297Sjkim# define BN_MULL_SIZE_NORMAL (16)/* 32 */ 202280297Sjkim# define BN_MUL_RECURSIVE_SIZE_NORMAL (16)/* 32 less than */ 203280297Sjkim# define BN_SQR_RECURSIVE_SIZE_NORMAL (16)/* 32 */ 204280297Sjkim# define BN_MUL_LOW_RECURSIVE_SIZE_NORMAL (32)/* 32 */ 205280297Sjkim# define BN_MONT_CTX_SET_SIZE_WORD (64)/* 32 */ 20655714Skris 207280297Sjkim# if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_NO_INLINE_ASM) && !defined(PEDANTIC) 20859191Skris/* 20959191Skris * BN_UMULT_HIGH section. 21059191Skris * 21159191Skris * No, I'm not trying to overwhelm you when stating that the 21259191Skris * product of N-bit numbers is 2*N bits wide:-) No, I don't expect 21359191Skris * you to be impressed when I say that if the compiler doesn't 21459191Skris * support 2*N integer type, then you have to replace every N*N 21559191Skris * multiplication with 4 (N/2)*(N/2) accompanied by some shifts 21659191Skris * and additions which unavoidably results in severe performance 21759191Skris * penalties. Of course provided that the hardware is capable of 21859191Skris * producing 2*N result... That's when you normally start 21959191Skris * considering assembler implementation. However! It should be 22059191Skris * pointed out that some CPUs (most notably Alpha, PowerPC and 22159191Skris * upcoming IA-64 family:-) provide *separate* instruction 22259191Skris * calculating the upper half of the product placing the result 22359191Skris * into a general purpose register. Now *if* the compiler supports 22459191Skris * inline assembler, then it's not impossible to implement the 22559191Skris * "bignum" routines (and have the compiler optimize 'em) 22659191Skris * exhibiting "native" performance in C. That's what BN_UMULT_HIGH 22759191Skris * macro is about:-) 22859191Skris * 229280297Sjkim * <appro@fy.chalmers.se> 23059191Skris */ 231280297Sjkim# if defined(__alpha) && (defined(SIXTY_FOUR_BIT_LONG) || defined(SIXTY_FOUR_BIT)) 232280297Sjkim# if defined(__DECC) 233280297Sjkim# include <c_asm.h> 234280297Sjkim# define BN_UMULT_HIGH(a,b) (BN_ULONG)asm("umulh %a0,%a1,%v0",(a),(b)) 235280297Sjkim# elif defined(__GNUC__) && __GNUC__>=2 236280297Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 237280297Sjkim register BN_ULONG ret; \ 238280297Sjkim asm ("umulh %1,%2,%0" \ 239280297Sjkim : "=r"(ret) \ 240280297Sjkim : "r"(a), "r"(b)); \ 241280297Sjkim ret; }) 242280297Sjkim# endif /* compiler */ 243280297Sjkim# elif defined(_ARCH_PPC) && defined(__64BIT__) && defined(SIXTY_FOUR_BIT_LONG) 244280297Sjkim# if defined(__GNUC__) && __GNUC__>=2 245280297Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 246280297Sjkim register BN_ULONG ret; \ 247280297Sjkim asm ("mulhdu %0,%1,%2" \ 248280297Sjkim : "=r"(ret) \ 249280297Sjkim : "r"(a), "r"(b)); \ 250280297Sjkim ret; }) 251280297Sjkim# endif /* compiler */ 252280297Sjkim# elif (defined(__x86_64) || defined(__x86_64__)) && \ 253238405Sjkim (defined(SIXTY_FOUR_BIT_LONG) || defined(SIXTY_FOUR_BIT)) 254280297Sjkim# if defined(__GNUC__) && __GNUC__>=2 255280297Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 256280297Sjkim register BN_ULONG ret,discard; \ 257280297Sjkim asm ("mulq %3" \ 258280297Sjkim : "=a"(discard),"=d"(ret) \ 259280297Sjkim : "a"(a), "g"(b) \ 260280297Sjkim : "cc"); \ 261280297Sjkim ret; }) 262280297Sjkim# define BN_UMULT_LOHI(low,high,a,b) \ 263280297Sjkim asm ("mulq %3" \ 264280297Sjkim : "=a"(low),"=d"(high) \ 265280297Sjkim : "a"(a),"g"(b) \ 266280297Sjkim : "cc"); 267280297Sjkim# endif 268280297Sjkim# elif (defined(_M_AMD64) || defined(_M_X64)) && defined(SIXTY_FOUR_BIT) 269280297Sjkim# if defined(_MSC_VER) && _MSC_VER>=1400 270280297Sjkimunsigned __int64 __umulh(unsigned __int64 a, unsigned __int64 b); 271280297Sjkimunsigned __int64 _umul128(unsigned __int64 a, unsigned __int64 b, 272280297Sjkim unsigned __int64 *h); 273280297Sjkim# pragma intrinsic(__umulh,_umul128) 274280297Sjkim# define BN_UMULT_HIGH(a,b) __umulh((a),(b)) 275280297Sjkim# define BN_UMULT_LOHI(low,high,a,b) ((low)=_umul128((a),(b),&(high))) 276280297Sjkim# endif 277280297Sjkim# elif defined(__mips) && (defined(SIXTY_FOUR_BIT) || defined(SIXTY_FOUR_BIT_LONG)) 278280297Sjkim# if defined(__GNUC__) && __GNUC__>=2 279280297Sjkim# if __GNUC__>=4 && __GNUC_MINOR__>=4 280280297Sjkim /* "h" constraint is no more since 4.4 */ 281280297Sjkim# define BN_UMULT_HIGH(a,b) (((__uint128_t)(a)*(b))>>64) 282280297Sjkim# define BN_UMULT_LOHI(low,high,a,b) ({ \ 283280297Sjkim __uint128_t ret=(__uint128_t)(a)*(b); \ 284280297Sjkim (high)=ret>>64; (low)=ret; }) 285280297Sjkim# else 286280297Sjkim# define BN_UMULT_HIGH(a,b) ({ \ 287280297Sjkim register BN_ULONG ret; \ 288280297Sjkim asm ("dmultu %1,%2" \ 289280297Sjkim : "=h"(ret) \ 290280297Sjkim : "r"(a), "r"(b) : "l"); \ 291280297Sjkim ret; }) 292246772Sjkim# define BN_UMULT_LOHI(low,high,a,b)\ 293280297Sjkim asm ("dmultu %2,%3" \ 294280297Sjkim : "=l"(low),"=h"(high) \ 295280297Sjkim : "r"(a), "r"(b)); 296246772Sjkim# endif 297280297Sjkim# endif 298280297Sjkim# endif /* cpu */ 299280297Sjkim# endif /* OPENSSL_NO_ASM */ 30055714Skris 30155714Skris/************************************************************* 30255714Skris * Using the long long type 30355714Skris */ 304280297Sjkim# define Lw(t) (((BN_ULONG)(t))&BN_MASK2) 305280297Sjkim# define Hw(t) (((BN_ULONG)((t)>>BN_BITS2))&BN_MASK2) 30655714Skris 307280297Sjkim# ifdef BN_DEBUG_RAND 308280297Sjkim# define bn_clear_top2max(a) \ 309280297Sjkim { \ 310280297Sjkim int ind = (a)->dmax - (a)->top; \ 311280297Sjkim BN_ULONG *ftl = &(a)->d[(a)->top-1]; \ 312280297Sjkim for (; ind != 0; ind--) \ 313280297Sjkim *(++ftl) = 0x0; \ 314280297Sjkim } 315280297Sjkim# else 316280297Sjkim# define bn_clear_top2max(a) 317280297Sjkim# endif 31855714Skris 319280297Sjkim# ifdef BN_LLONG 320280297Sjkim# define mul_add(r,a,w,c) { \ 321280297Sjkim BN_ULLONG t; \ 322280297Sjkim t=(BN_ULLONG)w * (a) + (r) + (c); \ 323280297Sjkim (r)= Lw(t); \ 324280297Sjkim (c)= Hw(t); \ 325280297Sjkim } 32655714Skris 327280297Sjkim# define mul(r,a,w,c) { \ 328280297Sjkim BN_ULLONG t; \ 329280297Sjkim t=(BN_ULLONG)w * (a) + (c); \ 330280297Sjkim (r)= Lw(t); \ 331280297Sjkim (c)= Hw(t); \ 332280297Sjkim } 33355714Skris 334280297Sjkim# define sqr(r0,r1,a) { \ 335280297Sjkim BN_ULLONG t; \ 336280297Sjkim t=(BN_ULLONG)(a)*(a); \ 337280297Sjkim (r0)=Lw(t); \ 338280297Sjkim (r1)=Hw(t); \ 339280297Sjkim } 34059191Skris 341280297Sjkim# elif defined(BN_UMULT_LOHI) 342280297Sjkim# define mul_add(r,a,w,c) { \ 343280297Sjkim BN_ULONG high,low,ret,tmp=(a); \ 344280297Sjkim ret = (r); \ 345280297Sjkim BN_UMULT_LOHI(low,high,w,tmp); \ 346280297Sjkim ret += (c); \ 347280297Sjkim (c) = (ret<(c))?1:0; \ 348280297Sjkim (c) += high; \ 349280297Sjkim ret += low; \ 350280297Sjkim (c) += (ret<low)?1:0; \ 351280297Sjkim (r) = ret; \ 352280297Sjkim } 353160814Ssimon 354280297Sjkim# define mul(r,a,w,c) { \ 355280297Sjkim BN_ULONG high,low,ret,ta=(a); \ 356280297Sjkim BN_UMULT_LOHI(low,high,w,ta); \ 357280297Sjkim ret = low + (c); \ 358280297Sjkim (c) = high; \ 359280297Sjkim (c) += (ret<low)?1:0; \ 360280297Sjkim (r) = ret; \ 361280297Sjkim } 362160814Ssimon 363280297Sjkim# define sqr(r0,r1,a) { \ 364280297Sjkim BN_ULONG tmp=(a); \ 365280297Sjkim BN_UMULT_LOHI(r0,r1,tmp,tmp); \ 366280297Sjkim } 367160814Ssimon 368280297Sjkim# elif defined(BN_UMULT_HIGH) 369280297Sjkim# define mul_add(r,a,w,c) { \ 370280297Sjkim BN_ULONG high,low,ret,tmp=(a); \ 371280297Sjkim ret = (r); \ 372280297Sjkim high= BN_UMULT_HIGH(w,tmp); \ 373280297Sjkim ret += (c); \ 374280297Sjkim low = (w) * tmp; \ 375280297Sjkim (c) = (ret<(c))?1:0; \ 376280297Sjkim (c) += high; \ 377280297Sjkim ret += low; \ 378280297Sjkim (c) += (ret<low)?1:0; \ 379280297Sjkim (r) = ret; \ 380280297Sjkim } 38159191Skris 382280297Sjkim# define mul(r,a,w,c) { \ 383280297Sjkim BN_ULONG high,low,ret,ta=(a); \ 384280297Sjkim low = (w) * ta; \ 385280297Sjkim high= BN_UMULT_HIGH(w,ta); \ 386280297Sjkim ret = low + (c); \ 387280297Sjkim (c) = high; \ 388280297Sjkim (c) += (ret<low)?1:0; \ 389280297Sjkim (r) = ret; \ 390280297Sjkim } 39159191Skris 392280297Sjkim# define sqr(r0,r1,a) { \ 393280297Sjkim BN_ULONG tmp=(a); \ 394280297Sjkim (r0) = tmp * tmp; \ 395280297Sjkim (r1) = BN_UMULT_HIGH(tmp,tmp); \ 396280297Sjkim } 39759191Skris 398280297Sjkim# else 39955714Skris/************************************************************* 40055714Skris * No long long type 40155714Skris */ 40255714Skris 403280297Sjkim# define LBITS(a) ((a)&BN_MASK2l) 404280297Sjkim# define HBITS(a) (((a)>>BN_BITS4)&BN_MASK2l) 405280297Sjkim# define L2HBITS(a) (((a)<<BN_BITS4)&BN_MASK2) 40655714Skris 407280297Sjkim# define LLBITS(a) ((a)&BN_MASKl) 408280297Sjkim# define LHBITS(a) (((a)>>BN_BITS2)&BN_MASKl) 409280297Sjkim# define LL2HBITS(a) ((BN_ULLONG)((a)&BN_MASKl)<<BN_BITS2) 41055714Skris 411280297Sjkim# define mul64(l,h,bl,bh) \ 412280297Sjkim { \ 413280297Sjkim BN_ULONG m,m1,lt,ht; \ 41455714Skris \ 415280297Sjkim lt=l; \ 416280297Sjkim ht=h; \ 417280297Sjkim m =(bh)*(lt); \ 418280297Sjkim lt=(bl)*(lt); \ 419280297Sjkim m1=(bl)*(ht); \ 420280297Sjkim ht =(bh)*(ht); \ 421280297Sjkim m=(m+m1)&BN_MASK2; if (m < m1) ht+=L2HBITS((BN_ULONG)1); \ 422280297Sjkim ht+=HBITS(m); \ 423280297Sjkim m1=L2HBITS(m); \ 424280297Sjkim lt=(lt+m1)&BN_MASK2; if (lt < m1) ht++; \ 425280297Sjkim (l)=lt; \ 426280297Sjkim (h)=ht; \ 427280297Sjkim } 42855714Skris 429280297Sjkim# define sqr64(lo,ho,in) \ 430280297Sjkim { \ 431280297Sjkim BN_ULONG l,h,m; \ 43255714Skris \ 433280297Sjkim h=(in); \ 434280297Sjkim l=LBITS(h); \ 435280297Sjkim h=HBITS(h); \ 436280297Sjkim m =(l)*(h); \ 437280297Sjkim l*=l; \ 438280297Sjkim h*=h; \ 439280297Sjkim h+=(m&BN_MASK2h1)>>(BN_BITS4-1); \ 440280297Sjkim m =(m&BN_MASK2l)<<(BN_BITS4+1); \ 441280297Sjkim l=(l+m)&BN_MASK2; if (l < m) h++; \ 442280297Sjkim (lo)=l; \ 443280297Sjkim (ho)=h; \ 444280297Sjkim } 44555714Skris 446280297Sjkim# define mul_add(r,a,bl,bh,c) { \ 447280297Sjkim BN_ULONG l,h; \ 44855714Skris \ 449280297Sjkim h= (a); \ 450280297Sjkim l=LBITS(h); \ 451280297Sjkim h=HBITS(h); \ 452280297Sjkim mul64(l,h,(bl),(bh)); \ 45355714Skris \ 454280297Sjkim /* non-multiply part */ \ 455280297Sjkim l=(l+(c))&BN_MASK2; if (l < (c)) h++; \ 456280297Sjkim (c)=(r); \ 457280297Sjkim l=(l+(c))&BN_MASK2; if (l < (c)) h++; \ 458280297Sjkim (c)=h&BN_MASK2; \ 459280297Sjkim (r)=l; \ 460280297Sjkim } 46155714Skris 462280297Sjkim# define mul(r,a,bl,bh,c) { \ 463280297Sjkim BN_ULONG l,h; \ 46455714Skris \ 465280297Sjkim h= (a); \ 466280297Sjkim l=LBITS(h); \ 467280297Sjkim h=HBITS(h); \ 468280297Sjkim mul64(l,h,(bl),(bh)); \ 46955714Skris \ 470280297Sjkim /* non-multiply part */ \ 471280297Sjkim l+=(c); if ((l&BN_MASK2) < (c)) h++; \ 472280297Sjkim (c)=h&BN_MASK2; \ 473280297Sjkim (r)=l&BN_MASK2; \ 474280297Sjkim } 475280297Sjkim# endif /* !BN_LLONG */ 47655714Skris 477280297Sjkim# if defined(OPENSSL_DOING_MAKEDEPEND) && defined(OPENSSL_FIPS) 478280297Sjkim# undef bn_div_words 479280297Sjkim# endif 480238405Sjkim 481280297Sjkimvoid bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb); 482280297Sjkimvoid bn_mul_comba8(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b); 483280297Sjkimvoid bn_mul_comba4(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b); 484109998Smarkmvoid bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp); 485280297Sjkimvoid bn_sqr_comba8(BN_ULONG *r, const BN_ULONG *a); 486280297Sjkimvoid bn_sqr_comba4(BN_ULONG *r, const BN_ULONG *a); 487280297Sjkimint bn_cmp_words(const BN_ULONG *a, const BN_ULONG *b, int n); 488280297Sjkimint bn_cmp_part_words(const BN_ULONG *a, const BN_ULONG *b, int cl, int dl); 489280297Sjkimvoid bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2, 490280297Sjkim int dna, int dnb, BN_ULONG *t); 491280297Sjkimvoid bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, 492280297Sjkim int n, int tna, int tnb, BN_ULONG *t); 493280297Sjkimvoid bn_sqr_recursive(BN_ULONG *r, const BN_ULONG *a, int n2, BN_ULONG *t); 494280297Sjkimvoid bn_mul_low_normal(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n); 495280297Sjkimvoid bn_mul_low_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n2, 496280297Sjkim BN_ULONG *t); 497280297Sjkimvoid bn_mul_high(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, BN_ULONG *l, int n2, 498280297Sjkim BN_ULONG *t); 499160814SsimonBN_ULONG bn_add_part_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, 500280297Sjkim int cl, int dl); 501160814SsimonBN_ULONG bn_sub_part_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, 502280297Sjkim int cl, int dl); 503280297Sjkimint bn_mul_mont(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp, 504280297Sjkim const BN_ULONG *np, const BN_ULONG *n0, int num); 50555714Skris 50655714Skris#ifdef __cplusplus 50755714Skris} 50855714Skris#endif 50955714Skris 51055714Skris#endif 511