1// Code generated by Fiat Cryptography. DO NOT EDIT. 2// 3// Autogenerated: word_by_word_montgomery --lang Go --no-wide-int --cmovznz-by-mul --relax-primitive-carry-to-bitwidth 32,64 --internal-static --public-function-case camelCase --public-type-case camelCase --private-function-case camelCase --private-type-case camelCase --doc-text-before-function-name '' --doc-newline-before-package-declaration --doc-prepend-header 'Code generated by Fiat Cryptography. DO NOT EDIT.' --package-name fiat --no-prefix-fiat p224 64 '2^224 - 2^96 + 1' mul square add sub one from_montgomery to_montgomery selectznz to_bytes from_bytes 4// 5// curve description: p224 6// 7// machine_wordsize = 64 (from "64") 8// 9// requested operations: mul, square, add, sub, one, from_montgomery, to_montgomery, selectznz, to_bytes, from_bytes 10// 11// m = 0xffffffffffffffffffffffffffffffff000000000000000000000001 (from "2^224 - 2^96 + 1") 12// 13// 14// 15// NOTE: In addition to the bounds specified above each function, all 16// 17// functions synthesized for this Montgomery arithmetic require the 18// 19// input to be strictly less than the prime modulus (m), and also 20// 21// require the input to be in the unique saturated representation. 22// 23// All functions also ensure that these two properties are true of 24// 25// return values. 26// 27// 28// 29// Computed values: 30// 31// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) 32// 33// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) 34// 35// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in 36// 37// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 38 39package fiat 40 41import "math/bits" 42 43type p224Uint1 uint64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927 44type p224Int1 int64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927 45 46// The type p224MontgomeryDomainFieldElement is a field element in the Montgomery domain. 47// 48// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] 49type p224MontgomeryDomainFieldElement [4]uint64 50 51// The type p224NonMontgomeryDomainFieldElement is a field element NOT in the Montgomery domain. 52// 53// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] 54type p224NonMontgomeryDomainFieldElement [4]uint64 55 56// p224CmovznzU64 is a single-word conditional move. 57// 58// Postconditions: 59// 60// out1 = (if arg1 = 0 then arg2 else arg3) 61// 62// Input Bounds: 63// 64// arg1: [0x0 ~> 0x1] 65// arg2: [0x0 ~> 0xffffffffffffffff] 66// arg3: [0x0 ~> 0xffffffffffffffff] 67// 68// Output Bounds: 69// 70// out1: [0x0 ~> 0xffffffffffffffff] 71func p224CmovznzU64(out1 *uint64, arg1 p224Uint1, arg2 uint64, arg3 uint64) { 72 x1 := (uint64(arg1) * 0xffffffffffffffff) 73 x2 := ((x1 & arg3) | ((^x1) & arg2)) 74 *out1 = x2 75} 76 77// p224Mul multiplies two field elements in the Montgomery domain. 78// 79// Preconditions: 80// 81// 0 ≤ eval arg1 < m 82// 0 ≤ eval arg2 < m 83// 84// Postconditions: 85// 86// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m 87// 0 ≤ eval out1 < m 88func p224Mul(out1 *p224MontgomeryDomainFieldElement, arg1 *p224MontgomeryDomainFieldElement, arg2 *p224MontgomeryDomainFieldElement) { 89 x1 := arg1[1] 90 x2 := arg1[2] 91 x3 := arg1[3] 92 x4 := arg1[0] 93 var x5 uint64 94 var x6 uint64 95 x6, x5 = bits.Mul64(x4, arg2[3]) 96 var x7 uint64 97 var x8 uint64 98 x8, x7 = bits.Mul64(x4, arg2[2]) 99 var x9 uint64 100 var x10 uint64 101 x10, x9 = bits.Mul64(x4, arg2[1]) 102 var x11 uint64 103 var x12 uint64 104 x12, x11 = bits.Mul64(x4, arg2[0]) 105 var x13 uint64 106 var x14 uint64 107 x13, x14 = bits.Add64(x12, x9, uint64(0x0)) 108 var x15 uint64 109 var x16 uint64 110 x15, x16 = bits.Add64(x10, x7, uint64(p224Uint1(x14))) 111 var x17 uint64 112 var x18 uint64 113 x17, x18 = bits.Add64(x8, x5, uint64(p224Uint1(x16))) 114 x19 := (uint64(p224Uint1(x18)) + x6) 115 var x20 uint64 116 _, x20 = bits.Mul64(x11, 0xffffffffffffffff) 117 var x22 uint64 118 var x23 uint64 119 x23, x22 = bits.Mul64(x20, 0xffffffff) 120 var x24 uint64 121 var x25 uint64 122 x25, x24 = bits.Mul64(x20, 0xffffffffffffffff) 123 var x26 uint64 124 var x27 uint64 125 x27, x26 = bits.Mul64(x20, 0xffffffff00000000) 126 var x28 uint64 127 var x29 uint64 128 x28, x29 = bits.Add64(x27, x24, uint64(0x0)) 129 var x30 uint64 130 var x31 uint64 131 x30, x31 = bits.Add64(x25, x22, uint64(p224Uint1(x29))) 132 x32 := (uint64(p224Uint1(x31)) + x23) 133 var x34 uint64 134 _, x34 = bits.Add64(x11, x20, uint64(0x0)) 135 var x35 uint64 136 var x36 uint64 137 x35, x36 = bits.Add64(x13, x26, uint64(p224Uint1(x34))) 138 var x37 uint64 139 var x38 uint64 140 x37, x38 = bits.Add64(x15, x28, uint64(p224Uint1(x36))) 141 var x39 uint64 142 var x40 uint64 143 x39, x40 = bits.Add64(x17, x30, uint64(p224Uint1(x38))) 144 var x41 uint64 145 var x42 uint64 146 x41, x42 = bits.Add64(x19, x32, uint64(p224Uint1(x40))) 147 var x43 uint64 148 var x44 uint64 149 x44, x43 = bits.Mul64(x1, arg2[3]) 150 var x45 uint64 151 var x46 uint64 152 x46, x45 = bits.Mul64(x1, arg2[2]) 153 var x47 uint64 154 var x48 uint64 155 x48, x47 = bits.Mul64(x1, arg2[1]) 156 var x49 uint64 157 var x50 uint64 158 x50, x49 = bits.Mul64(x1, arg2[0]) 159 var x51 uint64 160 var x52 uint64 161 x51, x52 = bits.Add64(x50, x47, uint64(0x0)) 162 var x53 uint64 163 var x54 uint64 164 x53, x54 = bits.Add64(x48, x45, uint64(p224Uint1(x52))) 165 var x55 uint64 166 var x56 uint64 167 x55, x56 = bits.Add64(x46, x43, uint64(p224Uint1(x54))) 168 x57 := (uint64(p224Uint1(x56)) + x44) 169 var x58 uint64 170 var x59 uint64 171 x58, x59 = bits.Add64(x35, x49, uint64(0x0)) 172 var x60 uint64 173 var x61 uint64 174 x60, x61 = bits.Add64(x37, x51, uint64(p224Uint1(x59))) 175 var x62 uint64 176 var x63 uint64 177 x62, x63 = bits.Add64(x39, x53, uint64(p224Uint1(x61))) 178 var x64 uint64 179 var x65 uint64 180 x64, x65 = bits.Add64(x41, x55, uint64(p224Uint1(x63))) 181 var x66 uint64 182 var x67 uint64 183 x66, x67 = bits.Add64(uint64(p224Uint1(x42)), x57, uint64(p224Uint1(x65))) 184 var x68 uint64 185 _, x68 = bits.Mul64(x58, 0xffffffffffffffff) 186 var x70 uint64 187 var x71 uint64 188 x71, x70 = bits.Mul64(x68, 0xffffffff) 189 var x72 uint64 190 var x73 uint64 191 x73, x72 = bits.Mul64(x68, 0xffffffffffffffff) 192 var x74 uint64 193 var x75 uint64 194 x75, x74 = bits.Mul64(x68, 0xffffffff00000000) 195 var x76 uint64 196 var x77 uint64 197 x76, x77 = bits.Add64(x75, x72, uint64(0x0)) 198 var x78 uint64 199 var x79 uint64 200 x78, x79 = bits.Add64(x73, x70, uint64(p224Uint1(x77))) 201 x80 := (uint64(p224Uint1(x79)) + x71) 202 var x82 uint64 203 _, x82 = bits.Add64(x58, x68, uint64(0x0)) 204 var x83 uint64 205 var x84 uint64 206 x83, x84 = bits.Add64(x60, x74, uint64(p224Uint1(x82))) 207 var x85 uint64 208 var x86 uint64 209 x85, x86 = bits.Add64(x62, x76, uint64(p224Uint1(x84))) 210 var x87 uint64 211 var x88 uint64 212 x87, x88 = bits.Add64(x64, x78, uint64(p224Uint1(x86))) 213 var x89 uint64 214 var x90 uint64 215 x89, x90 = bits.Add64(x66, x80, uint64(p224Uint1(x88))) 216 x91 := (uint64(p224Uint1(x90)) + uint64(p224Uint1(x67))) 217 var x92 uint64 218 var x93 uint64 219 x93, x92 = bits.Mul64(x2, arg2[3]) 220 var x94 uint64 221 var x95 uint64 222 x95, x94 = bits.Mul64(x2, arg2[2]) 223 var x96 uint64 224 var x97 uint64 225 x97, x96 = bits.Mul64(x2, arg2[1]) 226 var x98 uint64 227 var x99 uint64 228 x99, x98 = bits.Mul64(x2, arg2[0]) 229 var x100 uint64 230 var x101 uint64 231 x100, x101 = bits.Add64(x99, x96, uint64(0x0)) 232 var x102 uint64 233 var x103 uint64 234 x102, x103 = bits.Add64(x97, x94, uint64(p224Uint1(x101))) 235 var x104 uint64 236 var x105 uint64 237 x104, x105 = bits.Add64(x95, x92, uint64(p224Uint1(x103))) 238 x106 := (uint64(p224Uint1(x105)) + x93) 239 var x107 uint64 240 var x108 uint64 241 x107, x108 = bits.Add64(x83, x98, uint64(0x0)) 242 var x109 uint64 243 var x110 uint64 244 x109, x110 = bits.Add64(x85, x100, uint64(p224Uint1(x108))) 245 var x111 uint64 246 var x112 uint64 247 x111, x112 = bits.Add64(x87, x102, uint64(p224Uint1(x110))) 248 var x113 uint64 249 var x114 uint64 250 x113, x114 = bits.Add64(x89, x104, uint64(p224Uint1(x112))) 251 var x115 uint64 252 var x116 uint64 253 x115, x116 = bits.Add64(x91, x106, uint64(p224Uint1(x114))) 254 var x117 uint64 255 _, x117 = bits.Mul64(x107, 0xffffffffffffffff) 256 var x119 uint64 257 var x120 uint64 258 x120, x119 = bits.Mul64(x117, 0xffffffff) 259 var x121 uint64 260 var x122 uint64 261 x122, x121 = bits.Mul64(x117, 0xffffffffffffffff) 262 var x123 uint64 263 var x124 uint64 264 x124, x123 = bits.Mul64(x117, 0xffffffff00000000) 265 var x125 uint64 266 var x126 uint64 267 x125, x126 = bits.Add64(x124, x121, uint64(0x0)) 268 var x127 uint64 269 var x128 uint64 270 x127, x128 = bits.Add64(x122, x119, uint64(p224Uint1(x126))) 271 x129 := (uint64(p224Uint1(x128)) + x120) 272 var x131 uint64 273 _, x131 = bits.Add64(x107, x117, uint64(0x0)) 274 var x132 uint64 275 var x133 uint64 276 x132, x133 = bits.Add64(x109, x123, uint64(p224Uint1(x131))) 277 var x134 uint64 278 var x135 uint64 279 x134, x135 = bits.Add64(x111, x125, uint64(p224Uint1(x133))) 280 var x136 uint64 281 var x137 uint64 282 x136, x137 = bits.Add64(x113, x127, uint64(p224Uint1(x135))) 283 var x138 uint64 284 var x139 uint64 285 x138, x139 = bits.Add64(x115, x129, uint64(p224Uint1(x137))) 286 x140 := (uint64(p224Uint1(x139)) + uint64(p224Uint1(x116))) 287 var x141 uint64 288 var x142 uint64 289 x142, x141 = bits.Mul64(x3, arg2[3]) 290 var x143 uint64 291 var x144 uint64 292 x144, x143 = bits.Mul64(x3, arg2[2]) 293 var x145 uint64 294 var x146 uint64 295 x146, x145 = bits.Mul64(x3, arg2[1]) 296 var x147 uint64 297 var x148 uint64 298 x148, x147 = bits.Mul64(x3, arg2[0]) 299 var x149 uint64 300 var x150 uint64 301 x149, x150 = bits.Add64(x148, x145, uint64(0x0)) 302 var x151 uint64 303 var x152 uint64 304 x151, x152 = bits.Add64(x146, x143, uint64(p224Uint1(x150))) 305 var x153 uint64 306 var x154 uint64 307 x153, x154 = bits.Add64(x144, x141, uint64(p224Uint1(x152))) 308 x155 := (uint64(p224Uint1(x154)) + x142) 309 var x156 uint64 310 var x157 uint64 311 x156, x157 = bits.Add64(x132, x147, uint64(0x0)) 312 var x158 uint64 313 var x159 uint64 314 x158, x159 = bits.Add64(x134, x149, uint64(p224Uint1(x157))) 315 var x160 uint64 316 var x161 uint64 317 x160, x161 = bits.Add64(x136, x151, uint64(p224Uint1(x159))) 318 var x162 uint64 319 var x163 uint64 320 x162, x163 = bits.Add64(x138, x153, uint64(p224Uint1(x161))) 321 var x164 uint64 322 var x165 uint64 323 x164, x165 = bits.Add64(x140, x155, uint64(p224Uint1(x163))) 324 var x166 uint64 325 _, x166 = bits.Mul64(x156, 0xffffffffffffffff) 326 var x168 uint64 327 var x169 uint64 328 x169, x168 = bits.Mul64(x166, 0xffffffff) 329 var x170 uint64 330 var x171 uint64 331 x171, x170 = bits.Mul64(x166, 0xffffffffffffffff) 332 var x172 uint64 333 var x173 uint64 334 x173, x172 = bits.Mul64(x166, 0xffffffff00000000) 335 var x174 uint64 336 var x175 uint64 337 x174, x175 = bits.Add64(x173, x170, uint64(0x0)) 338 var x176 uint64 339 var x177 uint64 340 x176, x177 = bits.Add64(x171, x168, uint64(p224Uint1(x175))) 341 x178 := (uint64(p224Uint1(x177)) + x169) 342 var x180 uint64 343 _, x180 = bits.Add64(x156, x166, uint64(0x0)) 344 var x181 uint64 345 var x182 uint64 346 x181, x182 = bits.Add64(x158, x172, uint64(p224Uint1(x180))) 347 var x183 uint64 348 var x184 uint64 349 x183, x184 = bits.Add64(x160, x174, uint64(p224Uint1(x182))) 350 var x185 uint64 351 var x186 uint64 352 x185, x186 = bits.Add64(x162, x176, uint64(p224Uint1(x184))) 353 var x187 uint64 354 var x188 uint64 355 x187, x188 = bits.Add64(x164, x178, uint64(p224Uint1(x186))) 356 x189 := (uint64(p224Uint1(x188)) + uint64(p224Uint1(x165))) 357 var x190 uint64 358 var x191 uint64 359 x190, x191 = bits.Sub64(x181, uint64(0x1), uint64(0x0)) 360 var x192 uint64 361 var x193 uint64 362 x192, x193 = bits.Sub64(x183, 0xffffffff00000000, uint64(p224Uint1(x191))) 363 var x194 uint64 364 var x195 uint64 365 x194, x195 = bits.Sub64(x185, 0xffffffffffffffff, uint64(p224Uint1(x193))) 366 var x196 uint64 367 var x197 uint64 368 x196, x197 = bits.Sub64(x187, 0xffffffff, uint64(p224Uint1(x195))) 369 var x199 uint64 370 _, x199 = bits.Sub64(x189, uint64(0x0), uint64(p224Uint1(x197))) 371 var x200 uint64 372 p224CmovznzU64(&x200, p224Uint1(x199), x190, x181) 373 var x201 uint64 374 p224CmovznzU64(&x201, p224Uint1(x199), x192, x183) 375 var x202 uint64 376 p224CmovznzU64(&x202, p224Uint1(x199), x194, x185) 377 var x203 uint64 378 p224CmovznzU64(&x203, p224Uint1(x199), x196, x187) 379 out1[0] = x200 380 out1[1] = x201 381 out1[2] = x202 382 out1[3] = x203 383} 384 385// p224Square squares a field element in the Montgomery domain. 386// 387// Preconditions: 388// 389// 0 ≤ eval arg1 < m 390// 391// Postconditions: 392// 393// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m 394// 0 ≤ eval out1 < m 395func p224Square(out1 *p224MontgomeryDomainFieldElement, arg1 *p224MontgomeryDomainFieldElement) { 396 x1 := arg1[1] 397 x2 := arg1[2] 398 x3 := arg1[3] 399 x4 := arg1[0] 400 var x5 uint64 401 var x6 uint64 402 x6, x5 = bits.Mul64(x4, arg1[3]) 403 var x7 uint64 404 var x8 uint64 405 x8, x7 = bits.Mul64(x4, arg1[2]) 406 var x9 uint64 407 var x10 uint64 408 x10, x9 = bits.Mul64(x4, arg1[1]) 409 var x11 uint64 410 var x12 uint64 411 x12, x11 = bits.Mul64(x4, arg1[0]) 412 var x13 uint64 413 var x14 uint64 414 x13, x14 = bits.Add64(x12, x9, uint64(0x0)) 415 var x15 uint64 416 var x16 uint64 417 x15, x16 = bits.Add64(x10, x7, uint64(p224Uint1(x14))) 418 var x17 uint64 419 var x18 uint64 420 x17, x18 = bits.Add64(x8, x5, uint64(p224Uint1(x16))) 421 x19 := (uint64(p224Uint1(x18)) + x6) 422 var x20 uint64 423 _, x20 = bits.Mul64(x11, 0xffffffffffffffff) 424 var x22 uint64 425 var x23 uint64 426 x23, x22 = bits.Mul64(x20, 0xffffffff) 427 var x24 uint64 428 var x25 uint64 429 x25, x24 = bits.Mul64(x20, 0xffffffffffffffff) 430 var x26 uint64 431 var x27 uint64 432 x27, x26 = bits.Mul64(x20, 0xffffffff00000000) 433 var x28 uint64 434 var x29 uint64 435 x28, x29 = bits.Add64(x27, x24, uint64(0x0)) 436 var x30 uint64 437 var x31 uint64 438 x30, x31 = bits.Add64(x25, x22, uint64(p224Uint1(x29))) 439 x32 := (uint64(p224Uint1(x31)) + x23) 440 var x34 uint64 441 _, x34 = bits.Add64(x11, x20, uint64(0x0)) 442 var x35 uint64 443 var x36 uint64 444 x35, x36 = bits.Add64(x13, x26, uint64(p224Uint1(x34))) 445 var x37 uint64 446 var x38 uint64 447 x37, x38 = bits.Add64(x15, x28, uint64(p224Uint1(x36))) 448 var x39 uint64 449 var x40 uint64 450 x39, x40 = bits.Add64(x17, x30, uint64(p224Uint1(x38))) 451 var x41 uint64 452 var x42 uint64 453 x41, x42 = bits.Add64(x19, x32, uint64(p224Uint1(x40))) 454 var x43 uint64 455 var x44 uint64 456 x44, x43 = bits.Mul64(x1, arg1[3]) 457 var x45 uint64 458 var x46 uint64 459 x46, x45 = bits.Mul64(x1, arg1[2]) 460 var x47 uint64 461 var x48 uint64 462 x48, x47 = bits.Mul64(x1, arg1[1]) 463 var x49 uint64 464 var x50 uint64 465 x50, x49 = bits.Mul64(x1, arg1[0]) 466 var x51 uint64 467 var x52 uint64 468 x51, x52 = bits.Add64(x50, x47, uint64(0x0)) 469 var x53 uint64 470 var x54 uint64 471 x53, x54 = bits.Add64(x48, x45, uint64(p224Uint1(x52))) 472 var x55 uint64 473 var x56 uint64 474 x55, x56 = bits.Add64(x46, x43, uint64(p224Uint1(x54))) 475 x57 := (uint64(p224Uint1(x56)) + x44) 476 var x58 uint64 477 var x59 uint64 478 x58, x59 = bits.Add64(x35, x49, uint64(0x0)) 479 var x60 uint64 480 var x61 uint64 481 x60, x61 = bits.Add64(x37, x51, uint64(p224Uint1(x59))) 482 var x62 uint64 483 var x63 uint64 484 x62, x63 = bits.Add64(x39, x53, uint64(p224Uint1(x61))) 485 var x64 uint64 486 var x65 uint64 487 x64, x65 = bits.Add64(x41, x55, uint64(p224Uint1(x63))) 488 var x66 uint64 489 var x67 uint64 490 x66, x67 = bits.Add64(uint64(p224Uint1(x42)), x57, uint64(p224Uint1(x65))) 491 var x68 uint64 492 _, x68 = bits.Mul64(x58, 0xffffffffffffffff) 493 var x70 uint64 494 var x71 uint64 495 x71, x70 = bits.Mul64(x68, 0xffffffff) 496 var x72 uint64 497 var x73 uint64 498 x73, x72 = bits.Mul64(x68, 0xffffffffffffffff) 499 var x74 uint64 500 var x75 uint64 501 x75, x74 = bits.Mul64(x68, 0xffffffff00000000) 502 var x76 uint64 503 var x77 uint64 504 x76, x77 = bits.Add64(x75, x72, uint64(0x0)) 505 var x78 uint64 506 var x79 uint64 507 x78, x79 = bits.Add64(x73, x70, uint64(p224Uint1(x77))) 508 x80 := (uint64(p224Uint1(x79)) + x71) 509 var x82 uint64 510 _, x82 = bits.Add64(x58, x68, uint64(0x0)) 511 var x83 uint64 512 var x84 uint64 513 x83, x84 = bits.Add64(x60, x74, uint64(p224Uint1(x82))) 514 var x85 uint64 515 var x86 uint64 516 x85, x86 = bits.Add64(x62, x76, uint64(p224Uint1(x84))) 517 var x87 uint64 518 var x88 uint64 519 x87, x88 = bits.Add64(x64, x78, uint64(p224Uint1(x86))) 520 var x89 uint64 521 var x90 uint64 522 x89, x90 = bits.Add64(x66, x80, uint64(p224Uint1(x88))) 523 x91 := (uint64(p224Uint1(x90)) + uint64(p224Uint1(x67))) 524 var x92 uint64 525 var x93 uint64 526 x93, x92 = bits.Mul64(x2, arg1[3]) 527 var x94 uint64 528 var x95 uint64 529 x95, x94 = bits.Mul64(x2, arg1[2]) 530 var x96 uint64 531 var x97 uint64 532 x97, x96 = bits.Mul64(x2, arg1[1]) 533 var x98 uint64 534 var x99 uint64 535 x99, x98 = bits.Mul64(x2, arg1[0]) 536 var x100 uint64 537 var x101 uint64 538 x100, x101 = bits.Add64(x99, x96, uint64(0x0)) 539 var x102 uint64 540 var x103 uint64 541 x102, x103 = bits.Add64(x97, x94, uint64(p224Uint1(x101))) 542 var x104 uint64 543 var x105 uint64 544 x104, x105 = bits.Add64(x95, x92, uint64(p224Uint1(x103))) 545 x106 := (uint64(p224Uint1(x105)) + x93) 546 var x107 uint64 547 var x108 uint64 548 x107, x108 = bits.Add64(x83, x98, uint64(0x0)) 549 var x109 uint64 550 var x110 uint64 551 x109, x110 = bits.Add64(x85, x100, uint64(p224Uint1(x108))) 552 var x111 uint64 553 var x112 uint64 554 x111, x112 = bits.Add64(x87, x102, uint64(p224Uint1(x110))) 555 var x113 uint64 556 var x114 uint64 557 x113, x114 = bits.Add64(x89, x104, uint64(p224Uint1(x112))) 558 var x115 uint64 559 var x116 uint64 560 x115, x116 = bits.Add64(x91, x106, uint64(p224Uint1(x114))) 561 var x117 uint64 562 _, x117 = bits.Mul64(x107, 0xffffffffffffffff) 563 var x119 uint64 564 var x120 uint64 565 x120, x119 = bits.Mul64(x117, 0xffffffff) 566 var x121 uint64 567 var x122 uint64 568 x122, x121 = bits.Mul64(x117, 0xffffffffffffffff) 569 var x123 uint64 570 var x124 uint64 571 x124, x123 = bits.Mul64(x117, 0xffffffff00000000) 572 var x125 uint64 573 var x126 uint64 574 x125, x126 = bits.Add64(x124, x121, uint64(0x0)) 575 var x127 uint64 576 var x128 uint64 577 x127, x128 = bits.Add64(x122, x119, uint64(p224Uint1(x126))) 578 x129 := (uint64(p224Uint1(x128)) + x120) 579 var x131 uint64 580 _, x131 = bits.Add64(x107, x117, uint64(0x0)) 581 var x132 uint64 582 var x133 uint64 583 x132, x133 = bits.Add64(x109, x123, uint64(p224Uint1(x131))) 584 var x134 uint64 585 var x135 uint64 586 x134, x135 = bits.Add64(x111, x125, uint64(p224Uint1(x133))) 587 var x136 uint64 588 var x137 uint64 589 x136, x137 = bits.Add64(x113, x127, uint64(p224Uint1(x135))) 590 var x138 uint64 591 var x139 uint64 592 x138, x139 = bits.Add64(x115, x129, uint64(p224Uint1(x137))) 593 x140 := (uint64(p224Uint1(x139)) + uint64(p224Uint1(x116))) 594 var x141 uint64 595 var x142 uint64 596 x142, x141 = bits.Mul64(x3, arg1[3]) 597 var x143 uint64 598 var x144 uint64 599 x144, x143 = bits.Mul64(x3, arg1[2]) 600 var x145 uint64 601 var x146 uint64 602 x146, x145 = bits.Mul64(x3, arg1[1]) 603 var x147 uint64 604 var x148 uint64 605 x148, x147 = bits.Mul64(x3, arg1[0]) 606 var x149 uint64 607 var x150 uint64 608 x149, x150 = bits.Add64(x148, x145, uint64(0x0)) 609 var x151 uint64 610 var x152 uint64 611 x151, x152 = bits.Add64(x146, x143, uint64(p224Uint1(x150))) 612 var x153 uint64 613 var x154 uint64 614 x153, x154 = bits.Add64(x144, x141, uint64(p224Uint1(x152))) 615 x155 := (uint64(p224Uint1(x154)) + x142) 616 var x156 uint64 617 var x157 uint64 618 x156, x157 = bits.Add64(x132, x147, uint64(0x0)) 619 var x158 uint64 620 var x159 uint64 621 x158, x159 = bits.Add64(x134, x149, uint64(p224Uint1(x157))) 622 var x160 uint64 623 var x161 uint64 624 x160, x161 = bits.Add64(x136, x151, uint64(p224Uint1(x159))) 625 var x162 uint64 626 var x163 uint64 627 x162, x163 = bits.Add64(x138, x153, uint64(p224Uint1(x161))) 628 var x164 uint64 629 var x165 uint64 630 x164, x165 = bits.Add64(x140, x155, uint64(p224Uint1(x163))) 631 var x166 uint64 632 _, x166 = bits.Mul64(x156, 0xffffffffffffffff) 633 var x168 uint64 634 var x169 uint64 635 x169, x168 = bits.Mul64(x166, 0xffffffff) 636 var x170 uint64 637 var x171 uint64 638 x171, x170 = bits.Mul64(x166, 0xffffffffffffffff) 639 var x172 uint64 640 var x173 uint64 641 x173, x172 = bits.Mul64(x166, 0xffffffff00000000) 642 var x174 uint64 643 var x175 uint64 644 x174, x175 = bits.Add64(x173, x170, uint64(0x0)) 645 var x176 uint64 646 var x177 uint64 647 x176, x177 = bits.Add64(x171, x168, uint64(p224Uint1(x175))) 648 x178 := (uint64(p224Uint1(x177)) + x169) 649 var x180 uint64 650 _, x180 = bits.Add64(x156, x166, uint64(0x0)) 651 var x181 uint64 652 var x182 uint64 653 x181, x182 = bits.Add64(x158, x172, uint64(p224Uint1(x180))) 654 var x183 uint64 655 var x184 uint64 656 x183, x184 = bits.Add64(x160, x174, uint64(p224Uint1(x182))) 657 var x185 uint64 658 var x186 uint64 659 x185, x186 = bits.Add64(x162, x176, uint64(p224Uint1(x184))) 660 var x187 uint64 661 var x188 uint64 662 x187, x188 = bits.Add64(x164, x178, uint64(p224Uint1(x186))) 663 x189 := (uint64(p224Uint1(x188)) + uint64(p224Uint1(x165))) 664 var x190 uint64 665 var x191 uint64 666 x190, x191 = bits.Sub64(x181, uint64(0x1), uint64(0x0)) 667 var x192 uint64 668 var x193 uint64 669 x192, x193 = bits.Sub64(x183, 0xffffffff00000000, uint64(p224Uint1(x191))) 670 var x194 uint64 671 var x195 uint64 672 x194, x195 = bits.Sub64(x185, 0xffffffffffffffff, uint64(p224Uint1(x193))) 673 var x196 uint64 674 var x197 uint64 675 x196, x197 = bits.Sub64(x187, 0xffffffff, uint64(p224Uint1(x195))) 676 var x199 uint64 677 _, x199 = bits.Sub64(x189, uint64(0x0), uint64(p224Uint1(x197))) 678 var x200 uint64 679 p224CmovznzU64(&x200, p224Uint1(x199), x190, x181) 680 var x201 uint64 681 p224CmovznzU64(&x201, p224Uint1(x199), x192, x183) 682 var x202 uint64 683 p224CmovznzU64(&x202, p224Uint1(x199), x194, x185) 684 var x203 uint64 685 p224CmovznzU64(&x203, p224Uint1(x199), x196, x187) 686 out1[0] = x200 687 out1[1] = x201 688 out1[2] = x202 689 out1[3] = x203 690} 691 692// p224Add adds two field elements in the Montgomery domain. 693// 694// Preconditions: 695// 696// 0 ≤ eval arg1 < m 697// 0 ≤ eval arg2 < m 698// 699// Postconditions: 700// 701// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m 702// 0 ≤ eval out1 < m 703func p224Add(out1 *p224MontgomeryDomainFieldElement, arg1 *p224MontgomeryDomainFieldElement, arg2 *p224MontgomeryDomainFieldElement) { 704 var x1 uint64 705 var x2 uint64 706 x1, x2 = bits.Add64(arg1[0], arg2[0], uint64(0x0)) 707 var x3 uint64 708 var x4 uint64 709 x3, x4 = bits.Add64(arg1[1], arg2[1], uint64(p224Uint1(x2))) 710 var x5 uint64 711 var x6 uint64 712 x5, x6 = bits.Add64(arg1[2], arg2[2], uint64(p224Uint1(x4))) 713 var x7 uint64 714 var x8 uint64 715 x7, x8 = bits.Add64(arg1[3], arg2[3], uint64(p224Uint1(x6))) 716 var x9 uint64 717 var x10 uint64 718 x9, x10 = bits.Sub64(x1, uint64(0x1), uint64(0x0)) 719 var x11 uint64 720 var x12 uint64 721 x11, x12 = bits.Sub64(x3, 0xffffffff00000000, uint64(p224Uint1(x10))) 722 var x13 uint64 723 var x14 uint64 724 x13, x14 = bits.Sub64(x5, 0xffffffffffffffff, uint64(p224Uint1(x12))) 725 var x15 uint64 726 var x16 uint64 727 x15, x16 = bits.Sub64(x7, 0xffffffff, uint64(p224Uint1(x14))) 728 var x18 uint64 729 _, x18 = bits.Sub64(uint64(p224Uint1(x8)), uint64(0x0), uint64(p224Uint1(x16))) 730 var x19 uint64 731 p224CmovznzU64(&x19, p224Uint1(x18), x9, x1) 732 var x20 uint64 733 p224CmovznzU64(&x20, p224Uint1(x18), x11, x3) 734 var x21 uint64 735 p224CmovznzU64(&x21, p224Uint1(x18), x13, x5) 736 var x22 uint64 737 p224CmovznzU64(&x22, p224Uint1(x18), x15, x7) 738 out1[0] = x19 739 out1[1] = x20 740 out1[2] = x21 741 out1[3] = x22 742} 743 744// p224Sub subtracts two field elements in the Montgomery domain. 745// 746// Preconditions: 747// 748// 0 ≤ eval arg1 < m 749// 0 ≤ eval arg2 < m 750// 751// Postconditions: 752// 753// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m 754// 0 ≤ eval out1 < m 755func p224Sub(out1 *p224MontgomeryDomainFieldElement, arg1 *p224MontgomeryDomainFieldElement, arg2 *p224MontgomeryDomainFieldElement) { 756 var x1 uint64 757 var x2 uint64 758 x1, x2 = bits.Sub64(arg1[0], arg2[0], uint64(0x0)) 759 var x3 uint64 760 var x4 uint64 761 x3, x4 = bits.Sub64(arg1[1], arg2[1], uint64(p224Uint1(x2))) 762 var x5 uint64 763 var x6 uint64 764 x5, x6 = bits.Sub64(arg1[2], arg2[2], uint64(p224Uint1(x4))) 765 var x7 uint64 766 var x8 uint64 767 x7, x8 = bits.Sub64(arg1[3], arg2[3], uint64(p224Uint1(x6))) 768 var x9 uint64 769 p224CmovznzU64(&x9, p224Uint1(x8), uint64(0x0), 0xffffffffffffffff) 770 var x10 uint64 771 var x11 uint64 772 x10, x11 = bits.Add64(x1, uint64((p224Uint1(x9) & 0x1)), uint64(0x0)) 773 var x12 uint64 774 var x13 uint64 775 x12, x13 = bits.Add64(x3, (x9 & 0xffffffff00000000), uint64(p224Uint1(x11))) 776 var x14 uint64 777 var x15 uint64 778 x14, x15 = bits.Add64(x5, x9, uint64(p224Uint1(x13))) 779 var x16 uint64 780 x16, _ = bits.Add64(x7, (x9 & 0xffffffff), uint64(p224Uint1(x15))) 781 out1[0] = x10 782 out1[1] = x12 783 out1[2] = x14 784 out1[3] = x16 785} 786 787// p224SetOne returns the field element one in the Montgomery domain. 788// 789// Postconditions: 790// 791// eval (from_montgomery out1) mod m = 1 mod m 792// 0 ≤ eval out1 < m 793func p224SetOne(out1 *p224MontgomeryDomainFieldElement) { 794 out1[0] = 0xffffffff00000000 795 out1[1] = 0xffffffffffffffff 796 out1[2] = uint64(0x0) 797 out1[3] = uint64(0x0) 798} 799 800// p224FromMontgomery translates a field element out of the Montgomery domain. 801// 802// Preconditions: 803// 804// 0 ≤ eval arg1 < m 805// 806// Postconditions: 807// 808// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m 809// 0 ≤ eval out1 < m 810func p224FromMontgomery(out1 *p224NonMontgomeryDomainFieldElement, arg1 *p224MontgomeryDomainFieldElement) { 811 x1 := arg1[0] 812 var x2 uint64 813 _, x2 = bits.Mul64(x1, 0xffffffffffffffff) 814 var x4 uint64 815 var x5 uint64 816 x5, x4 = bits.Mul64(x2, 0xffffffff) 817 var x6 uint64 818 var x7 uint64 819 x7, x6 = bits.Mul64(x2, 0xffffffffffffffff) 820 var x8 uint64 821 var x9 uint64 822 x9, x8 = bits.Mul64(x2, 0xffffffff00000000) 823 var x10 uint64 824 var x11 uint64 825 x10, x11 = bits.Add64(x9, x6, uint64(0x0)) 826 var x12 uint64 827 var x13 uint64 828 x12, x13 = bits.Add64(x7, x4, uint64(p224Uint1(x11))) 829 var x15 uint64 830 _, x15 = bits.Add64(x1, x2, uint64(0x0)) 831 var x16 uint64 832 var x17 uint64 833 x16, x17 = bits.Add64(uint64(0x0), x8, uint64(p224Uint1(x15))) 834 var x18 uint64 835 var x19 uint64 836 x18, x19 = bits.Add64(uint64(0x0), x10, uint64(p224Uint1(x17))) 837 var x20 uint64 838 var x21 uint64 839 x20, x21 = bits.Add64(uint64(0x0), x12, uint64(p224Uint1(x19))) 840 var x22 uint64 841 var x23 uint64 842 x22, x23 = bits.Add64(x16, arg1[1], uint64(0x0)) 843 var x24 uint64 844 var x25 uint64 845 x24, x25 = bits.Add64(x18, uint64(0x0), uint64(p224Uint1(x23))) 846 var x26 uint64 847 var x27 uint64 848 x26, x27 = bits.Add64(x20, uint64(0x0), uint64(p224Uint1(x25))) 849 var x28 uint64 850 _, x28 = bits.Mul64(x22, 0xffffffffffffffff) 851 var x30 uint64 852 var x31 uint64 853 x31, x30 = bits.Mul64(x28, 0xffffffff) 854 var x32 uint64 855 var x33 uint64 856 x33, x32 = bits.Mul64(x28, 0xffffffffffffffff) 857 var x34 uint64 858 var x35 uint64 859 x35, x34 = bits.Mul64(x28, 0xffffffff00000000) 860 var x36 uint64 861 var x37 uint64 862 x36, x37 = bits.Add64(x35, x32, uint64(0x0)) 863 var x38 uint64 864 var x39 uint64 865 x38, x39 = bits.Add64(x33, x30, uint64(p224Uint1(x37))) 866 var x41 uint64 867 _, x41 = bits.Add64(x22, x28, uint64(0x0)) 868 var x42 uint64 869 var x43 uint64 870 x42, x43 = bits.Add64(x24, x34, uint64(p224Uint1(x41))) 871 var x44 uint64 872 var x45 uint64 873 x44, x45 = bits.Add64(x26, x36, uint64(p224Uint1(x43))) 874 var x46 uint64 875 var x47 uint64 876 x46, x47 = bits.Add64((uint64(p224Uint1(x27)) + (uint64(p224Uint1(x21)) + (uint64(p224Uint1(x13)) + x5))), x38, uint64(p224Uint1(x45))) 877 var x48 uint64 878 var x49 uint64 879 x48, x49 = bits.Add64(x42, arg1[2], uint64(0x0)) 880 var x50 uint64 881 var x51 uint64 882 x50, x51 = bits.Add64(x44, uint64(0x0), uint64(p224Uint1(x49))) 883 var x52 uint64 884 var x53 uint64 885 x52, x53 = bits.Add64(x46, uint64(0x0), uint64(p224Uint1(x51))) 886 var x54 uint64 887 _, x54 = bits.Mul64(x48, 0xffffffffffffffff) 888 var x56 uint64 889 var x57 uint64 890 x57, x56 = bits.Mul64(x54, 0xffffffff) 891 var x58 uint64 892 var x59 uint64 893 x59, x58 = bits.Mul64(x54, 0xffffffffffffffff) 894 var x60 uint64 895 var x61 uint64 896 x61, x60 = bits.Mul64(x54, 0xffffffff00000000) 897 var x62 uint64 898 var x63 uint64 899 x62, x63 = bits.Add64(x61, x58, uint64(0x0)) 900 var x64 uint64 901 var x65 uint64 902 x64, x65 = bits.Add64(x59, x56, uint64(p224Uint1(x63))) 903 var x67 uint64 904 _, x67 = bits.Add64(x48, x54, uint64(0x0)) 905 var x68 uint64 906 var x69 uint64 907 x68, x69 = bits.Add64(x50, x60, uint64(p224Uint1(x67))) 908 var x70 uint64 909 var x71 uint64 910 x70, x71 = bits.Add64(x52, x62, uint64(p224Uint1(x69))) 911 var x72 uint64 912 var x73 uint64 913 x72, x73 = bits.Add64((uint64(p224Uint1(x53)) + (uint64(p224Uint1(x47)) + (uint64(p224Uint1(x39)) + x31))), x64, uint64(p224Uint1(x71))) 914 var x74 uint64 915 var x75 uint64 916 x74, x75 = bits.Add64(x68, arg1[3], uint64(0x0)) 917 var x76 uint64 918 var x77 uint64 919 x76, x77 = bits.Add64(x70, uint64(0x0), uint64(p224Uint1(x75))) 920 var x78 uint64 921 var x79 uint64 922 x78, x79 = bits.Add64(x72, uint64(0x0), uint64(p224Uint1(x77))) 923 var x80 uint64 924 _, x80 = bits.Mul64(x74, 0xffffffffffffffff) 925 var x82 uint64 926 var x83 uint64 927 x83, x82 = bits.Mul64(x80, 0xffffffff) 928 var x84 uint64 929 var x85 uint64 930 x85, x84 = bits.Mul64(x80, 0xffffffffffffffff) 931 var x86 uint64 932 var x87 uint64 933 x87, x86 = bits.Mul64(x80, 0xffffffff00000000) 934 var x88 uint64 935 var x89 uint64 936 x88, x89 = bits.Add64(x87, x84, uint64(0x0)) 937 var x90 uint64 938 var x91 uint64 939 x90, x91 = bits.Add64(x85, x82, uint64(p224Uint1(x89))) 940 var x93 uint64 941 _, x93 = bits.Add64(x74, x80, uint64(0x0)) 942 var x94 uint64 943 var x95 uint64 944 x94, x95 = bits.Add64(x76, x86, uint64(p224Uint1(x93))) 945 var x96 uint64 946 var x97 uint64 947 x96, x97 = bits.Add64(x78, x88, uint64(p224Uint1(x95))) 948 var x98 uint64 949 var x99 uint64 950 x98, x99 = bits.Add64((uint64(p224Uint1(x79)) + (uint64(p224Uint1(x73)) + (uint64(p224Uint1(x65)) + x57))), x90, uint64(p224Uint1(x97))) 951 x100 := (uint64(p224Uint1(x99)) + (uint64(p224Uint1(x91)) + x83)) 952 var x101 uint64 953 var x102 uint64 954 x101, x102 = bits.Sub64(x94, uint64(0x1), uint64(0x0)) 955 var x103 uint64 956 var x104 uint64 957 x103, x104 = bits.Sub64(x96, 0xffffffff00000000, uint64(p224Uint1(x102))) 958 var x105 uint64 959 var x106 uint64 960 x105, x106 = bits.Sub64(x98, 0xffffffffffffffff, uint64(p224Uint1(x104))) 961 var x107 uint64 962 var x108 uint64 963 x107, x108 = bits.Sub64(x100, 0xffffffff, uint64(p224Uint1(x106))) 964 var x110 uint64 965 _, x110 = bits.Sub64(uint64(0x0), uint64(0x0), uint64(p224Uint1(x108))) 966 var x111 uint64 967 p224CmovznzU64(&x111, p224Uint1(x110), x101, x94) 968 var x112 uint64 969 p224CmovznzU64(&x112, p224Uint1(x110), x103, x96) 970 var x113 uint64 971 p224CmovznzU64(&x113, p224Uint1(x110), x105, x98) 972 var x114 uint64 973 p224CmovznzU64(&x114, p224Uint1(x110), x107, x100) 974 out1[0] = x111 975 out1[1] = x112 976 out1[2] = x113 977 out1[3] = x114 978} 979 980// p224ToMontgomery translates a field element into the Montgomery domain. 981// 982// Preconditions: 983// 984// 0 ≤ eval arg1 < m 985// 986// Postconditions: 987// 988// eval (from_montgomery out1) mod m = eval arg1 mod m 989// 0 ≤ eval out1 < m 990func p224ToMontgomery(out1 *p224MontgomeryDomainFieldElement, arg1 *p224NonMontgomeryDomainFieldElement) { 991 x1 := arg1[1] 992 x2 := arg1[2] 993 x3 := arg1[3] 994 x4 := arg1[0] 995 var x5 uint64 996 var x6 uint64 997 x6, x5 = bits.Mul64(x4, 0xffffffff) 998 var x7 uint64 999 var x8 uint64 1000 x8, x7 = bits.Mul64(x4, 0xfffffffe00000000) 1001 var x9 uint64 1002 var x10 uint64 1003 x10, x9 = bits.Mul64(x4, 0xffffffff00000000) 1004 var x11 uint64 1005 var x12 uint64 1006 x12, x11 = bits.Mul64(x4, 0xffffffff00000001) 1007 var x13 uint64 1008 var x14 uint64 1009 x13, x14 = bits.Add64(x12, x9, uint64(0x0)) 1010 var x15 uint64 1011 var x16 uint64 1012 x15, x16 = bits.Add64(x10, x7, uint64(p224Uint1(x14))) 1013 var x17 uint64 1014 var x18 uint64 1015 x17, x18 = bits.Add64(x8, x5, uint64(p224Uint1(x16))) 1016 var x19 uint64 1017 _, x19 = bits.Mul64(x11, 0xffffffffffffffff) 1018 var x21 uint64 1019 var x22 uint64 1020 x22, x21 = bits.Mul64(x19, 0xffffffff) 1021 var x23 uint64 1022 var x24 uint64 1023 x24, x23 = bits.Mul64(x19, 0xffffffffffffffff) 1024 var x25 uint64 1025 var x26 uint64 1026 x26, x25 = bits.Mul64(x19, 0xffffffff00000000) 1027 var x27 uint64 1028 var x28 uint64 1029 x27, x28 = bits.Add64(x26, x23, uint64(0x0)) 1030 var x29 uint64 1031 var x30 uint64 1032 x29, x30 = bits.Add64(x24, x21, uint64(p224Uint1(x28))) 1033 var x32 uint64 1034 _, x32 = bits.Add64(x11, x19, uint64(0x0)) 1035 var x33 uint64 1036 var x34 uint64 1037 x33, x34 = bits.Add64(x13, x25, uint64(p224Uint1(x32))) 1038 var x35 uint64 1039 var x36 uint64 1040 x35, x36 = bits.Add64(x15, x27, uint64(p224Uint1(x34))) 1041 var x37 uint64 1042 var x38 uint64 1043 x37, x38 = bits.Add64(x17, x29, uint64(p224Uint1(x36))) 1044 var x39 uint64 1045 var x40 uint64 1046 x40, x39 = bits.Mul64(x1, 0xffffffff) 1047 var x41 uint64 1048 var x42 uint64 1049 x42, x41 = bits.Mul64(x1, 0xfffffffe00000000) 1050 var x43 uint64 1051 var x44 uint64 1052 x44, x43 = bits.Mul64(x1, 0xffffffff00000000) 1053 var x45 uint64 1054 var x46 uint64 1055 x46, x45 = bits.Mul64(x1, 0xffffffff00000001) 1056 var x47 uint64 1057 var x48 uint64 1058 x47, x48 = bits.Add64(x46, x43, uint64(0x0)) 1059 var x49 uint64 1060 var x50 uint64 1061 x49, x50 = bits.Add64(x44, x41, uint64(p224Uint1(x48))) 1062 var x51 uint64 1063 var x52 uint64 1064 x51, x52 = bits.Add64(x42, x39, uint64(p224Uint1(x50))) 1065 var x53 uint64 1066 var x54 uint64 1067 x53, x54 = bits.Add64(x33, x45, uint64(0x0)) 1068 var x55 uint64 1069 var x56 uint64 1070 x55, x56 = bits.Add64(x35, x47, uint64(p224Uint1(x54))) 1071 var x57 uint64 1072 var x58 uint64 1073 x57, x58 = bits.Add64(x37, x49, uint64(p224Uint1(x56))) 1074 var x59 uint64 1075 var x60 uint64 1076 x59, x60 = bits.Add64(((uint64(p224Uint1(x38)) + (uint64(p224Uint1(x18)) + x6)) + (uint64(p224Uint1(x30)) + x22)), x51, uint64(p224Uint1(x58))) 1077 var x61 uint64 1078 _, x61 = bits.Mul64(x53, 0xffffffffffffffff) 1079 var x63 uint64 1080 var x64 uint64 1081 x64, x63 = bits.Mul64(x61, 0xffffffff) 1082 var x65 uint64 1083 var x66 uint64 1084 x66, x65 = bits.Mul64(x61, 0xffffffffffffffff) 1085 var x67 uint64 1086 var x68 uint64 1087 x68, x67 = bits.Mul64(x61, 0xffffffff00000000) 1088 var x69 uint64 1089 var x70 uint64 1090 x69, x70 = bits.Add64(x68, x65, uint64(0x0)) 1091 var x71 uint64 1092 var x72 uint64 1093 x71, x72 = bits.Add64(x66, x63, uint64(p224Uint1(x70))) 1094 var x74 uint64 1095 _, x74 = bits.Add64(x53, x61, uint64(0x0)) 1096 var x75 uint64 1097 var x76 uint64 1098 x75, x76 = bits.Add64(x55, x67, uint64(p224Uint1(x74))) 1099 var x77 uint64 1100 var x78 uint64 1101 x77, x78 = bits.Add64(x57, x69, uint64(p224Uint1(x76))) 1102 var x79 uint64 1103 var x80 uint64 1104 x79, x80 = bits.Add64(x59, x71, uint64(p224Uint1(x78))) 1105 var x81 uint64 1106 var x82 uint64 1107 x82, x81 = bits.Mul64(x2, 0xffffffff) 1108 var x83 uint64 1109 var x84 uint64 1110 x84, x83 = bits.Mul64(x2, 0xfffffffe00000000) 1111 var x85 uint64 1112 var x86 uint64 1113 x86, x85 = bits.Mul64(x2, 0xffffffff00000000) 1114 var x87 uint64 1115 var x88 uint64 1116 x88, x87 = bits.Mul64(x2, 0xffffffff00000001) 1117 var x89 uint64 1118 var x90 uint64 1119 x89, x90 = bits.Add64(x88, x85, uint64(0x0)) 1120 var x91 uint64 1121 var x92 uint64 1122 x91, x92 = bits.Add64(x86, x83, uint64(p224Uint1(x90))) 1123 var x93 uint64 1124 var x94 uint64 1125 x93, x94 = bits.Add64(x84, x81, uint64(p224Uint1(x92))) 1126 var x95 uint64 1127 var x96 uint64 1128 x95, x96 = bits.Add64(x75, x87, uint64(0x0)) 1129 var x97 uint64 1130 var x98 uint64 1131 x97, x98 = bits.Add64(x77, x89, uint64(p224Uint1(x96))) 1132 var x99 uint64 1133 var x100 uint64 1134 x99, x100 = bits.Add64(x79, x91, uint64(p224Uint1(x98))) 1135 var x101 uint64 1136 var x102 uint64 1137 x101, x102 = bits.Add64(((uint64(p224Uint1(x80)) + (uint64(p224Uint1(x60)) + (uint64(p224Uint1(x52)) + x40))) + (uint64(p224Uint1(x72)) + x64)), x93, uint64(p224Uint1(x100))) 1138 var x103 uint64 1139 _, x103 = bits.Mul64(x95, 0xffffffffffffffff) 1140 var x105 uint64 1141 var x106 uint64 1142 x106, x105 = bits.Mul64(x103, 0xffffffff) 1143 var x107 uint64 1144 var x108 uint64 1145 x108, x107 = bits.Mul64(x103, 0xffffffffffffffff) 1146 var x109 uint64 1147 var x110 uint64 1148 x110, x109 = bits.Mul64(x103, 0xffffffff00000000) 1149 var x111 uint64 1150 var x112 uint64 1151 x111, x112 = bits.Add64(x110, x107, uint64(0x0)) 1152 var x113 uint64 1153 var x114 uint64 1154 x113, x114 = bits.Add64(x108, x105, uint64(p224Uint1(x112))) 1155 var x116 uint64 1156 _, x116 = bits.Add64(x95, x103, uint64(0x0)) 1157 var x117 uint64 1158 var x118 uint64 1159 x117, x118 = bits.Add64(x97, x109, uint64(p224Uint1(x116))) 1160 var x119 uint64 1161 var x120 uint64 1162 x119, x120 = bits.Add64(x99, x111, uint64(p224Uint1(x118))) 1163 var x121 uint64 1164 var x122 uint64 1165 x121, x122 = bits.Add64(x101, x113, uint64(p224Uint1(x120))) 1166 var x123 uint64 1167 var x124 uint64 1168 x124, x123 = bits.Mul64(x3, 0xffffffff) 1169 var x125 uint64 1170 var x126 uint64 1171 x126, x125 = bits.Mul64(x3, 0xfffffffe00000000) 1172 var x127 uint64 1173 var x128 uint64 1174 x128, x127 = bits.Mul64(x3, 0xffffffff00000000) 1175 var x129 uint64 1176 var x130 uint64 1177 x130, x129 = bits.Mul64(x3, 0xffffffff00000001) 1178 var x131 uint64 1179 var x132 uint64 1180 x131, x132 = bits.Add64(x130, x127, uint64(0x0)) 1181 var x133 uint64 1182 var x134 uint64 1183 x133, x134 = bits.Add64(x128, x125, uint64(p224Uint1(x132))) 1184 var x135 uint64 1185 var x136 uint64 1186 x135, x136 = bits.Add64(x126, x123, uint64(p224Uint1(x134))) 1187 var x137 uint64 1188 var x138 uint64 1189 x137, x138 = bits.Add64(x117, x129, uint64(0x0)) 1190 var x139 uint64 1191 var x140 uint64 1192 x139, x140 = bits.Add64(x119, x131, uint64(p224Uint1(x138))) 1193 var x141 uint64 1194 var x142 uint64 1195 x141, x142 = bits.Add64(x121, x133, uint64(p224Uint1(x140))) 1196 var x143 uint64 1197 var x144 uint64 1198 x143, x144 = bits.Add64(((uint64(p224Uint1(x122)) + (uint64(p224Uint1(x102)) + (uint64(p224Uint1(x94)) + x82))) + (uint64(p224Uint1(x114)) + x106)), x135, uint64(p224Uint1(x142))) 1199 var x145 uint64 1200 _, x145 = bits.Mul64(x137, 0xffffffffffffffff) 1201 var x147 uint64 1202 var x148 uint64 1203 x148, x147 = bits.Mul64(x145, 0xffffffff) 1204 var x149 uint64 1205 var x150 uint64 1206 x150, x149 = bits.Mul64(x145, 0xffffffffffffffff) 1207 var x151 uint64 1208 var x152 uint64 1209 x152, x151 = bits.Mul64(x145, 0xffffffff00000000) 1210 var x153 uint64 1211 var x154 uint64 1212 x153, x154 = bits.Add64(x152, x149, uint64(0x0)) 1213 var x155 uint64 1214 var x156 uint64 1215 x155, x156 = bits.Add64(x150, x147, uint64(p224Uint1(x154))) 1216 var x158 uint64 1217 _, x158 = bits.Add64(x137, x145, uint64(0x0)) 1218 var x159 uint64 1219 var x160 uint64 1220 x159, x160 = bits.Add64(x139, x151, uint64(p224Uint1(x158))) 1221 var x161 uint64 1222 var x162 uint64 1223 x161, x162 = bits.Add64(x141, x153, uint64(p224Uint1(x160))) 1224 var x163 uint64 1225 var x164 uint64 1226 x163, x164 = bits.Add64(x143, x155, uint64(p224Uint1(x162))) 1227 x165 := ((uint64(p224Uint1(x164)) + (uint64(p224Uint1(x144)) + (uint64(p224Uint1(x136)) + x124))) + (uint64(p224Uint1(x156)) + x148)) 1228 var x166 uint64 1229 var x167 uint64 1230 x166, x167 = bits.Sub64(x159, uint64(0x1), uint64(0x0)) 1231 var x168 uint64 1232 var x169 uint64 1233 x168, x169 = bits.Sub64(x161, 0xffffffff00000000, uint64(p224Uint1(x167))) 1234 var x170 uint64 1235 var x171 uint64 1236 x170, x171 = bits.Sub64(x163, 0xffffffffffffffff, uint64(p224Uint1(x169))) 1237 var x172 uint64 1238 var x173 uint64 1239 x172, x173 = bits.Sub64(x165, 0xffffffff, uint64(p224Uint1(x171))) 1240 var x175 uint64 1241 _, x175 = bits.Sub64(uint64(0x0), uint64(0x0), uint64(p224Uint1(x173))) 1242 var x176 uint64 1243 p224CmovznzU64(&x176, p224Uint1(x175), x166, x159) 1244 var x177 uint64 1245 p224CmovznzU64(&x177, p224Uint1(x175), x168, x161) 1246 var x178 uint64 1247 p224CmovznzU64(&x178, p224Uint1(x175), x170, x163) 1248 var x179 uint64 1249 p224CmovznzU64(&x179, p224Uint1(x175), x172, x165) 1250 out1[0] = x176 1251 out1[1] = x177 1252 out1[2] = x178 1253 out1[3] = x179 1254} 1255 1256// p224Selectznz is a multi-limb conditional select. 1257// 1258// Postconditions: 1259// 1260// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3) 1261// 1262// Input Bounds: 1263// 1264// arg1: [0x0 ~> 0x1] 1265// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] 1266// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] 1267// 1268// Output Bounds: 1269// 1270// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]] 1271func p224Selectznz(out1 *[4]uint64, arg1 p224Uint1, arg2 *[4]uint64, arg3 *[4]uint64) { 1272 var x1 uint64 1273 p224CmovznzU64(&x1, arg1, arg2[0], arg3[0]) 1274 var x2 uint64 1275 p224CmovznzU64(&x2, arg1, arg2[1], arg3[1]) 1276 var x3 uint64 1277 p224CmovznzU64(&x3, arg1, arg2[2], arg3[2]) 1278 var x4 uint64 1279 p224CmovznzU64(&x4, arg1, arg2[3], arg3[3]) 1280 out1[0] = x1 1281 out1[1] = x2 1282 out1[2] = x3 1283 out1[3] = x4 1284} 1285 1286// p224ToBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order. 1287// 1288// Preconditions: 1289// 1290// 0 ≤ eval arg1 < m 1291// 1292// Postconditions: 1293// 1294// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..27] 1295// 1296// Input Bounds: 1297// 1298// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffff]] 1299// 1300// Output Bounds: 1301// 1302// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] 1303func p224ToBytes(out1 *[28]uint8, arg1 *[4]uint64) { 1304 x1 := arg1[3] 1305 x2 := arg1[2] 1306 x3 := arg1[1] 1307 x4 := arg1[0] 1308 x5 := (uint8(x4) & 0xff) 1309 x6 := (x4 >> 8) 1310 x7 := (uint8(x6) & 0xff) 1311 x8 := (x6 >> 8) 1312 x9 := (uint8(x8) & 0xff) 1313 x10 := (x8 >> 8) 1314 x11 := (uint8(x10) & 0xff) 1315 x12 := (x10 >> 8) 1316 x13 := (uint8(x12) & 0xff) 1317 x14 := (x12 >> 8) 1318 x15 := (uint8(x14) & 0xff) 1319 x16 := (x14 >> 8) 1320 x17 := (uint8(x16) & 0xff) 1321 x18 := uint8((x16 >> 8)) 1322 x19 := (uint8(x3) & 0xff) 1323 x20 := (x3 >> 8) 1324 x21 := (uint8(x20) & 0xff) 1325 x22 := (x20 >> 8) 1326 x23 := (uint8(x22) & 0xff) 1327 x24 := (x22 >> 8) 1328 x25 := (uint8(x24) & 0xff) 1329 x26 := (x24 >> 8) 1330 x27 := (uint8(x26) & 0xff) 1331 x28 := (x26 >> 8) 1332 x29 := (uint8(x28) & 0xff) 1333 x30 := (x28 >> 8) 1334 x31 := (uint8(x30) & 0xff) 1335 x32 := uint8((x30 >> 8)) 1336 x33 := (uint8(x2) & 0xff) 1337 x34 := (x2 >> 8) 1338 x35 := (uint8(x34) & 0xff) 1339 x36 := (x34 >> 8) 1340 x37 := (uint8(x36) & 0xff) 1341 x38 := (x36 >> 8) 1342 x39 := (uint8(x38) & 0xff) 1343 x40 := (x38 >> 8) 1344 x41 := (uint8(x40) & 0xff) 1345 x42 := (x40 >> 8) 1346 x43 := (uint8(x42) & 0xff) 1347 x44 := (x42 >> 8) 1348 x45 := (uint8(x44) & 0xff) 1349 x46 := uint8((x44 >> 8)) 1350 x47 := (uint8(x1) & 0xff) 1351 x48 := (x1 >> 8) 1352 x49 := (uint8(x48) & 0xff) 1353 x50 := (x48 >> 8) 1354 x51 := (uint8(x50) & 0xff) 1355 x52 := uint8((x50 >> 8)) 1356 out1[0] = x5 1357 out1[1] = x7 1358 out1[2] = x9 1359 out1[3] = x11 1360 out1[4] = x13 1361 out1[5] = x15 1362 out1[6] = x17 1363 out1[7] = x18 1364 out1[8] = x19 1365 out1[9] = x21 1366 out1[10] = x23 1367 out1[11] = x25 1368 out1[12] = x27 1369 out1[13] = x29 1370 out1[14] = x31 1371 out1[15] = x32 1372 out1[16] = x33 1373 out1[17] = x35 1374 out1[18] = x37 1375 out1[19] = x39 1376 out1[20] = x41 1377 out1[21] = x43 1378 out1[22] = x45 1379 out1[23] = x46 1380 out1[24] = x47 1381 out1[25] = x49 1382 out1[26] = x51 1383 out1[27] = x52 1384} 1385 1386// p224FromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order. 1387// 1388// Preconditions: 1389// 1390// 0 ≤ bytes_eval arg1 < m 1391// 1392// Postconditions: 1393// 1394// eval out1 mod m = bytes_eval arg1 mod m 1395// 0 ≤ eval out1 < m 1396// 1397// Input Bounds: 1398// 1399// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]] 1400// 1401// Output Bounds: 1402// 1403// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffff]] 1404func p224FromBytes(out1 *[4]uint64, arg1 *[28]uint8) { 1405 x1 := (uint64(arg1[27]) << 24) 1406 x2 := (uint64(arg1[26]) << 16) 1407 x3 := (uint64(arg1[25]) << 8) 1408 x4 := arg1[24] 1409 x5 := (uint64(arg1[23]) << 56) 1410 x6 := (uint64(arg1[22]) << 48) 1411 x7 := (uint64(arg1[21]) << 40) 1412 x8 := (uint64(arg1[20]) << 32) 1413 x9 := (uint64(arg1[19]) << 24) 1414 x10 := (uint64(arg1[18]) << 16) 1415 x11 := (uint64(arg1[17]) << 8) 1416 x12 := arg1[16] 1417 x13 := (uint64(arg1[15]) << 56) 1418 x14 := (uint64(arg1[14]) << 48) 1419 x15 := (uint64(arg1[13]) << 40) 1420 x16 := (uint64(arg1[12]) << 32) 1421 x17 := (uint64(arg1[11]) << 24) 1422 x18 := (uint64(arg1[10]) << 16) 1423 x19 := (uint64(arg1[9]) << 8) 1424 x20 := arg1[8] 1425 x21 := (uint64(arg1[7]) << 56) 1426 x22 := (uint64(arg1[6]) << 48) 1427 x23 := (uint64(arg1[5]) << 40) 1428 x24 := (uint64(arg1[4]) << 32) 1429 x25 := (uint64(arg1[3]) << 24) 1430 x26 := (uint64(arg1[2]) << 16) 1431 x27 := (uint64(arg1[1]) << 8) 1432 x28 := arg1[0] 1433 x29 := (x27 + uint64(x28)) 1434 x30 := (x26 + x29) 1435 x31 := (x25 + x30) 1436 x32 := (x24 + x31) 1437 x33 := (x23 + x32) 1438 x34 := (x22 + x33) 1439 x35 := (x21 + x34) 1440 x36 := (x19 + uint64(x20)) 1441 x37 := (x18 + x36) 1442 x38 := (x17 + x37) 1443 x39 := (x16 + x38) 1444 x40 := (x15 + x39) 1445 x41 := (x14 + x40) 1446 x42 := (x13 + x41) 1447 x43 := (x11 + uint64(x12)) 1448 x44 := (x10 + x43) 1449 x45 := (x9 + x44) 1450 x46 := (x8 + x45) 1451 x47 := (x7 + x46) 1452 x48 := (x6 + x47) 1453 x49 := (x5 + x48) 1454 x50 := (x3 + uint64(x4)) 1455 x51 := (x2 + x50) 1456 x52 := (x1 + x51) 1457 out1[0] = x35 1458 out1[1] = x42 1459 out1[2] = x49 1460 out1[3] = x52 1461} 1462