M meson.build → meson.build

@@ -7,7 +7,7 @@ 'tinycrypt/portable/kangarootwelve128.c',
     'tinycrypt/portable/sha2.c',
 ]
 
-if false#meson.get_compiler('c').has_define('__SIZEOF_INT128__')
+if meson.get_compiler('c').has_define('__SIZEOF_INT128__')
     sources += 'tinycrypt/x86_64_aarch64/ed25519.c'
 else
     sources += 'tinycrypt/portable/ed25519.c'

M test.c → test.c

@@ -1,58 +1,37 @@
+#include "tinycrypt/x25519.h"
 #include <stdint.h>
 #include <stdio.h>
 
-static void
-add_shifted (uint32_t *h, const uint32_t *c, uint8_t shift)
+int
+main (int argc, char **argv)
 {
-  uint32_t shifted[16];
-  for (uint8_t i = 0; i < 16; ++i)
+  const uint8_t SCALAR[]
+      = { 0x4b, 0x66, 0xe9, 0xd4, 0xd1, 0xb4, 0x67, 0x3c, 0x5a, 0xd2, 0x26,
+          0x91, 0x95, 0x7d, 0x6a, 0xf5, 0xc1, 0x1b, 0x64, 0x21, 0xe0, 0xea,
+          0x01, 0xd4, 0x2c, 0xa4, 0x16, 0x9e, 0x79, 0x18, 0xba, 0x0d };
+  const uint8_t U[]
+      = { 0xe5, 0x21, 0x0f, 0x12, 0x78, 0x68, 0x11, 0xd3, 0xf4, 0xb7, 0x95,
+          0x9d, 0x05, 0x38, 0xae, 0x2c, 0x31, 0xdb, 0xe7, 0x10, 0x6f, 0xc0,
+          0x3c, 0x3e, 0xfc, 0x4c, 0xd5, 0x49, 0xc7, 0x15, 0xa4, 0x93 };
+  const uint8_t EXPECTED[]
+      = { 0x95, 0xcb, 0xde, 0x94, 0x76, 0xe8, 0x90, 0x7d, 0x7a, 0xad, 0xe4,
+          0x5c, 0xb4, 0xb8, 0x73, 0xf8, 0x8b, 0x59, 0x5a, 0x68, 0x79, 0x9f,
+          0xa1, 0x52, 0xe6, 0xf8, 0xf7, 0x64, 0x7a, 0xac, 0x79, 0x57 };
+  uint8_t actual[sizeof (EXPECTED)];
+  for (unsigned int i = 0; i < 10000; ++i)
     {
-      shifted[i] = 0x0;
+      tct_x25519 (SCALAR, U, actual);
     }
-  shifted[shift / 32] = (c[0] << (shift % 32)) & 0xffffffff;
-  for (uint8_t i = shift / 32 + 1; i < shift / 32 + 9 && i < 16; ++i)
+  for (unsigned int i = 0; i < sizeof (actual); ++i)
     {
-      if (shift % 32 == 0)
-        {
-          shifted[i] = c[i - shift / 32];
-        }
-      else
-        {
-          shifted[i] = (c[i - shift / 32 - 1] >> (32 - (shift % 32)))
-                       | ((c[i - shift / 32] << (shift % 32)) & 0xffffffff);
-        }
+      printf ("%02x", actual[i]);
     }
-  if (shift / 32 + 9 < 16)
-    {
-      shifted[shift / 32 + 9] = c[8] >> (32 - (shift % 32));
-    }
-  uint64_t acc = 0;
-  for (unsigned int i = 0; i < 16; ++i)
-    {
-      acc += (uint64_t)h[i] + (uint64_t)shifted[i];
-      h[i] = acc & 0xffffffff;
-      acc >>= 32;
-    }
-}
+  printf ("\n");
 
-int
-main ()
-{
-  uint32_t buf[16] = {
-    0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-    0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-  };
-  uint32_t to_add[9] = {
-    0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-  };
-  for (uint16_t i = 0; i <= 255; ++i)
+  for (unsigned int i = 0; i < sizeof (actual); ++i)
     {
-      add_shifted (buf, to_add, i);
-      for (unsigned int i = 0; i < 16; ++i)
-        {
-          printf ("%08x", buf[15 - i]);
-        }
-      printf ("\n");
+      printf ("%02x", EXPECTED[i]);
     }
+  printf ("\n");
   return 0;
 }

M tinycrypt/portable/ed25519.c → tinycrypt/portable/ed25519.c

@@ -23,106 +23,43 @@ }
 }
 
 static void
-add_shifted (uint32_t *h, const uint32_t *c, uint8_t shift)
+add_shifted (uint32_t *h, const uint64_t c, const unsigned int shift)
 {
-  uint32_t shifted[16];
-  for (uint8_t i = 0; i < 16; ++i)
+  uint32_t digits[2];
+  digits[0] = c & 0xffffffff;
+  digits[1] = (c >> 32) & 0xffffffff;
+  uint64_t accumulator = 0;
+  unsigned int i;
+  for (i = shift; i < shift + 2 && i < 16; ++i)
     {
-      shifted[i] = 0x0;
+      accumulator += (uint64_t)digits[i - shift] + (uint64_t)h[i];
+      h[i] = accumulator & 0xffffffff;
+      accumulator >>= 32;
     }
-  if (shift % 32 == 0)
+  while (i < 16)
     {
-      for (uint8_t i = shift / 32; i < 16 && i < shift / 32 + 9; ++i)
-        {
-          shifted[i] = c[i - shift / 32];
-        }
-    }
-  else
-    {
-      shifted[shift / 32] = (c[0] << (shift % 32)) & 0xffffffff;
-      for (uint8_t i = shift / 32 + 1; i < shift / 32 + 9 && i < 16; ++i)
-        {
-          shifted[i] = (c[i - shift / 32 - 1] >> (32 - (shift % 32)))
-                       | ((c[i - shift / 32] << (shift % 32)) & 0xffffffff);
-        }
-      if (shift / 32 + 9 < 16)
-        {
-          shifted[shift / 32 + 9] = c[8] >> (32 - (shift % 32));
-        }
-    }
-  uint64_t acc = 0;
-  for (unsigned int i = 0; i < 16; ++i)
-    {
-      acc += (uint64_t)h[i] + (uint64_t)shifted[i];
-      h[i] = acc & 0xffffffff;
-      acc >>= 32;
-    }
-}
-
-static void
-add288 (uint32_t *h, const uint32_t *c)
-{
-  uint64_t acc = 0;
-  for (unsigned int i = 0; i < 9; ++i)
-    {
-      acc += (uint64_t)h[i] + (uint64_t)c[i];
-      h[i] = acc & 0xffffffff;
-      acc >>= 32;
+      accumulator += (uint64_t)h[i];
+      h[i] = accumulator & 0xffffffff;
+      accumulator >>= 32;
+      ++i;
     }
 }
 
 static void
 mult256 (const uint32_t *a, const uint32_t *b, uint32_t *out)
 {
-  uint32_t cache[16][9];
-  for (unsigned int i = 0; i < 8; ++i)
-    {
-      cache[0][i] = 0x0;
-      cache[1][i] = a[i];
-      cache[2][i] = a[i];
-      cache[3][i] = a[i];
-      cache[4][i] = a[i];
-      cache[5][i] = a[i];
-      cache[6][i] = a[i];
-      cache[7][i] = a[i];
-      cache[8][i] = a[i];
-      cache[9][i] = a[i];
-      cache[10][i] = a[i];
-      cache[11][i] = a[i];
-      cache[12][i] = a[i];
-      cache[13][i] = a[i];
-      cache[14][i] = a[i];
-      cache[15][i] = a[i];
-      out[i] = 0x0;
-    }
-  cache[0][8] = 0x0;
-  cache[1][8] = 0x0;
-  cache[2][8] = 0x0;
-  cache[3][8] = 0x0;
-  cache[4][8] = 0x0;
-  cache[5][8] = 0x0;
-  cache[6][8] = 0x0;
-  cache[7][8] = 0x0;
-  cache[8][8] = 0x0;
-  cache[9][8] = 0x0;
-  cache[10][8] = 0x0;
-  cache[11][8] = 0x0;
-  cache[12][8] = 0x0;
-  cache[13][8] = 0x0;
-  cache[14][8] = 0x0;
-  cache[15][8] = 0x0;
-  for (unsigned int i = 8; i < 16; ++i)
+  // Literal long multiplication
+  for (unsigned int i = 0; i < 16; ++i)
     {
       out[i] = 0x0;
     }
-  for (unsigned int i = 1; i < 16; ++i)
+  for (unsigned int i = 0; i < 8; ++i)
     {
-      add288 (cache[i], cache[i - 1]);
-    }
-  for (unsigned int i = 0; i < 64; ++i)
-    {
-      uint8_t ind = (b[i / 8] >> (4 * (i % 8))) & 0xf;
-      add_shifted (out, cache[ind], 4 * i);
+      for (unsigned int j = 0; j < 8; ++j)
+        {
+          uint64_t prod = (uint64_t)a[i] * (uint64_t)b[j];
+          add_shifted (out, prod, i + j);
+        }
     }
 }