@@ -220,95 +220,47 @@ void secp256k1_fe_sqr_inner(uint64_t *r, const uint64_t *a);
220
220
} while(0)
221
221
222
222
/* Add a**2 to [c0,c1]. c0,c1 must all be 0 on input. */
223
- #define sqr2 (c0 ,c1 ,a ) do {\
224
- uint128_t t = (uint128_t)(a) * (a); \
225
- VERIFY_CHECK(c0 == 0); \
226
- VERIFY_CHECK(c1 == 0); \
227
- c0 = t; \
228
- c1 = t >> 64; \
229
- } while(0)
223
+ #define sqr2 (c0 ,c1 ,a ) mul2(c0,c1,a,a)
230
224
231
225
/* Add a*b to [c0,c1,c2]. c2 must never overflow. */
232
226
#define muladd3 (c0 ,c1 ,c2 ,a ,b ) do {\
233
- uint64_t tl, th; \
234
- { \
235
- uint128_t t = (uint128_t)(a) * (b); \
236
- th = t >> 64; /* at most 0xFFFFFFFFFFFFFFFE */ \
237
- tl = t ; \
238
- } \
239
- c0 += tl ; /* overflow is handled on the next line */ \
240
- th += (c0 < tl ); /* at most 0xFFFFFFFFFFFFFFFF */ \
241
- c1 += th ; /* overflow is handled on the next line */ \
242
- c2 += (c1 < th ); /* never overflows by contract (verified in the next line) */ \
243
- VERIFY_CHECK ((c1 >= th ) || (c2 != 0 )); \
227
+ uint128_t t = (uint128_t)(a) * (b); \
228
+ uint128_t acc = (uint128_t)c0 + (t & 0xffffffffffffffff); \
229
+ c0 = (uint64_t)acc; acc >>= 64; \
230
+ acc += c1; acc += (t >> 64); \
231
+ c1 = (uint64_t)acc; acc >>= 64; \
232
+ acc += c2; \
233
+ c2 = (uint64_t)acc; acc >>= 64; \
234
+ VERIFY_CHECK(acc == 0); \
244
235
} while(0)
245
236
246
237
/* Add a**2 to [c0,c1,c2]. c2 must never overflow. */
247
- #define sqradd3 (c0 ,c1 ,c2 ,a ) do {\
248
- uint64_t tl, th; \
249
- { \
250
- uint128_t t = (uint128_t)(a) * (a); \
251
- th = t >> 64; /* at most 0xFFFFFFFFFFFFFFFE */ \
252
- tl = t ; \
253
- } \
254
- c0 += tl ; /* overflow is handled on the next line */ \
255
- th += (c0 < tl ); /* at most 0xFFFFFFFFFFFFFFFF */ \
256
- c1 += th ; /* overflow is handled on the next line */ \
257
- c2 += (c1 < th ); /* never overflows by contract (verified in the next line) */ \
258
- VERIFY_CHECK ((c1 >= th ) || (c2 != 0 )); \
259
- } while (0 )
238
+ #define sqradd3 (c0 ,c1 ,c2 ,a ) muladd3(c0,c1,c2,a,a)
260
239
261
240
/* Add 2*a*b to [c0,c1,c2]. c2 must never overflow. */
262
241
#define mul2add3 (c0 ,c1 ,c2 ,a ,b ) do {\
263
- uint64_t tl, th, th2, tl2; \
264
- { \
265
- uint128_t t = (uint128_t)(a) * (b); \
266
- th = t >> 64; /* at most 0xFFFFFFFFFFFFFFFE */ \
267
- tl = t ; \
268
- } \
269
- th2 = th + th ; /* at most 0xFFFFFFFFFFFFFFFE (in case th was 0x7FFFFFFFFFFFFFFF) */ \
270
- c2 += (th2 < th ); /* never overflows by contract (verified the next line) */ \
271
- VERIFY_CHECK ((th2 >= th ) || (c2 != 0 )); \
272
- tl2 = tl + tl ; /* at most 0xFFFFFFFFFFFFFFFE (in case the lowest 63 bits of tl were 0x7FFFFFFFFFFFFFFF) */ \
273
- th2 += (tl2 < tl ); /* at most 0xFFFFFFFFFFFFFFFF */ \
274
- c0 += tl2 ; /* overflow is handled on the next line */ \
275
- th2 += (c0 < tl2 ); /* second overflow is handled on the next line */ \
276
- c2 += (c0 < tl2 ) & (th2 == 0 ); /* never overflows by contract (verified the next line) */ \
277
- VERIFY_CHECK ((c0 >= tl2 ) || (th2 != 0 ) || (c2 != 0 )); \
278
- c1 += th2 ; /* overflow is handled on the next line */ \
279
- c2 += (c1 < th2 ); /* never overflows by contract (verified the next line) */ \
280
- VERIFY_CHECK ((c1 >= th2 ) || (c2 != 0 )); \
242
+ uint128_t t = (uint128_t)(a) * (b); \
243
+ uint128_t acc = (uint128_t)c0 + (t & 0xffffffffffffffff) + (t & 0xffffffffffffffff); \
244
+ c0 = (uint64_t)acc; acc >>= 64; \
245
+ acc += c1; acc += (t >> 64); acc += (t >> 64); \
246
+ c1 = (uint64_t)acc; acc >>= 64; \
247
+ acc += c2; \
248
+ c2 = (uint64_t)acc; acc >>= 64; \
249
+ VERIFY_CHECK(acc == 0); \
281
250
} while(0)
282
251
283
252
/* Add a*b to [c0,c1]. c1 must never overflow. */
284
253
#define muladd2 (c0 ,c1 ,a ,b ) do {\
285
- uint64_t tl, th; \
286
- ON_VERIFY(uint64_t old_c1 = c1;) \
287
- { \
288
- uint128_t t = (uint128_t)(a) * (b); \
289
- th = t >> 64; /* at most 0xFFFFFFFFFFFFFFFE */ \
290
- tl = t ; \
291
- } \
292
- c0 += tl ; /* overflow is handled on the next line */ \
293
- th += (c0 < tl ); /* at most 0xFFFFFFFFFFFFFFFF */ \
294
- c1 += th ; /* overflow is handled on the next line */ \
295
- ON_VERIFY (VERIFY_CHECK (c1 >= old_c1 );) \
254
+ uint128_t t = (uint128_t)(a) * (b); \
255
+ uint128_t acc = (uint128_t)c0 + (t & 0xffffffffffffffff); \
256
+ c0 = (uint64_t)acc; acc >>= 64; \
257
+ acc += c1; acc += (t >> 64); \
258
+ c1 = (uint64_t)acc; acc >>= 64; \
259
+ VERIFY_CHECK(acc == 0); \
296
260
} while(0)
297
261
298
262
/* Add a**2 to [c0,c1. c1 must never overflow. */
299
- #define sqradd2 (c0 ,c1 ,a ) do {\
300
- uint64_t tl, th; \
301
- ON_VERIFY(uint64_t old_c1 = c1;) \
302
- { \
303
- uint128_t t = (uint128_t)(a) * (a); \
304
- th = t >> 64; /* at most 0xFFFFFFFFFFFFFFFE */ \
305
- tl = t ; \
306
- } \
307
- c0 += tl ; /* overflow is handled on the next line */ \
308
- th += (c0 < tl ); /* at most 0xFFFFFFFFFFFFFFFF */ \
309
- c1 += th ; /* overflow is handled on the next line */ \
310
- ON_VERIFY (VERIFY_CHECK (c1 >= old_c1 );) \
311
- } while (0 )
263
+ #define sqradd2 (c0 ,c1 ,a ) muladd2(c0,c1,a,a)
312
264
313
265
/* Add [a0,a1,a2,a3,a4] t0 [c0,c1,c2,c3,c4]. C4 cannot overflow. */
314
266
#define add5x5 (c0 ,c1 ,c2 ,c3 ,c4 ,a0 ,a1 ,a2 ,a3 ,a4 ) do {\
@@ -350,7 +302,6 @@ void secp256k1_fe_sqr_inner(uint64_t *r, const uint64_t *a);
350
302
c3 = tmp; \
351
303
} while(0)
352
304
353
-
354
305
/* Add a to [c0,c1,c2]. c2 must never overflow. */
355
306
#define add3 (c0 ,c1 ,c2 ,a ) do {\
356
307
uint128_t tmp = (uint128_t)c0 + (a); \
0 commit comments