2  *  Copyright (C) 2017 - This file is part of libecc project
7  *      Jean-Pierre FLORI <jean-pierre.flori@ssi.gouv.fr>
23  *  o out = in1 +/- in2 if cnd is not zero.
36  * in "out" and returning the carry in 'carry' parameter on success. This
38  * returns 0 on success, -1 on error.
61 		       word_t *carry)  in _nn_cnd_add()  argument
68 	MUST_HAVE((carry != NULL), ret, err);  in _nn_cnd_add()
73 	loop_wlen = LOCAL_MAX(in1->wlen, in2->wlen);  in _nn_cnd_add()
80 	/* Perform addition one word at a time, propagating the carry. */  in _nn_cnd_add()
82 		tmp = (word_t)(in1->val[i] + (in2->val[i] & mask));  in _nn_cnd_add()
83 		carry1 = (word_t)(tmp < in1->val[i]);  in _nn_cnd_add()
84 		out->val[i] = (word_t)(tmp + _carry);  in _nn_cnd_add()
85 		carry2 = (word_t)(out->val[i] < tmp);  in _nn_cnd_add()
86 		/* There is at most one carry going out. */  in _nn_cnd_add()
90 	(*carry) = _carry;  in _nn_cnd_add()
98  * in "out", including the potential carry overflowing past the maximal
101  * for instance guaranteed if both in1->wlen and in2->wlen are less than
112  * For finer carry propagation and length control the internal "_nn_cnd_add"
117  * The function returns 0 on success, -1 on error.
121 	word_t carry;  in nn_cnd_add()  local
124 	ret = _nn_cnd_add(cnd, out, in1, in2, &carry); EG(ret, err);  in nn_cnd_add()
126 	/* We cannot allow a non-zero carry if out->wlen is at its limit */  in nn_cnd_add()
127 	MUST_HAVE(((out->wlen != NN_MAX_WORD_LEN) || (!carry)), ret, err);  in nn_cnd_add()
129 	if (out->wlen != NN_MAX_WORD_LEN) {  in nn_cnd_add()
131 		 * To maintain constant time, we perform carry addition in all  in nn_cnd_add()
132 		 * cases. If carry is 0, no change is performed in practice,  in nn_cnd_add()
137 		out->val[out->wlen] = carry;  in nn_cnd_add()
138 		out->wlen = (u8)(out->wlen + carry);  in nn_cnd_add()
147  * including the potential carry overflowing past the maximal length of
148  * 'in1' and 'in2'. The function returns 0 on success, -1 on error.
166  * for instance guaranteed if 'in1' wlen is less than NN_MAX_WORD_LEN). The
167  * function returns 0 on succes, -1 on error.
181 	word_t carry, tmp;  in nn_add_word()  local
188 	n_wlen = in1->wlen;  in nn_add_word()
195 	/* No matter its value, propagate the carry. */  in nn_add_word()
196 	carry = w;  in nn_add_word()
198 		tmp = (word_t)(in1->val[i] + carry);  in nn_add_word()
199 		carry = (word_t)(tmp < in1->val[i]);  in nn_add_word()
200 		out->val[i] = tmp;  in nn_add_word()
203 	MUST_HAVE(((out->wlen != NN_MAX_WORD_LEN) || (!carry)), ret, err);  in nn_add_word()
204 	if (out->wlen != NN_MAX_WORD_LEN) {  in nn_add_word()
206 		 * To maintain constant time, we perform carry addition in all  in nn_add_word()
207 		 * cases. If carry is 0, no change is performed in practice,  in nn_add_word()
212 		out->val[out->wlen] = carry;  in nn_add_word()
213 		out->wlen = (u8)(out->wlen + carry);  in nn_add_word()
224  * less than NN_MAX_WORD_LEN). The function returns 0 on success, -1 on error.
239  *  o out = in1 - in2 if cnd is not zero.
248  * The function returns 0 on success, -1 on error.
261 	loop_wlen = LOCAL_MAX(in1->wlen, in2->wlen);  in nn_cnd_sub()
265 		ret = nn_set_wlen(out, in1->wlen); EG(ret, err);  in nn_cnd_sub()
270 		tmp = (word_t)(in1->val[i] - (in2->val[i] & mask));  in nn_cnd_sub()
271 		borrow1 = (word_t)(tmp > in1->val[i]);  in nn_cnd_sub()
272 		out->val[i] = (word_t)(tmp - borrow);  in nn_cnd_sub()
273 		borrow2 = (word_t)(out->val[i] > tmp);  in nn_cnd_sub()
279 	ret = (borrow != WORD(0)) ? -1 : 0;  in nn_cnd_sub()
292  * Compute out = in1 - 1 where in1 is a *positive* integer. Aliasing is
293  * supported i.e. nn_dec(A, A) works as expected and provides A -= 1.
294  * The function returns 0 on success, -1 on error.
304 	n_wlen = in1->wlen;  in nn_dec()
310 		tmp = (word_t)(in1->val[i] - borrow);  in nn_dec()
311 		borrow = (word_t)(tmp > in1->val[i]);  in nn_dec()
312 		out->val[i] = tmp;  in nn_dec()
315 	ret = (borrow != WORD(0)) ? -1 : 0;  in nn_dec()
334  * Compute out = in1 + in2 mod p. The function returns 0 on success, -1 on
346 	MUST_HAVE((p->wlen < NN_MAX_WORD_LEN), ret, err); /* otherwise carry could overflow */  in _nn_mod_add()
352 	 * If previous addition extends out->wlen, this may have an effect on  in _nn_mod_add()
354 	 * normalize out->wlen to p->wlen + 1. Its length is set to that of  in _nn_mod_add()
357 	 * We could also use _nn_cnd_add to catch the carry and deal  in _nn_mod_add()
360 	 * of in1 and in2 so getting a carry out does not necessarily mean  in _nn_mod_add()
363 	ret = nn_set_wlen(out, (u8)(p->wlen + 1)); EG(ret, err);  in _nn_mod_add()
367 	ret = nn_set_wlen(out, p->wlen);  in _nn_mod_add()
374  * Compute out = in1 + in2 mod p. The function returns 0 on success, -1 on
403  * Compute out = in1 + 1 mod p. The function returns 0 on success, -1 on error.
413 	MUST_HAVE((p->wlen < NN_MAX_WORD_LEN), ret, err); /* otherwise carry could overflow */  in _nn_mod_inc()
417 	ret = nn_set_wlen(out, (u8)(p->wlen + 1)); EG(ret, err); /* see comment in nn_mod_add() */  in _nn_mod_inc()
421 	ret = nn_set_wlen(out, p->wlen);  in _nn_mod_inc()
428  * Compute out = in1 + 1 mod p. The function returns 0 on success, -1 on error.
457  * Compute out = in1 - in2 mod p. The function returns 0 on success, -1 on
472 	MUST_HAVE((p->wlen < NN_MAX_WORD_LEN), ret, err); /* otherwise carry could overflow */  in _nn_mod_sub()
489 	ret = nn_set_wlen(out, (u8)(p->wlen + 1)); EG(ret, err);/* See Comment in nn_mod_add() */  in _nn_mod_sub()
491 	ret = nn_set_wlen(out, p->wlen);  in _nn_mod_sub()
500  * Compute out = in1 - in2 mod p. The function returns 0 on success, -1 on
529  * Compute out = in1 - 1 mod p. The function returns 0 on success, -1 on error
539 	MUST_HAVE((p->wlen < NN_MAX_WORD_LEN), ret, err); /* otherwise carry could overflow */  in _nn_mod_dec()
546 	ret = nn_set_wlen(out, (u8)(p->wlen + 1)); EG(ret, err); /* See Comment in nn_mod_add() */  in _nn_mod_dec()
548 	ret = nn_set_wlen(out, p->wlen);  in _nn_mod_dec()
555  * Compute out = in1 - 1 mod p. The function returns 0 on success, -1 on error
583  * Compute out = -in mod p. The function returns 0 on success, -1 on error.
585  * out = p - in (except when value is 0).