| /* |
| Licensed to the Apache Software Foundation (ASF) under one |
| or more contributor license agreements. See the NOTICE file |
| distributed with this work for additional information |
| regarding copyright ownership. The ASF licenses this file |
| to you under the Apache License, Version 2.0 (the |
| "License"); you may not use this file except in compliance |
| with the License. You may obtain a copy of the License at |
| |
| http://www.apache.org/licenses/LICENSE-2.0 |
| |
| Unless required by applicable law or agreed to in writing, |
| software distributed under the License is distributed on an |
| "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| KIND, either express or implied. See the License for the |
| specific language governing permissions and limitations |
| under the License. |
| */ |
| |
| /* AMCL BN Curve pairing functions */ |
| |
| //#define HAS_MAIN |
| |
| #include "amcl.h" |
| |
| /* Line function */ |
| static void PAIR_line(FP12 *v,ECP2 *A,ECP2 *B,BIG Qx,BIG Qy) |
| { |
| ECP2 P; |
| FP2 Z3,X,Y,ZZ,T,NY; |
| FP4 a,b,c; |
| int D; |
| ECP2_copy(&P,A); |
| if (A==B) |
| D=ECP2_dbl(A); // check these return numbers... |
| else |
| D=ECP2_add(A,B); |
| if (D<0) |
| { |
| /* Infinity */ |
| FP12_one(v); |
| return; |
| } |
| |
| FP2_copy(&Z3,&(A->z)); |
| FP4_zero(&c); |
| FP2_sqr(&ZZ,&(P.z)); /* ZZ=Z^2 */ |
| if (D==0) |
| { |
| /* addition */ |
| ECP2_get(&X,&Y,B); |
| FP2_mul(&T,&(P.z),&Y); /* T=Z*Y2 */ |
| |
| FP2_mul(&ZZ,&ZZ,&T); |
| |
| FP2_neg(&NY,&(P.y)); |
| FP2_add(&ZZ,&ZZ,&NY); /* ZZ=Z^3*Y2-Y (slope numerator) */ |
| FP2_pmul(&Z3,&Z3,Qy); /* Z3*Qy */ |
| FP2_mul(&T,&T,&(P.x)); |
| FP2_mul(&X,&X,&NY); |
| FP2_add(&T,&T,&X); /* Z*Y2*X-X2*Y */ |
| FP4_from_FP2s(&a,&Z3,&T); /* a=[Z3*Qy,Z*Y2*X-X2*Y] */ |
| FP2_neg(&ZZ,&ZZ); |
| FP2_pmul(&ZZ,&ZZ,Qx); |
| FP4_from_FP2(&b,&ZZ); /* b=-slope*Qx */ |
| } |
| else |
| { |
| /* doubling */ |
| FP2_sqr(&T,&(P.x)); |
| FP2_imul(&T,&T,3); /* T=3X^2 (slope numerator) */ |
| FP2_sqr(&Y,&(P.y)); |
| |
| FP2_add(&Y,&Y,&Y); /* Y=2Y^2 */ |
| FP2_mul(&Z3,&Z3,&ZZ); /* Z3=Z3*ZZ */ |
| FP2_pmul(&Z3,&Z3,Qy); /* Z3=Z3*ZZ*Qy */ |
| |
| FP2_mul(&X,&(P.x),&T); |
| FP2_sub(&X,&X,&Y); /* X=X*slope-2Y^2 */ |
| FP4_from_FP2s(&a,&Z3,&X); /* a=[Z3*ZZ*Qy , X*slope-2Y^2] */ |
| FP2_neg(&T,&T); |
| FP2_mul(&ZZ,&ZZ,&T); |
| FP2_pmul(&ZZ,&ZZ,Qx); |
| FP4_from_FP2(&b,&ZZ); /* b=-slope*ZZ*Qx */ |
| } |
| |
| FP12_from_FP4s(v,&a,&b,&c); |
| } |
| |
| /* Optimal R-ate pairing r=e(P,Q) */ |
| void PAIR_ate(FP12 *r,ECP2 *P,ECP *Q) |
| { |
| FP2 X; |
| BIG x,n,Qx,Qy; |
| int i,nb; |
| ECP2 A; |
| FP12 lv; |
| #if CHOICE<BLS_CURVES |
| ECP2 KA; |
| #endif |
| |
| BIG_rcopy(Qx,CURVE_Fra); |
| BIG_rcopy(Qy,CURVE_Frb); |
| FP2_from_BIGs(&X,Qx,Qy); |
| |
| BIG_rcopy(x,CURVE_Bnx); |
| |
| #if CHOICE<BLS_CURVES |
| BIG_pmul(n,x,6); |
| BIG_dec(n,2); |
| #else |
| BIG_copy(n,x); |
| #endif |
| |
| BIG_norm(n); |
| |
| ECP2_affine(P); |
| ECP_affine(Q); |
| |
| BIG_copy(Qx,Q->x); |
| BIG_copy(Qy,Q->y); |
| |
| ECP2_copy(&A,P); |
| FP12_one(r); |
| nb=BIG_nbits(n); |
| |
| /* Main Miller Loop */ |
| for (i=nb-2; i>=1; i--) |
| { |
| PAIR_line(&lv,&A,&A,Qx,Qy); |
| FP12_smul(r,&lv); |
| if (BIG_bit(n,i)) |
| { |
| |
| PAIR_line(&lv,&A,P,Qx,Qy); |
| FP12_smul(r,&lv); |
| } |
| FP12_sqr(r,r); |
| } |
| |
| PAIR_line(&lv,&A,&A,Qx,Qy); |
| FP12_smul(r,&lv); |
| |
| if (BIG_parity(n)) |
| { |
| PAIR_line(&lv,&A,P,Qx,Qy); |
| FP12_smul(r,&lv); |
| } |
| |
| /* R-ate fixup required for BN curves */ |
| #if CHOICE<BLS_CURVES |
| ECP2_copy(&KA,P); |
| ECP2_frob(&KA,&X); |
| |
| ECP2_neg(&A); |
| FP12_conj(r,r); |
| |
| PAIR_line(&lv,&A,&KA,Qx,Qy); |
| FP12_smul(r,&lv); |
| ECP2_frob(&KA,&X); |
| ECP2_neg(&KA); |
| PAIR_line(&lv,&A,&KA,Qx,Qy); |
| FP12_smul(r,&lv); |
| #endif |
| } |
| |
| /* Optimal R-ate double pairing e(P,Q).e(R,S) */ |
| void PAIR_double_ate(FP12 *r,ECP2 *P,ECP *Q,ECP2 *R,ECP *S) |
| { |
| FP2 X; |
| BIG x,n,Qx,Qy,Sx,Sy; |
| int i,nb; |
| ECP2 A,B; |
| FP12 lv; |
| #if CHOICE<BLS_CURVES |
| ECP2 K; |
| #endif |
| BIG_rcopy(Qx,CURVE_Fra); |
| BIG_rcopy(Qy,CURVE_Frb); |
| FP2_from_BIGs(&X,Qx,Qy); |
| |
| BIG_rcopy(x,CURVE_Bnx); |
| |
| #if CHOICE<BLS_CURVES |
| BIG_pmul(n,x,6); |
| BIG_dec(n,2); |
| #else |
| BIG_copy(n,x); |
| #endif |
| |
| BIG_norm(n); |
| |
| ECP2_affine(P); |
| ECP_affine(Q); |
| |
| ECP2_affine(R); |
| ECP_affine(S); |
| |
| BIG_copy(Qx,Q->x); |
| BIG_copy(Qy,Q->y); |
| |
| BIG_copy(Sx,S->x); |
| BIG_copy(Sy,S->y); |
| |
| ECP2_copy(&A,P); |
| ECP2_copy(&B,R); |
| FP12_one(r); |
| nb=BIG_nbits(n); |
| |
| /* Main Miller Loop */ |
| for (i=nb-2; i>=1; i--) |
| { |
| PAIR_line(&lv,&A,&A,Qx,Qy); |
| FP12_smul(r,&lv); |
| PAIR_line(&lv,&B,&B,Sx,Sy); |
| FP12_smul(r,&lv); |
| |
| if (BIG_bit(n,i)) |
| { |
| PAIR_line(&lv,&A,P,Qx,Qy); |
| FP12_smul(r,&lv); |
| |
| PAIR_line(&lv,&B,R,Sx,Sy); |
| FP12_smul(r,&lv); |
| } |
| FP12_sqr(r,r); |
| } |
| |
| PAIR_line(&lv,&A,&A,Qx,Qy); |
| FP12_smul(r,&lv); |
| |
| PAIR_line(&lv,&B,&B,Sx,Sy); |
| FP12_smul(r,&lv); |
| |
| if (BIG_parity(n)) |
| { |
| PAIR_line(&lv,&A,P,Qx,Qy); |
| FP12_smul(r,&lv); |
| |
| PAIR_line(&lv,&B,R,Sx,Sy); |
| FP12_smul(r,&lv); |
| } |
| |
| /* R-ate fixup required for BN curves */ |
| #if CHOICE<BLS_CURVES |
| FP12_conj(r,r); |
| |
| ECP2_copy(&K,P); |
| ECP2_frob(&K,&X); |
| ECP2_neg(&A); |
| PAIR_line(&lv,&A,&K,Qx,Qy); |
| FP12_smul(r,&lv); |
| ECP2_frob(&K,&X); |
| ECP2_neg(&K); |
| PAIR_line(&lv,&A,&K,Qx,Qy); |
| FP12_smul(r,&lv); |
| |
| ECP2_copy(&K,R); |
| ECP2_frob(&K,&X); |
| ECP2_neg(&B); |
| PAIR_line(&lv,&B,&K,Sx,Sy); |
| FP12_smul(r,&lv); |
| ECP2_frob(&K,&X); |
| ECP2_neg(&K); |
| PAIR_line(&lv,&B,&K,Sx,Sy); |
| FP12_smul(r,&lv); |
| #endif |
| } |
| |
| /* final exponentiation - keep separate for multi-pairings and to avoid thrashing stack */ |
| void PAIR_fexp(FP12 *r) |
| { |
| FP2 X; |
| BIG x,a,b; |
| FP12 t0,y0,y1,y2,y3; |
| |
| BIG_rcopy(x,CURVE_Bnx); |
| BIG_rcopy(a,CURVE_Fra); |
| BIG_rcopy(b,CURVE_Frb); |
| FP2_from_BIGs(&X,a,b); |
| |
| /* Easy part of final exp */ |
| |
| FP12_inv(&t0,r); |
| FP12_conj(r,r); |
| |
| FP12_mul(r,&t0); |
| FP12_copy(&t0,r); |
| |
| FP12_frob(r,&X); |
| FP12_frob(r,&X); |
| FP12_mul(r,&t0); |
| |
| /* Hard part of final exp - see Duquesne & Ghamman eprint 2015/192.pdf */ |
| #if CHOICE<BLS_CURVES |
| FP12_pow(&t0,r,x); // t0=f^-u |
| FP12_usqr(&y3,&t0); // y3=t0^2 |
| FP12_copy(&y0,&t0); |
| FP12_mul(&y0,&y3); // y0=t0*y3 |
| FP12_copy(&y2,&y3); |
| FP12_frob(&y2,&X); // y2=y3^p |
| FP12_mul(&y2,&y3); //y2=y2*y3 |
| FP12_usqr(&y2,&y2); //y2=y2^2 |
| FP12_mul(&y2,&y3); // y2=y2*y3 |
| |
| FP12_pow(&t0,&y0,x); //t0=y0^-u |
| FP12_conj(&y0,r); //y0=~r |
| FP12_copy(&y1,&t0); |
| FP12_frob(&y1,&X); |
| FP12_frob(&y1,&X); //y1=t0^p^2 |
| FP12_mul(&y1,&y0); // y1=y0*y1 |
| FP12_conj(&t0,&t0); // t0=~t0 |
| FP12_copy(&y3,&t0); |
| FP12_frob(&y3,&X); //y3=t0^p |
| FP12_mul(&y3,&t0); // y3=t0*y3 |
| FP12_usqr(&t0,&t0); // t0=t0^2 |
| FP12_mul(&y1,&t0); // y1=t0*y1 |
| |
| FP12_pow(&t0,&y3,x); // t0=y3^-u |
| FP12_usqr(&t0,&t0); //t0=t0^2 |
| FP12_conj(&t0,&t0); //t0=~t0 |
| FP12_mul(&y3,&t0); // y3=t0*y3 |
| |
| FP12_frob(r,&X); |
| FP12_copy(&y0,r); |
| FP12_frob(r,&X); |
| FP12_mul(&y0,r); |
| FP12_frob(r,&X); |
| FP12_mul(&y0,r); |
| |
| FP12_usqr(r,&y3); //r=y3^2 |
| FP12_mul(r,&y2); //r=y2*r |
| FP12_copy(&y3,r); |
| FP12_mul(&y3,&y0); // y3=r*y0 |
| FP12_mul(r,&y1); // r=r*y1 |
| FP12_usqr(r,r); // r=r^2 |
| FP12_mul(r,&y3); // r=r*y3 |
| FP12_reduce(r); |
| #else |
| // Ghamman & Fouotsa Method |
| |
| FP12_usqr(&y0,r); |
| FP12_pow(&y1,&y0,x); |
| BIG_fshr(x,1); |
| FP12_pow(&y2,&y1,x); |
| BIG_fshl(x,1); // x must be even |
| FP12_conj(&y3,r); |
| FP12_mul(&y1,&y3); |
| |
| FP12_conj(&y1,&y1); |
| FP12_mul(&y1,&y2); |
| |
| FP12_pow(&y2,&y1,x); |
| |
| FP12_pow(&y3,&y2,x); |
| FP12_conj(&y1,&y1); |
| FP12_mul(&y3,&y1); |
| |
| FP12_conj(&y1,&y1); |
| FP12_frob(&y1,&X); |
| FP12_frob(&y1,&X); |
| FP12_frob(&y1,&X); |
| FP12_frob(&y2,&X); |
| FP12_frob(&y2,&X); |
| FP12_mul(&y1,&y2); |
| |
| FP12_pow(&y2,&y3,x); |
| FP12_mul(&y2,&y0); |
| FP12_mul(&y2,r); |
| |
| FP12_mul(&y1,&y2); |
| FP12_copy(&y2,&y3); |
| FP12_frob(&y2,&X); |
| FP12_mul(&y1,&y2); |
| FP12_copy(r,&y1); |
| FP12_reduce(r); |
| |
| // Aranha et al method as described by Ghamman & Fouotsa |
| /* |
| FP12_usqr(&y0,r); // t0=f^2 |
| FP12_conj(&y3,&y0); // t0=f^-2 |
| FP12_pow(&t0,r,x); // t5=f^u |
| FP12_usqr(&y1,&t0); // t1=t5^2 |
| FP12_mul(&y3,&t0); // t3=t0*t5 |
| |
| FP12_pow(&y0,&y3,x); |
| |
| FP12_pow(&y2,&y0,x); |
| |
| FP12_pow(&y4,&y2,x); |
| |
| FP12_mul(&y4,&y1); |
| FP12_pow(&y1,&y4,x); |
| FP12_conj(&y3,&y3); |
| FP12_mul(&y1,&y3); |
| FP12_mul(&y1,r); |
| |
| FP12_conj(&y3,r); |
| FP12_mul(&y0,r); |
| FP12_frob(&y0,&X); FP12_frob(&y0,&X); FP12_frob(&y0,&X); |
| |
| FP12_mul(&y4,&y3); |
| FP12_frob(&y4,&X); |
| |
| FP12_mul(&t0,&y2); |
| FP12_frob(&t0,&X); FP12_frob(&t0,&X); |
| |
| FP12_mul(&t0,&y0); |
| FP12_mul(&t0,&y4); |
| FP12_mul(&t0,&y1); |
| FP12_copy(r,&t0); |
| FP12_reduce(r);*/ |
| |
| //----------------------------------- |
| /* |
| FP12_copy(&y0,r); // y0=r; |
| FP12_copy(&y1,r); // y1=r; |
| FP12_copy(&t0,r); FP12_frob(&t0,&X); // t0=Frobenius(r,X,1); |
| FP12_conj(&y3,&t0); FP12_mul(&y1,&y3); // y1*=inverse(t0); |
| FP12_frob(&t0,&X); FP12_frob(&t0,&X); // t0=Frobenius(t0,X,2); |
| FP12_mul(&y1,&t0); // y1*=t0; |
| |
| FP12_pow(r,r,x); // r=pow(r,x); |
| FP12_conj(&y3,r); FP12_mul(&y1,&y3); // y1*=inverse(r); |
| FP12_copy(&t0,r); FP12_frob(&t0,&X); // t0=Frobenius(r,X,1); |
| FP12_mul(&y0,&t0); // y0*=t0; |
| FP12_frob(&t0,&X); // t0=Frobenius(t0,X,1); |
| FP12_mul(&y1,&t0); // y1*=t0; |
| FP12_frob(&t0,&X); // t0=Frobenius(t0,X,1); |
| FP12_conj(&y3,&t0); FP12_mul(&y0,&y3); // y0*=inverse(t0); |
| |
| FP12_pow(r,r,x); // r=pow(r,x); |
| FP12_mul(&y0,r); // y0*=r; |
| FP12_copy(&t0,r); FP12_frob(&t0,&X); FP12_frob(&t0,&X); // t0=Frobenius(r,X,2); |
| FP12_conj(&y3,&t0); FP12_mul(&y0,&y3); // y0*=inverse(t0); |
| FP12_frob(&t0,&X); // t0=Frobenius(t0,X,1); |
| FP12_mul(&y1,&t0); // y1*=t0; |
| |
| FP12_pow(r,r,x); // r=pow(r,x); // r^x3 |
| FP12_copy(&t0,r); FP12_frob(&t0,&X); // t0=Frobenius(r,X,1); |
| FP12_conj(&y3,&t0); FP12_mul(&y0,&y3); // y0*=inverse(t0); |
| FP12_frob(&t0,&X); // t0=Frobenius(t0,X,1); |
| FP12_mul(&y1,&t0); // y1*=t0; |
| |
| FP12_pow(r,r,x); // r=pow(r,x); // r^x4 |
| FP12_conj(&y3,r); FP12_mul(&y0,&y3); // y0*=inverse(r); |
| FP12_copy(&t0,r); FP12_frob(&t0,&X); // t0=Frobenius(r,X,1); |
| FP12_mul(&y1,&t0); //y1*=t0; |
| |
| FP12_pow(r,r,x); // r=pow(r,x); // r^x5 |
| FP12_mul(&y1,r); // y1*=r; |
| |
| FP12_usqr(&y0,&y0); // r=y0*y0*y1; |
| FP12_mul(&y0,&y1); |
| FP12_copy(r,&y0); |
| FP12_reduce(r); */ |
| #endif |
| } |
| |
| #ifdef USE_GLV |
| /* GLV method */ |
| static void glv(BIG u[2],BIG e) |
| { |
| #if CHOICE<BLS_CURVES |
| int i,j; |
| BIG v[2],t,q; |
| DBIG d; |
| BIG_rcopy(q,CURVE_Order); |
| for (i=0; i<2; i++) |
| { |
| BIG_rcopy(t,CURVE_W[i]); |
| //BIG_norm(t); BIG_norm(e); |
| BIG_mul(d,t,e); |
| BIG_ddiv(v[i],d,q); |
| BIG_zero(u[i]); |
| } |
| BIG_copy(u[0],e); |
| for (i=0; i<2; i++) |
| for (j=0; j<2; j++) |
| { |
| BIG_rcopy(t,CURVE_SB[j][i]); |
| BIG_modmul(t,v[j],t,q); |
| BIG_add(u[i],u[i],q); |
| BIG_sub(u[i],u[i],t); |
| BIG_mod(u[i],q); |
| } |
| |
| #else |
| // -(x^2).P = (Beta.x,y) |
| |
| BIG x,x2,q; |
| BIG_rcopy(x,CURVE_Bnx); |
| BIG_smul(x2,x,x); |
| BIG_copy(u[0],e); |
| BIG_mod(u[0],x2); |
| BIG_copy(u[1],e); |
| BIG_sdiv(u[1],x2); |
| |
| BIG_rcopy(q,CURVE_Order); |
| BIG_sub(u[1],q,u[1]); |
| |
| #endif |
| |
| return; |
| } |
| #endif // USE_GLV |
| |
| /* Galbraith & Scott Method */ |
| static void gs(BIG u[4],BIG e) |
| { |
| int i; |
| #if CHOICE<BLS_CURVES |
| int j; |
| BIG v[4],t,q; |
| DBIG d; |
| BIG_rcopy(q,CURVE_Order); |
| for (i=0; i<4; i++) |
| { |
| BIG_rcopy(t,CURVE_WB[i]); |
| //BIG_norm(t); BIG_norm(e); |
| BIG_mul(d,t,e); |
| BIG_ddiv(v[i],d,q); |
| BIG_zero(u[i]); |
| } |
| |
| BIG_copy(u[0],e); |
| for (i=0; i<4; i++) |
| for (j=0; j<4; j++) |
| { |
| BIG_rcopy(t,CURVE_BB[j][i]); |
| BIG_modmul(t,v[j],t,q); |
| BIG_add(u[i],u[i],q); |
| BIG_sub(u[i],u[i],t); |
| BIG_mod(u[i],q); |
| } |
| |
| #else |
| |
| BIG x,w; |
| BIG_rcopy(x,CURVE_Bnx); |
| BIG_copy(w,e); |
| |
| for (i=0; i<4; i++) |
| { |
| BIG_copy(u[i],w); |
| BIG_mod(u[i],x); |
| BIG_sdiv(w,x); |
| } |
| |
| #endif |
| return; |
| } |
| |
| /* Multiply P by e in group G1 */ |
| void PAIR_G1mul(ECP *P,BIG e) |
| { |
| #ifdef USE_GLV /* Note this method is patented */ |
| int np,nn; |
| ECP Q; |
| BIG cru,t,q; |
| BIG u[2]; |
| |
| BIG_rcopy(q,CURVE_Order); |
| glv(u,e); |
| |
| ECP_affine(P); |
| ECP_copy(&Q,P); |
| BIG_rcopy(cru,CURVE_Cru); |
| FP_nres(cru); |
| FP_mul(Q.x,Q.x,cru); |
| |
| /* note that -a.B = a.(-B). Use a or -a depending on which is smaller */ |
| |
| np=BIG_nbits(u[0]); |
| BIG_modneg(t,u[0],q); |
| nn=BIG_nbits(t); |
| if (nn<np) |
| { |
| BIG_copy(u[0],t); |
| ECP_neg(P); |
| } |
| |
| np=BIG_nbits(u[1]); |
| BIG_modneg(t,u[1],q); |
| nn=BIG_nbits(t); |
| if (nn<np) |
| { |
| BIG_copy(u[1],t); |
| ECP_neg(&Q); |
| } |
| |
| ECP_mul2(P,&Q,u[0],u[1]); |
| |
| #else |
| ECP_mul(P,e); |
| #endif |
| } |
| |
| /* Multiply P by e in group G2 */ |
| void PAIR_G2mul(ECP2 *P,BIG e) |
| { |
| #ifdef USE_GS_G2 /* Well I didn't patent it :) */ |
| int i,np,nn; |
| ECP2 Q[4]; |
| FP2 X; |
| BIG x,y; |
| BIG u[4]; |
| |
| BIG_rcopy(x,CURVE_Fra); |
| BIG_rcopy(y,CURVE_Frb); |
| FP2_from_BIGs(&X,x,y); |
| |
| BIG_rcopy(y,CURVE_Order); |
| gs(u,e); |
| |
| |
| ECP2_affine(P); |
| |
| ECP2_copy(&Q[0],P); |
| for (i=1; i<4; i++) |
| { |
| ECP2_copy(&Q[i],&Q[i-1]); |
| ECP2_frob(&Q[i],&X); |
| } |
| |
| for (i=0; i<4; i++) |
| { |
| np=BIG_nbits(u[i]); |
| BIG_modneg(x,u[i],y); |
| nn=BIG_nbits(x); |
| if (nn<np) |
| { |
| BIG_copy(u[i],x); |
| ECP2_neg(&Q[i]); |
| } |
| } |
| |
| ECP2_mul4(P,Q,u); |
| |
| #else |
| ECP2_mul(P,e); |
| #endif |
| } |
| |
| /* f=f^e */ |
| void PAIR_GTpow(FP12 *f,BIG e) |
| { |
| #ifdef USE_GS_GT /* Note that this option requires a lot of RAM! Maybe better to use compressed XTR method, see fp4.c */ |
| int i,np,nn; |
| FP12 g[4]; |
| FP2 X; |
| BIG t,q,x,y; |
| BIG u[4]; |
| |
| BIG_rcopy(x,CURVE_Fra); |
| BIG_rcopy(y,CURVE_Frb); |
| FP2_from_BIGs(&X,x,y); |
| |
| BIG_rcopy(q,CURVE_Order); |
| gs(u,e); |
| |
| FP12_copy(&g[0],f); |
| for (i=1; i<4; i++) |
| { |
| FP12_copy(&g[i],&g[i-1]); |
| FP12_frob(&g[i],&X); |
| } |
| |
| for (i=0; i<4; i++) |
| { |
| np=BIG_nbits(u[i]); |
| BIG_modneg(t,u[i],q); |
| nn=BIG_nbits(t); |
| if (nn<np) |
| { |
| BIG_copy(u[i],t); |
| FP12_conj(&g[i],&g[i]); |
| } |
| } |
| FP12_pow4(f,g,u); |
| |
| #else |
| FP12_pow(f,f,e); |
| #endif |
| } |
| |
| /* test group membership test - no longer needed */ |
| /* with GT-Strong curve, now only check that m!=1, conj(m)*m==1, and m.m^{p^4}=m^{p^2} */ |
| |
| /* |
| int PAIR_GTmember(FP12 *m) |
| { |
| BIG a,b; |
| FP2 X; |
| FP12 r,w; |
| if (FP12_isunity(m)) return 0; |
| FP12_conj(&r,m); |
| FP12_mul(&r,m); |
| if (!FP12_isunity(&r)) return 0; |
| |
| BIG_rcopy(a,CURVE_Fra); |
| BIG_rcopy(b,CURVE_Frb); |
| FP2_from_BIGs(&X,a,b); |
| |
| |
| FP12_copy(&r,m); FP12_frob(&r,&X); FP12_frob(&r,&X); |
| FP12_copy(&w,&r); FP12_frob(&w,&X); FP12_frob(&w,&X); |
| FP12_mul(&w,m); |
| |
| |
| #ifndef GT_STRONG |
| if (!FP12_equals(&w,&r)) return 0; |
| |
| BIG_rcopy(a,CURVE_Bnx); |
| |
| FP12_copy(&r,m); FP12_pow(&w,&r,a); FP12_pow(&w,&w,a); |
| FP12_sqr(&r,&w); FP12_mul(&r,&w); FP12_sqr(&r,&r); |
| |
| FP12_copy(&w,m); FP12_frob(&w,&X); |
| #endif |
| |
| return FP12_equals(&w,&r); |
| } |
| |
| */ |
| |
| |
| #ifdef HAS_MAIN |
| /* |
| #if CHOICE==BN254_T |
| |
| const BIG TEST_Gx={0x18AFF11A,0xF2EF406,0xAF68220,0x171F2E27,0x6BA0959,0x124C50E0,0x450BE27,0x7003EA8,0x8A914}; |
| const BIG TEST_Gy={0x6E010F4,0xA71D07E,0x7ECADA8,0x8260E8E,0x1F79C328,0x17A09412,0xBFAE690,0x1C57CBD1,0x17DF54}; |
| |
| const BIG TEST_Pxa={0x1047D566,0xD83CD71,0x10322E9D,0x991FA93,0xA282C48,0x18AEBEC8,0xCB05850,0x13B4F669,0x21794A}; |
| const BIG TEST_Pxb={0x1E305936,0x16885BF1,0x327060,0xE26F794,0x1547D870,0x1963E5B2,0x1BEBB96C,0x988A33C,0x1A9B47}; |
| const BIG TEST_Pya={0x20FF876,0x4427E67,0x18732211,0xE88E45E,0x174D1A7E,0x17D877ED,0x343AB37,0x97EB453,0xB00D5}; |
| const BIG TEST_Pyb={0x1D746B7B,0x732F4C2,0x122A49B0,0x16267985,0x235DF56,0x10B1E4D,0x14D8F210,0x17A05C3E,0x5ECF8}; |
| |
| #endif |
| |
| #if CHOICE==BN254_T2 |
| |
| const BIG TEST_Gx={0x15488765,0x46790D7,0xD9900A,0x1DFB43F,0x9F2D307,0xC4724E8,0x5678E51,0x15C3E3A7,0x1BEC8E}; |
| const BIG TEST_Gy={0x3D3273C,0x1AFA5FF,0x1880A139,0xACD34DF,0x17493067,0x10FA4103,0x1D4C9766,0x1A73F3DB,0x2D148}; |
| |
| const BIG TEST_Pxa={0xF8DC275,0xAC27FA,0x11815151,0x152691C8,0x5CDEBF1,0x7D5A965,0x1BF70CE3,0x679A1C8,0xD62CF}; |
| const BIG TEST_Pxb={0x1D17D7A8,0x6B28DF4,0x174A0389,0xFE67E5F,0x1FA97A3C,0x7F5F473,0xFFB5146,0x4BC19A5,0x227010}; |
| const BIG TEST_Pya={0x16CC1F90,0x5284627,0x171B91AB,0x11F843B9,0x1D468755,0x67E279C,0x19FE0EF8,0x1A0CAA6B,0x1CC6CB}; |
| const BIG TEST_Pyb={0x1FF0CF2A,0xBC83255,0x6DD6EE8,0xB8B752F,0x13E484EC,0x1809BE81,0x1A648AA1,0x8CEF3F3,0x86EE}; |
| |
| |
| #endif |
| |
| #if CHOICE==BN254 |
| |
| const BIG TEST_Gx={0x14BEC4670E4EB7,0xEA2973860F6861,0x35C14B2FC3C28F,0x4402A0B63B9473,0x2074A81D}; |
| const BIG TEST_Gy={0xC284846631CBEB,0x34A6E8D871B3B,0x89FB94A82B2006,0x87B20038771FC,0x6A41108}; |
| |
| const BIG TEST_Pxa={0xE4A00F52183C77,0x554E02DF4F8354,0xB65EB5CF1C2F89,0x8B71A87BFCFC9,0x49EEDB1}; |
| const BIG TEST_Pxb={0xCFB8FA9AA8845D,0x8A9CC76D966697,0x185BA05BF5EC08,0x76140E87D97226,0x1FB93AB6}; |
| const BIG TEST_Pya={0x3644CC1EDF208A,0xA637FB3FF8E257,0x4453DA2BB9E686,0xD14AD3CDF6A1FE,0xCD04A1E}; |
| const BIG TEST_Pyb={0x71BD7630A43C14,0x1CAA9F14EA264E,0x3C3C2DFC765DEF,0xCF59D1A1A7D6EE,0x11FF7795}; |
| |
| |
| #endif |
| */ |
| int main() |
| { |
| int i; |
| char byt[32]; |
| csprng rng; |
| BIG xa,xb,ya,yb,w,a,b,t1,q,u[2],v[4],m,r; |
| ECP2 P,G; |
| ECP Q,R; |
| FP12 g,gp; |
| FP4 t,c,cp,cpm1,cpm2; |
| FP2 x,y,X; |
| |
| |
| BIG_rcopy(a,CURVE_Fra); |
| BIG_rcopy(b,CURVE_Frb); |
| FP2_from_BIGs(&X,a,b); |
| |
| BIG_rcopy(xa,CURVE_Gx); |
| BIG_rcopy(ya,CURVE_Gy); |
| |
| ECP_set(&Q,xa,ya); |
| if (Q.inf) printf("Failed to set - point not on curve\n"); |
| else printf("G1 set success\n"); |
| |
| printf("Q= "); |
| ECP_output(&Q); |
| printf("\n"); |
| |
| // BIG_rcopy(r,CURVE_Order); BIG_dec(r,7); BIG_norm(r); |
| BIG_rcopy(xa,CURVE_Pxa); |
| BIG_rcopy(xb,CURVE_Pxb); |
| BIG_rcopy(ya,CURVE_Pya); |
| BIG_rcopy(yb,CURVE_Pyb); |
| |
| FP2_from_BIGs(&x,xa,xb); |
| FP2_from_BIGs(&y,ya,yb); |
| |
| ECP2_set(&P,&x,&y); |
| if (P.inf) printf("Failed to set - point not on curve\n"); |
| else printf("G2 set success\n"); |
| |
| printf("P= "); |
| ECP2_output(&P); |
| printf("\n"); |
| |
| for (i=0; i<1000; i++ ) |
| { |
| |
| PAIR_ate(&g,&P,&Q); |
| PAIR_fexp(&g); |
| |
| // PAIR_GTpow(&g,xa); |
| |
| } |
| printf("g= "); |
| FP12_output(&g); |
| printf("\n"); |
| |
| } |
| |
| #endif |
