diff --git a/backend/go.mod b/backend/go.mod index 3bcd89b..0d91aae 100644 --- a/backend/go.mod +++ b/backend/go.mod @@ -47,7 +47,6 @@ require ( github.com/charmbracelet/x/ansi v0.8.0 // indirect github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect github.com/charmbracelet/x/term v0.2.1 // indirect - github.com/cloudflare/circl v1.6.1 // indirect github.com/cloudwego/base64x v0.1.4 // indirect github.com/cloudwego/iasm v0.2.0 // indirect github.com/davecgh/go-spew v1.1.1 // indirect @@ -94,7 +93,7 @@ require ( github.com/pelletier/go-toml/v2 v2.2.2 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect github.com/quic-go/qpack v0.5.1 // indirect - github.com/refraction-networking/utls v1.7.0 // indirect + github.com/refraction-networking/utls v1.8.2 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/stretchr/objx v0.5.2 // indirect github.com/twitchyliquid64/golang-asm v0.15.1 // indirect diff --git a/backend/go.sum b/backend/go.sum index 7e1839b..e90a2da 100644 --- a/backend/go.sum +++ b/backend/go.sum @@ -38,8 +38,6 @@ github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0G github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs= github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ= github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg= -github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0= -github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs= github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/0Y= github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w= github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg= @@ -185,8 +183,8 @@ github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg= github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg= github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI= github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg= -github.com/refraction-networking/utls v1.7.0 h1:9JTnze/Md74uS3ZWiRAabityY0un69rOLXsBf8LGgTs= -github.com/refraction-networking/utls v1.7.0/go.mod h1:lV0Gwc1/Fi+HYH8hOtgFRdHfKo4FKSn6+FdyOz9hRms= +github.com/refraction-networking/utls v1.8.2 h1:j4Q1gJj0xngdeH+Ox/qND11aEfhpgoEvV+S9iJ2IdQo= +github.com/refraction-networking/utls v1.8.2/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= diff --git a/backend/vendor/github.com/cloudflare/circl/LICENSE b/backend/vendor/github.com/cloudflare/circl/LICENSE deleted file mode 100644 index 67edaa9..0000000 --- a/backend/vendor/github.com/cloudflare/circl/LICENSE +++ /dev/null @@ -1,57 +0,0 @@ -Copyright (c) 2019 Cloudflare. All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Cloudflare nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -======================================================================== - -Copyright (c) 2009 The Go Authors. All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Google Inc. nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve.go b/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve.go deleted file mode 100644 index f9057c2..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve.go +++ /dev/null @@ -1,96 +0,0 @@ -package x25519 - -import ( - fp "github.com/cloudflare/circl/math/fp25519" -) - -// ladderJoye calculates a fixed-point multiplication with the generator point. -// The algorithm is the right-to-left Joye's ladder as described -// in "How to precompute a ladder" in SAC'2017. -func ladderJoye(k *Key) { - w := [5]fp.Elt{} // [mu,x1,z1,x2,z2] order must be preserved. - fp.SetOne(&w[1]) // x1 = 1 - fp.SetOne(&w[2]) // z1 = 1 - w[3] = fp.Elt{ // x2 = G-S - 0xbd, 0xaa, 0x2f, 0xc8, 0xfe, 0xe1, 0x94, 0x7e, - 0xf8, 0xed, 0xb2, 0x14, 0xae, 0x95, 0xf0, 0xbb, - 0xe2, 0x48, 0x5d, 0x23, 0xb9, 0xa0, 0xc7, 0xad, - 0x34, 0xab, 0x7c, 0xe2, 0xee, 0xcd, 0xae, 0x1e, - } - fp.SetOne(&w[4]) // z2 = 1 - - const n = 255 - const h = 3 - swap := uint(1) - for s := 0; s < n-h; s++ { - i := (s + h) / 8 - j := (s + h) % 8 - bit := uint((k[i] >> uint(j)) & 1) - copy(w[0][:], tableGenerator[s*Size:(s+1)*Size]) - diffAdd(&w, swap^bit) - swap = bit - } - for s := 0; s < h; s++ { - double(&w[1], &w[2]) - } - toAffine((*[fp.Size]byte)(k), &w[1], &w[2]) -} - -// ladderMontgomery calculates a generic scalar point multiplication -// The algorithm implemented is the left-to-right Montgomery's ladder. -func ladderMontgomery(k, xP *Key) { - w := [5]fp.Elt{} // [x1, x2, z2, x3, z3] order must be preserved. - w[0] = *(*fp.Elt)(xP) // x1 = xP - fp.SetOne(&w[1]) // x2 = 1 - w[3] = *(*fp.Elt)(xP) // x3 = xP - fp.SetOne(&w[4]) // z3 = 1 - - move := uint(0) - for s := 255 - 1; s >= 0; s-- { - i := s / 8 - j := s % 8 - bit := uint((k[i] >> uint(j)) & 1) - ladderStep(&w, move^bit) - move = bit - } - toAffine((*[fp.Size]byte)(k), &w[1], &w[2]) -} - -func toAffine(k *[fp.Size]byte, x, z *fp.Elt) { - fp.Inv(z, z) - fp.Mul(x, x, z) - _ = fp.ToBytes(k[:], x) -} - -var lowOrderPoints = [5]fp.Elt{ - { /* (0,_,1) point of order 2 on Curve25519 */ - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - }, - { /* (1,_,1) point of order 4 on Curve25519 */ - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - }, - { /* (x,_,1) first point of order 8 on Curve25519 */ - 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae, - 0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a, - 0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd, - 0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00, - }, - { /* (x,_,1) second point of order 8 on Curve25519 */ - 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24, - 0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b, - 0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86, - 0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57, - }, - { /* (-1,_,1) a point of order 4 on the twist of Curve25519 */ - 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f, - }, -} diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.go b/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.go deleted file mode 100644 index 8a3d54c..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.go +++ /dev/null @@ -1,30 +0,0 @@ -//go:build amd64 && !purego -// +build amd64,!purego - -package x25519 - -import ( - fp "github.com/cloudflare/circl/math/fp25519" - "golang.org/x/sys/cpu" -) - -var hasBmi2Adx = cpu.X86.HasBMI2 && cpu.X86.HasADX - -var _ = hasBmi2Adx - -func double(x, z *fp.Elt) { doubleAmd64(x, z) } -func diffAdd(w *[5]fp.Elt, b uint) { diffAddAmd64(w, b) } -func ladderStep(w *[5]fp.Elt, b uint) { ladderStepAmd64(w, b) } -func mulA24(z, x *fp.Elt) { mulA24Amd64(z, x) } - -//go:noescape -func ladderStepAmd64(w *[5]fp.Elt, b uint) - -//go:noescape -func diffAddAmd64(w *[5]fp.Elt, b uint) - -//go:noescape -func doubleAmd64(x, z *fp.Elt) - -//go:noescape -func mulA24Amd64(z, x *fp.Elt) diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.h b/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.h deleted file mode 100644 index 8c1ae4d..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.h +++ /dev/null @@ -1,111 +0,0 @@ -#define ladderStepLeg \ - addSub(x2,z2) \ - addSub(x3,z3) \ - integerMulLeg(b0,x2,z3) \ - integerMulLeg(b1,x3,z2) \ - reduceFromDoubleLeg(t0,b0) \ - reduceFromDoubleLeg(t1,b1) \ - addSub(t0,t1) \ - cselect(x2,x3,regMove) \ - cselect(z2,z3,regMove) \ - integerSqrLeg(b0,t0) \ - integerSqrLeg(b1,t1) \ - reduceFromDoubleLeg(x3,b0) \ - reduceFromDoubleLeg(z3,b1) \ - integerMulLeg(b0,x1,z3) \ - reduceFromDoubleLeg(z3,b0) \ - integerSqrLeg(b0,x2) \ - integerSqrLeg(b1,z2) \ - reduceFromDoubleLeg(x2,b0) \ - reduceFromDoubleLeg(z2,b1) \ - subtraction(t0,x2,z2) \ - multiplyA24Leg(t1,t0) \ - additionLeg(t1,t1,z2) \ - integerMulLeg(b0,x2,z2) \ - integerMulLeg(b1,t0,t1) \ - reduceFromDoubleLeg(x2,b0) \ - reduceFromDoubleLeg(z2,b1) - -#define ladderStepBmi2Adx \ - addSub(x2,z2) \ - addSub(x3,z3) \ - integerMulAdx(b0,x2,z3) \ - integerMulAdx(b1,x3,z2) \ - reduceFromDoubleAdx(t0,b0) \ - reduceFromDoubleAdx(t1,b1) \ - addSub(t0,t1) \ - cselect(x2,x3,regMove) \ - cselect(z2,z3,regMove) \ - integerSqrAdx(b0,t0) \ - integerSqrAdx(b1,t1) \ - reduceFromDoubleAdx(x3,b0) \ - reduceFromDoubleAdx(z3,b1) \ - integerMulAdx(b0,x1,z3) \ - reduceFromDoubleAdx(z3,b0) \ - integerSqrAdx(b0,x2) \ - integerSqrAdx(b1,z2) \ - reduceFromDoubleAdx(x2,b0) \ - reduceFromDoubleAdx(z2,b1) \ - subtraction(t0,x2,z2) \ - multiplyA24Adx(t1,t0) \ - additionAdx(t1,t1,z2) \ - integerMulAdx(b0,x2,z2) \ - integerMulAdx(b1,t0,t1) \ - reduceFromDoubleAdx(x2,b0) \ - reduceFromDoubleAdx(z2,b1) - -#define difAddLeg \ - addSub(x1,z1) \ - integerMulLeg(b0,z1,ui) \ - reduceFromDoubleLeg(z1,b0) \ - addSub(x1,z1) \ - integerSqrLeg(b0,x1) \ - integerSqrLeg(b1,z1) \ - reduceFromDoubleLeg(x1,b0) \ - reduceFromDoubleLeg(z1,b1) \ - integerMulLeg(b0,x1,z2) \ - integerMulLeg(b1,z1,x2) \ - reduceFromDoubleLeg(x1,b0) \ - reduceFromDoubleLeg(z1,b1) - -#define difAddBmi2Adx \ - addSub(x1,z1) \ - integerMulAdx(b0,z1,ui) \ - reduceFromDoubleAdx(z1,b0) \ - addSub(x1,z1) \ - integerSqrAdx(b0,x1) \ - integerSqrAdx(b1,z1) \ - reduceFromDoubleAdx(x1,b0) \ - reduceFromDoubleAdx(z1,b1) \ - integerMulAdx(b0,x1,z2) \ - integerMulAdx(b1,z1,x2) \ - reduceFromDoubleAdx(x1,b0) \ - reduceFromDoubleAdx(z1,b1) - -#define doubleLeg \ - addSub(x1,z1) \ - integerSqrLeg(b0,x1) \ - integerSqrLeg(b1,z1) \ - reduceFromDoubleLeg(x1,b0) \ - reduceFromDoubleLeg(z1,b1) \ - subtraction(t0,x1,z1) \ - multiplyA24Leg(t1,t0) \ - additionLeg(t1,t1,z1) \ - integerMulLeg(b0,x1,z1) \ - integerMulLeg(b1,t0,t1) \ - reduceFromDoubleLeg(x1,b0) \ - reduceFromDoubleLeg(z1,b1) - -#define doubleBmi2Adx \ - addSub(x1,z1) \ - integerSqrAdx(b0,x1) \ - integerSqrAdx(b1,z1) \ - reduceFromDoubleAdx(x1,b0) \ - reduceFromDoubleAdx(z1,b1) \ - subtraction(t0,x1,z1) \ - multiplyA24Adx(t1,t0) \ - additionAdx(t1,t1,z1) \ - integerMulAdx(b0,x1,z1) \ - integerMulAdx(b1,t0,t1) \ - reduceFromDoubleAdx(x1,b0) \ - reduceFromDoubleAdx(z1,b1) diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.s b/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.s deleted file mode 100644 index ce9f062..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_amd64.s +++ /dev/null @@ -1,157 +0,0 @@ -//go:build amd64 && !purego -// +build amd64,!purego - -#include "textflag.h" - -// Depends on circl/math/fp25519 package -#include "../../math/fp25519/fp_amd64.h" -#include "curve_amd64.h" - -// CTE_A24 is (A+2)/4 from Curve25519 -#define CTE_A24 121666 - -#define Size 32 - -// multiplyA24Leg multiplies x times CTE_A24 and stores in z -// Uses: AX, DX, R8-R13, FLAGS -// Instr: x86_64, cmov -#define multiplyA24Leg(z,x) \ - MOVL $CTE_A24, AX; MULQ 0+x; MOVQ AX, R8; MOVQ DX, R9; \ - MOVL $CTE_A24, AX; MULQ 8+x; MOVQ AX, R12; MOVQ DX, R10; \ - MOVL $CTE_A24, AX; MULQ 16+x; MOVQ AX, R13; MOVQ DX, R11; \ - MOVL $CTE_A24, AX; MULQ 24+x; \ - ADDQ R12, R9; \ - ADCQ R13, R10; \ - ADCQ AX, R11; \ - ADCQ $0, DX; \ - MOVL $38, AX; /* 2*C = 38 = 2^256 MOD 2^255-19*/ \ - IMULQ AX, DX; \ - ADDQ DX, R8; \ - ADCQ $0, R9; MOVQ R9, 8+z; \ - ADCQ $0, R10; MOVQ R10, 16+z; \ - ADCQ $0, R11; MOVQ R11, 24+z; \ - MOVQ $0, DX; \ - CMOVQCS AX, DX; \ - ADDQ DX, R8; MOVQ R8, 0+z; - -// multiplyA24Adx multiplies x times CTE_A24 and stores in z -// Uses: AX, DX, R8-R12, FLAGS -// Instr: x86_64, cmov, bmi2 -#define multiplyA24Adx(z,x) \ - MOVQ $CTE_A24, DX; \ - MULXQ 0+x, R8, R10; \ - MULXQ 8+x, R9, R11; ADDQ R10, R9; \ - MULXQ 16+x, R10, AX; ADCQ R11, R10; \ - MULXQ 24+x, R11, R12; ADCQ AX, R11; \ - ;;;;;;;;;;;;;;;;;;;;; ADCQ $0, R12; \ - MOVL $38, DX; /* 2*C = 38 = 2^256 MOD 2^255-19*/ \ - IMULQ DX, R12; \ - ADDQ R12, R8; \ - ADCQ $0, R9; MOVQ R9, 8+z; \ - ADCQ $0, R10; MOVQ R10, 16+z; \ - ADCQ $0, R11; MOVQ R11, 24+z; \ - MOVQ $0, R12; \ - CMOVQCS DX, R12; \ - ADDQ R12, R8; MOVQ R8, 0+z; - -#define mulA24Legacy \ - multiplyA24Leg(0(DI),0(SI)) -#define mulA24Bmi2Adx \ - multiplyA24Adx(0(DI),0(SI)) - -// func mulA24Amd64(z, x *fp255.Elt) -TEXT ·mulA24Amd64(SB),NOSPLIT,$0-16 - MOVQ z+0(FP), DI - MOVQ x+8(FP), SI - CHECK_BMI2ADX(LMA24, mulA24Legacy, mulA24Bmi2Adx) - - -// func ladderStepAmd64(w *[5]fp255.Elt, b uint) -// ladderStepAmd64 calculates a point addition and doubling as follows: -// (x2,z2) = 2*(x2,z2) and (x3,z3) = (x2,z2)+(x3,z3) using as a difference (x1,-). -// work = (x1,x2,z2,x3,z3) are five fp255.Elt of 32 bytes. -// stack = (t0,t1) are two fp.Elt of fp.Size bytes, and -// (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes. -TEXT ·ladderStepAmd64(SB),NOSPLIT,$192-16 - // Parameters - #define regWork DI - #define regMove SI - #define x1 0*Size(regWork) - #define x2 1*Size(regWork) - #define z2 2*Size(regWork) - #define x3 3*Size(regWork) - #define z3 4*Size(regWork) - // Local variables - #define t0 0*Size(SP) - #define t1 1*Size(SP) - #define b0 2*Size(SP) - #define b1 4*Size(SP) - MOVQ w+0(FP), regWork - MOVQ b+8(FP), regMove - CHECK_BMI2ADX(LLADSTEP, ladderStepLeg, ladderStepBmi2Adx) - #undef regWork - #undef regMove - #undef x1 - #undef x2 - #undef z2 - #undef x3 - #undef z3 - #undef t0 - #undef t1 - #undef b0 - #undef b1 - -// func diffAddAmd64(w *[5]fp255.Elt, b uint) -// diffAddAmd64 calculates a differential point addition using a precomputed point. -// (x1,z1) = (x1,z1)+(mu) using a difference point (x2,z2) -// w = (mu,x1,z1,x2,z2) are five fp.Elt, and -// stack = (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes. -TEXT ·diffAddAmd64(SB),NOSPLIT,$128-16 - // Parameters - #define regWork DI - #define regSwap SI - #define ui 0*Size(regWork) - #define x1 1*Size(regWork) - #define z1 2*Size(regWork) - #define x2 3*Size(regWork) - #define z2 4*Size(regWork) - // Local variables - #define b0 0*Size(SP) - #define b1 2*Size(SP) - MOVQ w+0(FP), regWork - MOVQ b+8(FP), regSwap - cswap(x1,x2,regSwap) - cswap(z1,z2,regSwap) - CHECK_BMI2ADX(LDIFADD, difAddLeg, difAddBmi2Adx) - #undef regWork - #undef regSwap - #undef ui - #undef x1 - #undef z1 - #undef x2 - #undef z2 - #undef b0 - #undef b1 - -// func doubleAmd64(x, z *fp255.Elt) -// doubleAmd64 calculates a point doubling (x1,z1) = 2*(x1,z1). -// stack = (t0,t1) are two fp.Elt of fp.Size bytes, and -// (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes. -TEXT ·doubleAmd64(SB),NOSPLIT,$192-16 - // Parameters - #define x1 0(DI) - #define z1 0(SI) - // Local variables - #define t0 0*Size(SP) - #define t1 1*Size(SP) - #define b0 2*Size(SP) - #define b1 4*Size(SP) - MOVQ x+0(FP), DI - MOVQ z+8(FP), SI - CHECK_BMI2ADX(LDOUB,doubleLeg,doubleBmi2Adx) - #undef x1 - #undef z1 - #undef t0 - #undef t1 - #undef b0 - #undef b1 diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_generic.go b/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_generic.go deleted file mode 100644 index dae67ea..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_generic.go +++ /dev/null @@ -1,85 +0,0 @@ -package x25519 - -import ( - "encoding/binary" - "math/bits" - - fp "github.com/cloudflare/circl/math/fp25519" -) - -func doubleGeneric(x, z *fp.Elt) { - t0, t1 := &fp.Elt{}, &fp.Elt{} - fp.AddSub(x, z) - fp.Sqr(x, x) - fp.Sqr(z, z) - fp.Sub(t0, x, z) - mulA24Generic(t1, t0) - fp.Add(t1, t1, z) - fp.Mul(x, x, z) - fp.Mul(z, t0, t1) -} - -func diffAddGeneric(w *[5]fp.Elt, b uint) { - mu, x1, z1, x2, z2 := &w[0], &w[1], &w[2], &w[3], &w[4] - fp.Cswap(x1, x2, b) - fp.Cswap(z1, z2, b) - fp.AddSub(x1, z1) - fp.Mul(z1, z1, mu) - fp.AddSub(x1, z1) - fp.Sqr(x1, x1) - fp.Sqr(z1, z1) - fp.Mul(x1, x1, z2) - fp.Mul(z1, z1, x2) -} - -func ladderStepGeneric(w *[5]fp.Elt, b uint) { - x1, x2, z2, x3, z3 := &w[0], &w[1], &w[2], &w[3], &w[4] - t0 := &fp.Elt{} - t1 := &fp.Elt{} - fp.AddSub(x2, z2) - fp.AddSub(x3, z3) - fp.Mul(t0, x2, z3) - fp.Mul(t1, x3, z2) - fp.AddSub(t0, t1) - fp.Cmov(x2, x3, b) - fp.Cmov(z2, z3, b) - fp.Sqr(x3, t0) - fp.Sqr(z3, t1) - fp.Mul(z3, x1, z3) - fp.Sqr(x2, x2) - fp.Sqr(z2, z2) - fp.Sub(t0, x2, z2) - mulA24Generic(t1, t0) - fp.Add(t1, t1, z2) - fp.Mul(x2, x2, z2) - fp.Mul(z2, t0, t1) -} - -func mulA24Generic(z, x *fp.Elt) { - const A24 = 121666 - const n = 8 - var xx [4]uint64 - for i := range xx { - xx[i] = binary.LittleEndian.Uint64(x[i*n : (i+1)*n]) - } - - h0, l0 := bits.Mul64(xx[0], A24) - h1, l1 := bits.Mul64(xx[1], A24) - h2, l2 := bits.Mul64(xx[2], A24) - h3, l3 := bits.Mul64(xx[3], A24) - - var c3 uint64 - l1, c0 := bits.Add64(h0, l1, 0) - l2, c1 := bits.Add64(h1, l2, c0) - l3, c2 := bits.Add64(h2, l3, c1) - l4, _ := bits.Add64(h3, 0, c2) - _, l4 = bits.Mul64(l4, 38) - l0, c0 = bits.Add64(l0, l4, 0) - xx[1], c1 = bits.Add64(l1, 0, c0) - xx[2], c2 = bits.Add64(l2, 0, c1) - xx[3], c3 = bits.Add64(l3, 0, c2) - xx[0], _ = bits.Add64(l0, (-c3)&38, 0) - for i := range xx { - binary.LittleEndian.PutUint64(z[i*n:(i+1)*n], xx[i]) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_noasm.go b/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_noasm.go deleted file mode 100644 index 07fab97..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x25519/curve_noasm.go +++ /dev/null @@ -1,11 +0,0 @@ -//go:build !amd64 || purego -// +build !amd64 purego - -package x25519 - -import fp "github.com/cloudflare/circl/math/fp25519" - -func double(x, z *fp.Elt) { doubleGeneric(x, z) } -func diffAdd(w *[5]fp.Elt, b uint) { diffAddGeneric(w, b) } -func ladderStep(w *[5]fp.Elt, b uint) { ladderStepGeneric(w, b) } -func mulA24(z, x *fp.Elt) { mulA24Generic(z, x) } diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x25519/doc.go b/backend/vendor/github.com/cloudflare/circl/dh/x25519/doc.go deleted file mode 100644 index 3ce102d..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x25519/doc.go +++ /dev/null @@ -1,19 +0,0 @@ -/* -Package x25519 provides Diffie-Hellman functions as specified in RFC-7748. - -Validation of public keys. - -The Diffie-Hellman function, as described in RFC-7748 [1], works for any -public key. However, if a different protocol requires contributory -behaviour [2,3], then the public keys must be validated against low-order -points [3,4]. To do that, the Shared function performs this validation -internally and returns false when the public key is invalid (i.e., it -is a low-order point). - -References: - - [1] RFC7748 by Langley, Hamburg, Turner (https://rfc-editor.org/rfc/rfc7748.txt) - - [2] Curve25519 by Bernstein (https://cr.yp.to/ecdh.html) - - [3] Bernstein (https://cr.yp.to/ecdh.html#validate) - - [4] Cremers&Jackson (https://eprint.iacr.org/2019/526) -*/ -package x25519 diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x25519/key.go b/backend/vendor/github.com/cloudflare/circl/dh/x25519/key.go deleted file mode 100644 index c76f72a..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x25519/key.go +++ /dev/null @@ -1,47 +0,0 @@ -package x25519 - -import ( - "crypto/subtle" - - fp "github.com/cloudflare/circl/math/fp25519" -) - -// Size is the length in bytes of a X25519 key. -const Size = 32 - -// Key represents a X25519 key. -type Key [Size]byte - -func (k *Key) clamp(in *Key) *Key { - *k = *in - k[0] &= 248 - k[31] = (k[31] & 127) | 64 - return k -} - -// isValidPubKey verifies if the public key is not a low-order point. -func (k *Key) isValidPubKey() bool { - fp.Modp((*fp.Elt)(k)) - var isLowOrder int - for _, P := range lowOrderPoints { - isLowOrder |= subtle.ConstantTimeCompare(P[:], k[:]) - } - return isLowOrder == 0 -} - -// KeyGen obtains a public key given a secret key. -func KeyGen(public, secret *Key) { - ladderJoye(public.clamp(secret)) -} - -// Shared calculates Alice's shared key from Alice's secret key and Bob's -// public key returning true on success. A failure case happens when the public -// key is a low-order point, thus the shared key is all-zeros and the function -// returns false. -func Shared(shared, secret, public *Key) bool { - validPk := *public - validPk[31] &= (1 << (255 % 8)) - 1 - ok := validPk.isValidPubKey() - ladderMontgomery(shared.clamp(secret), &validPk) - return ok -} diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x25519/table.go b/backend/vendor/github.com/cloudflare/circl/dh/x25519/table.go deleted file mode 100644 index 28c8c4a..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x25519/table.go +++ /dev/null @@ -1,268 +0,0 @@ -package x25519 - -import "github.com/cloudflare/circl/math/fp25519" - -// tableGenerator contains the set of points: -// -// t[i] = (xi+1)/(xi-1), -// -// where (xi,yi) = 2^iG and G is the generator point -// Size = (256)*(256/8) = 8192 bytes. -var tableGenerator = [256 * fp25519.Size]byte{ - /* (2^ 0)P */ 0xf3, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x5f, - /* (2^ 1)P */ 0x96, 0xfe, 0xaa, 0x16, 0xf4, 0x20, 0x82, 0x6b, 0x34, 0x6a, 0x56, 0x4f, 0x2b, 0xeb, 0xeb, 0x82, 0x0f, 0x95, 0xa5, 0x75, 0xb0, 0xa5, 0xa9, 0xd5, 0xf4, 0x88, 0x24, 0x4b, 0xcf, 0xb2, 0x42, 0x51, - /* (2^ 2)P */ 0x0c, 0x68, 0x69, 0x00, 0x75, 0xbc, 0xae, 0x6a, 0x41, 0x9c, 0xf9, 0xa0, 0x20, 0x78, 0xcf, 0x89, 0xf4, 0xd0, 0x56, 0x3b, 0x18, 0xd9, 0x58, 0x2a, 0xa4, 0x11, 0x60, 0xe3, 0x80, 0xca, 0x5a, 0x4b, - /* (2^ 3)P */ 0x5d, 0x74, 0x29, 0x8c, 0x34, 0x32, 0x91, 0x32, 0xd7, 0x2f, 0x64, 0xe1, 0x16, 0xe6, 0xa2, 0xf4, 0x34, 0xbc, 0x67, 0xff, 0x03, 0xbb, 0x45, 0x1e, 0x4a, 0x9b, 0x2a, 0xf4, 0xd0, 0x12, 0x69, 0x30, - /* (2^ 4)P */ 0x54, 0x71, 0xaf, 0xe6, 0x07, 0x65, 0x88, 0xff, 0x2f, 0xc8, 0xee, 0xdf, 0x13, 0x0e, 0xf5, 0x04, 0xce, 0xb5, 0xba, 0x2a, 0xe8, 0x2f, 0x51, 0xaa, 0x22, 0xf2, 0xd5, 0x68, 0x1a, 0x25, 0x4e, 0x17, - /* (2^ 5)P */ 0x98, 0x88, 0x02, 0x82, 0x0d, 0x70, 0x96, 0xcf, 0xc5, 0x02, 0x2c, 0x0a, 0x37, 0xe3, 0x43, 0x17, 0xaa, 0x6e, 0xe8, 0xb4, 0x98, 0xec, 0x9e, 0x37, 0x2e, 0x48, 0xe0, 0x51, 0x8a, 0x88, 0x59, 0x0c, - /* (2^ 6)P */ 0x89, 0xd1, 0xb5, 0x99, 0xd6, 0xf1, 0xcb, 0xfb, 0x84, 0xdc, 0x9f, 0x8e, 0xd5, 0xf0, 0xae, 0xac, 0x14, 0x76, 0x1f, 0x23, 0x06, 0x0d, 0xc2, 0xc1, 0x72, 0xf9, 0x74, 0xa2, 0x8d, 0x21, 0x38, 0x29, - /* (2^ 7)P */ 0x18, 0x7f, 0x1d, 0xff, 0xbe, 0x49, 0xaf, 0xf6, 0xc2, 0xc9, 0x7a, 0x38, 0x22, 0x1c, 0x54, 0xcc, 0x6b, 0xc5, 0x15, 0x40, 0xef, 0xc9, 0xfc, 0x96, 0xa9, 0x13, 0x09, 0x69, 0x7c, 0x62, 0xc1, 0x69, - /* (2^ 8)P */ 0x0e, 0xdb, 0x33, 0x47, 0x2f, 0xfd, 0x86, 0x7a, 0xe9, 0x7d, 0x08, 0x9e, 0xf2, 0xc4, 0xb8, 0xfd, 0x29, 0xa2, 0xa2, 0x8e, 0x1a, 0x4b, 0x5e, 0x09, 0x79, 0x7a, 0xb3, 0x29, 0xc8, 0xa7, 0xd7, 0x1a, - /* (2^ 9)P */ 0xc0, 0xa0, 0x7e, 0xd1, 0xca, 0x89, 0x2d, 0x34, 0x51, 0x20, 0xed, 0xcc, 0xa6, 0xdd, 0xbe, 0x67, 0x74, 0x2f, 0xb4, 0x2b, 0xbf, 0x31, 0xca, 0x19, 0xbb, 0xac, 0x80, 0x49, 0xc8, 0xb4, 0xf7, 0x3d, - /* (2^ 10)P */ 0x83, 0xd8, 0x0a, 0xc8, 0x4d, 0x44, 0xc6, 0xa8, 0x85, 0xab, 0xe3, 0x66, 0x03, 0x44, 0x1e, 0xb9, 0xd8, 0xf6, 0x64, 0x01, 0xa0, 0xcd, 0x15, 0xc2, 0x68, 0xe6, 0x47, 0xf2, 0x6e, 0x7c, 0x86, 0x3d, - /* (2^ 11)P */ 0x8c, 0x65, 0x3e, 0xcc, 0x2b, 0x58, 0xdd, 0xc7, 0x28, 0x55, 0x0e, 0xee, 0x48, 0x47, 0x2c, 0xfd, 0x71, 0x4f, 0x9f, 0xcc, 0x95, 0x9b, 0xfd, 0xa0, 0xdf, 0x5d, 0x67, 0xb0, 0x71, 0xd8, 0x29, 0x75, - /* (2^ 12)P */ 0x78, 0xbd, 0x3c, 0x2d, 0xb4, 0x68, 0xf5, 0xb8, 0x82, 0xda, 0xf3, 0x91, 0x1b, 0x01, 0x33, 0x12, 0x62, 0x3b, 0x7c, 0x4a, 0xcd, 0x6c, 0xce, 0x2d, 0x03, 0x86, 0x49, 0x9e, 0x8e, 0xfc, 0xe7, 0x75, - /* (2^ 13)P */ 0xec, 0xb6, 0xd0, 0xfc, 0xf1, 0x13, 0x4f, 0x2f, 0x45, 0x7a, 0xff, 0x29, 0x1f, 0xca, 0xa8, 0xf1, 0x9b, 0xe2, 0x81, 0x29, 0xa7, 0xc1, 0x49, 0xc2, 0x6a, 0xb5, 0x83, 0x8c, 0xbb, 0x0d, 0xbe, 0x6e, - /* (2^ 14)P */ 0x22, 0xb2, 0x0b, 0x17, 0x8d, 0xfa, 0x14, 0x71, 0x5f, 0x93, 0x93, 0xbf, 0xd5, 0xdc, 0xa2, 0x65, 0x9a, 0x97, 0x9c, 0xb5, 0x68, 0x1f, 0xc4, 0xbd, 0x89, 0x92, 0xce, 0xa2, 0x79, 0xef, 0x0e, 0x2f, - /* (2^ 15)P */ 0xce, 0x37, 0x3c, 0x08, 0x0c, 0xbf, 0xec, 0x42, 0x22, 0x63, 0x49, 0xec, 0x09, 0xbc, 0x30, 0x29, 0x0d, 0xac, 0xfe, 0x9c, 0xc1, 0xb0, 0x94, 0xf2, 0x80, 0xbb, 0xfa, 0xed, 0x4b, 0xaa, 0x80, 0x37, - /* (2^ 16)P */ 0x29, 0xd9, 0xea, 0x7c, 0x3e, 0x7d, 0xc1, 0x56, 0xc5, 0x22, 0x57, 0x2e, 0xeb, 0x4b, 0xcb, 0xe7, 0x5a, 0xe1, 0xbf, 0x2d, 0x73, 0x31, 0xe9, 0x0c, 0xf8, 0x52, 0x10, 0x62, 0xc7, 0x83, 0xb8, 0x41, - /* (2^ 17)P */ 0x50, 0x53, 0xd2, 0xc3, 0xa0, 0x5c, 0xf7, 0xdb, 0x51, 0xe3, 0xb1, 0x6e, 0x08, 0xbe, 0x36, 0x29, 0x12, 0xb2, 0xa9, 0xb4, 0x3c, 0xe0, 0x36, 0xc9, 0xaa, 0x25, 0x22, 0x32, 0x82, 0xbf, 0x45, 0x1d, - /* (2^ 18)P */ 0xc5, 0x4c, 0x02, 0x6a, 0x03, 0xb1, 0x1a, 0xe8, 0x72, 0x9a, 0x4c, 0x30, 0x1c, 0x20, 0x12, 0xe2, 0xfc, 0xb1, 0x32, 0x68, 0xba, 0x3f, 0xd7, 0xc5, 0x81, 0x95, 0x83, 0x4d, 0x5a, 0xdb, 0xff, 0x20, - /* (2^ 19)P */ 0xad, 0x0f, 0x5d, 0xbe, 0x67, 0xd3, 0x83, 0xa2, 0x75, 0x44, 0x16, 0x8b, 0xca, 0x25, 0x2b, 0x6c, 0x2e, 0xf2, 0xaa, 0x7c, 0x46, 0x35, 0x49, 0x9d, 0x49, 0xff, 0x85, 0xee, 0x8e, 0x40, 0x66, 0x51, - /* (2^ 20)P */ 0x61, 0xe3, 0xb4, 0xfa, 0xa2, 0xba, 0x67, 0x3c, 0xef, 0x5c, 0xf3, 0x7e, 0xc6, 0x33, 0xe4, 0xb3, 0x1c, 0x9b, 0x15, 0x41, 0x92, 0x72, 0x59, 0x52, 0x33, 0xab, 0xb0, 0xd5, 0x92, 0x18, 0x62, 0x6a, - /* (2^ 21)P */ 0xcb, 0xcd, 0x55, 0x75, 0x38, 0x4a, 0xb7, 0x20, 0x3f, 0x92, 0x08, 0x12, 0x0e, 0xa1, 0x2a, 0x53, 0xd1, 0x1d, 0x28, 0x62, 0x77, 0x7b, 0xa1, 0xea, 0xbf, 0x44, 0x5c, 0xf0, 0x43, 0x34, 0xab, 0x61, - /* (2^ 22)P */ 0xf8, 0xde, 0x24, 0x23, 0x42, 0x6c, 0x7a, 0x25, 0x7f, 0xcf, 0xe3, 0x17, 0x10, 0x6c, 0x1c, 0x13, 0x57, 0xa2, 0x30, 0xf6, 0x39, 0x87, 0x75, 0x23, 0x80, 0x85, 0xa7, 0x01, 0x7a, 0x40, 0x5a, 0x29, - /* (2^ 23)P */ 0xd9, 0xa8, 0x5d, 0x6d, 0x24, 0x43, 0xc4, 0xf8, 0x5d, 0xfa, 0x52, 0x0c, 0x45, 0x75, 0xd7, 0x19, 0x3d, 0xf8, 0x1b, 0x73, 0x92, 0xfc, 0xfc, 0x2a, 0x00, 0x47, 0x2b, 0x1b, 0xe8, 0xc8, 0x10, 0x7d, - /* (2^ 24)P */ 0x0b, 0xa2, 0xba, 0x70, 0x1f, 0x27, 0xe0, 0xc8, 0x57, 0x39, 0xa6, 0x7c, 0x86, 0x48, 0x37, 0x99, 0xbb, 0xd4, 0x7e, 0xcb, 0xb3, 0xef, 0x12, 0x54, 0x75, 0x29, 0xe6, 0x73, 0x61, 0xd3, 0x96, 0x31, - /* (2^ 25)P */ 0xfc, 0xdf, 0xc7, 0x41, 0xd1, 0xca, 0x5b, 0xde, 0x48, 0xc8, 0x95, 0xb3, 0xd2, 0x8c, 0xcc, 0x47, 0xcb, 0xf3, 0x1a, 0xe1, 0x42, 0xd9, 0x4c, 0xa3, 0xc2, 0xce, 0x4e, 0xd0, 0xf2, 0xdb, 0x56, 0x02, - /* (2^ 26)P */ 0x7f, 0x66, 0x0e, 0x4b, 0xe9, 0xb7, 0x5a, 0x87, 0x10, 0x0d, 0x85, 0xc0, 0x83, 0xdd, 0xd4, 0xca, 0x9f, 0xc7, 0x72, 0x4e, 0x8f, 0x2e, 0xf1, 0x47, 0x9b, 0xb1, 0x85, 0x8c, 0xbb, 0x87, 0x1a, 0x5f, - /* (2^ 27)P */ 0xb8, 0x51, 0x7f, 0x43, 0xb6, 0xd0, 0xe9, 0x7a, 0x65, 0x90, 0x87, 0x18, 0x55, 0xce, 0xc7, 0x12, 0xee, 0x7a, 0xf7, 0x5c, 0xfe, 0x09, 0xde, 0x2a, 0x27, 0x56, 0x2c, 0x7d, 0x2f, 0x5a, 0xa0, 0x23, - /* (2^ 28)P */ 0x9a, 0x16, 0x7c, 0xf1, 0x28, 0xe1, 0x08, 0x59, 0x2d, 0x85, 0xd0, 0x8a, 0xdd, 0x98, 0x74, 0xf7, 0x64, 0x2f, 0x10, 0xab, 0xce, 0xc4, 0xb4, 0x74, 0x45, 0x98, 0x13, 0x10, 0xdd, 0xba, 0x3a, 0x18, - /* (2^ 29)P */ 0xac, 0xaa, 0x92, 0xaa, 0x8d, 0xba, 0x65, 0xb1, 0x05, 0x67, 0x38, 0x99, 0x95, 0xef, 0xc5, 0xd5, 0xd1, 0x40, 0xfc, 0xf8, 0x0c, 0x8f, 0x2f, 0xbe, 0x14, 0x45, 0x20, 0xee, 0x35, 0xe6, 0x01, 0x27, - /* (2^ 30)P */ 0x14, 0x65, 0x15, 0x20, 0x00, 0xa8, 0x9f, 0x62, 0xce, 0xc1, 0xa8, 0x64, 0x87, 0x86, 0x23, 0xf2, 0x0e, 0x06, 0x3f, 0x0b, 0xff, 0x4f, 0x89, 0x5b, 0xfa, 0xa3, 0x08, 0xf7, 0x4c, 0x94, 0xd9, 0x60, - /* (2^ 31)P */ 0x1f, 0x20, 0x7a, 0x1c, 0x1a, 0x00, 0xea, 0xae, 0x63, 0xce, 0xe2, 0x3e, 0x63, 0x6a, 0xf1, 0xeb, 0xe1, 0x07, 0x7a, 0x4c, 0x59, 0x09, 0x77, 0x6f, 0xcb, 0x08, 0x02, 0x0d, 0x15, 0x58, 0xb9, 0x79, - /* (2^ 32)P */ 0xe7, 0x10, 0xd4, 0x01, 0x53, 0x5e, 0xb5, 0x24, 0x4d, 0xc8, 0xfd, 0xf3, 0xdf, 0x4e, 0xa3, 0xe3, 0xd8, 0x32, 0x40, 0x90, 0xe4, 0x68, 0x87, 0xd8, 0xec, 0xae, 0x3a, 0x7b, 0x42, 0x84, 0x13, 0x13, - /* (2^ 33)P */ 0x14, 0x4f, 0x23, 0x86, 0x12, 0xe5, 0x05, 0x84, 0x29, 0xc5, 0xb4, 0xad, 0x39, 0x47, 0xdc, 0x14, 0xfd, 0x4f, 0x63, 0x50, 0xb2, 0xb5, 0xa2, 0xb8, 0x93, 0xff, 0xa7, 0xd8, 0x4a, 0xa9, 0xe2, 0x2f, - /* (2^ 34)P */ 0xdd, 0xfa, 0x43, 0xe8, 0xef, 0x57, 0x5c, 0xec, 0x18, 0x99, 0xbb, 0xf0, 0x40, 0xce, 0x43, 0x28, 0x05, 0x63, 0x3d, 0xcf, 0xd6, 0x61, 0xb5, 0xa4, 0x7e, 0x77, 0xfb, 0xe8, 0xbd, 0x29, 0x36, 0x74, - /* (2^ 35)P */ 0x8f, 0x73, 0xaf, 0xbb, 0x46, 0xdd, 0x3e, 0x34, 0x51, 0xa6, 0x01, 0xb1, 0x28, 0x18, 0x98, 0xed, 0x7a, 0x79, 0x2c, 0x88, 0x0b, 0x76, 0x01, 0xa4, 0x30, 0x87, 0xc8, 0x8d, 0xe2, 0x23, 0xc2, 0x1f, - /* (2^ 36)P */ 0x0e, 0xba, 0x0f, 0xfc, 0x91, 0x4e, 0x60, 0x48, 0xa4, 0x6f, 0x2c, 0x05, 0x8f, 0xf7, 0x37, 0xb6, 0x9c, 0x23, 0xe9, 0x09, 0x3d, 0xac, 0xcc, 0x91, 0x7c, 0x68, 0x7a, 0x43, 0xd4, 0xee, 0xf7, 0x23, - /* (2^ 37)P */ 0x00, 0xd8, 0x9b, 0x8d, 0x11, 0xb1, 0x73, 0x51, 0xa7, 0xd4, 0x89, 0x31, 0xb6, 0x41, 0xd6, 0x29, 0x86, 0xc5, 0xbb, 0x88, 0x79, 0x17, 0xbf, 0xfd, 0xf5, 0x1d, 0xd8, 0xca, 0x4f, 0x89, 0x59, 0x29, - /* (2^ 38)P */ 0x99, 0xc8, 0xbb, 0xb4, 0xf3, 0x8e, 0xbc, 0xae, 0xb9, 0x92, 0x69, 0xb2, 0x5a, 0x99, 0x48, 0x41, 0xfb, 0x2c, 0xf9, 0x34, 0x01, 0x0b, 0xe2, 0x24, 0xe8, 0xde, 0x05, 0x4a, 0x89, 0x58, 0xd1, 0x40, - /* (2^ 39)P */ 0xf6, 0x76, 0xaf, 0x85, 0x11, 0x0b, 0xb0, 0x46, 0x79, 0x7a, 0x18, 0x73, 0x78, 0xc7, 0xba, 0x26, 0x5f, 0xff, 0x8f, 0xab, 0x95, 0xbf, 0xc0, 0x3d, 0xd7, 0x24, 0x55, 0x94, 0xd8, 0x8b, 0x60, 0x2a, - /* (2^ 40)P */ 0x02, 0x63, 0x44, 0xbd, 0x88, 0x95, 0x44, 0x26, 0x9c, 0x43, 0x88, 0x03, 0x1c, 0xc2, 0x4b, 0x7c, 0xb2, 0x11, 0xbd, 0x83, 0xf3, 0xa4, 0x98, 0x8e, 0xb9, 0x76, 0xd8, 0xc9, 0x7b, 0x8d, 0x21, 0x26, - /* (2^ 41)P */ 0x8a, 0x17, 0x7c, 0x99, 0x42, 0x15, 0x08, 0xe3, 0x6f, 0x60, 0xb6, 0x6f, 0xa8, 0x29, 0x2d, 0x3c, 0x74, 0x93, 0x27, 0xfa, 0x36, 0x77, 0x21, 0x5c, 0xfa, 0xb1, 0xfe, 0x4a, 0x73, 0x05, 0xde, 0x7d, - /* (2^ 42)P */ 0xab, 0x2b, 0xd4, 0x06, 0x39, 0x0e, 0xf1, 0x3b, 0x9c, 0x64, 0x80, 0x19, 0x3e, 0x80, 0xf7, 0xe4, 0x7a, 0xbf, 0x95, 0x95, 0xf8, 0x3b, 0x05, 0xe6, 0x30, 0x55, 0x24, 0xda, 0x38, 0xaf, 0x4f, 0x39, - /* (2^ 43)P */ 0xf4, 0x28, 0x69, 0x89, 0x58, 0xfb, 0x8e, 0x7a, 0x3c, 0x11, 0x6a, 0xcc, 0xe9, 0x78, 0xc7, 0xfb, 0x6f, 0x59, 0xaf, 0x30, 0xe3, 0x0c, 0x67, 0x72, 0xf7, 0x6c, 0x3d, 0x1d, 0xa8, 0x22, 0xf2, 0x48, - /* (2^ 44)P */ 0xa7, 0xca, 0x72, 0x0d, 0x41, 0xce, 0x1f, 0xf0, 0x95, 0x55, 0x3b, 0x21, 0xc7, 0xec, 0x20, 0x5a, 0x83, 0x14, 0xfa, 0xc1, 0x65, 0x11, 0xc2, 0x7b, 0x41, 0xa7, 0xa8, 0x1d, 0xe3, 0x9a, 0xf8, 0x07, - /* (2^ 45)P */ 0xf9, 0x0f, 0x83, 0xc6, 0xb4, 0xc2, 0xd2, 0x05, 0x93, 0x62, 0x31, 0xc6, 0x0f, 0x33, 0x3e, 0xd4, 0x04, 0xa9, 0xd3, 0x96, 0x0a, 0x59, 0xa5, 0xa5, 0xb6, 0x33, 0x53, 0xa6, 0x91, 0xdb, 0x5e, 0x70, - /* (2^ 46)P */ 0xf7, 0xa5, 0xb9, 0x0b, 0x5e, 0xe1, 0x8e, 0x04, 0x5d, 0xaf, 0x0a, 0x9e, 0xca, 0xcf, 0x40, 0x32, 0x0b, 0xa4, 0xc4, 0xed, 0xce, 0x71, 0x4b, 0x8f, 0x6d, 0x4a, 0x54, 0xde, 0xa3, 0x0d, 0x1c, 0x62, - /* (2^ 47)P */ 0x91, 0x40, 0x8c, 0xa0, 0x36, 0x28, 0x87, 0x92, 0x45, 0x14, 0xc9, 0x10, 0xb0, 0x75, 0x83, 0xce, 0x94, 0x63, 0x27, 0x4f, 0x52, 0xeb, 0x72, 0x8a, 0x35, 0x36, 0xc8, 0x7e, 0xfa, 0xfc, 0x67, 0x26, - /* (2^ 48)P */ 0x2a, 0x75, 0xe8, 0x45, 0x33, 0x17, 0x4c, 0x7f, 0xa5, 0x79, 0x70, 0xee, 0xfe, 0x47, 0x1b, 0x06, 0x34, 0xff, 0x86, 0x9f, 0xfa, 0x9a, 0xdd, 0x25, 0x9c, 0xc8, 0x5d, 0x42, 0xf5, 0xce, 0x80, 0x37, - /* (2^ 49)P */ 0xe9, 0xb4, 0x3b, 0x51, 0x5a, 0x03, 0x46, 0x1a, 0xda, 0x5a, 0x57, 0xac, 0x79, 0xf3, 0x1e, 0x3e, 0x50, 0x4b, 0xa2, 0x5f, 0x1c, 0x5f, 0x8c, 0xc7, 0x22, 0x9f, 0xfd, 0x34, 0x76, 0x96, 0x1a, 0x32, - /* (2^ 50)P */ 0xfa, 0x27, 0x6e, 0x82, 0xb8, 0x07, 0x67, 0x94, 0xd0, 0x6f, 0x50, 0x4c, 0xd6, 0x84, 0xca, 0x3d, 0x36, 0x14, 0xe9, 0x75, 0x80, 0x21, 0x89, 0xc1, 0x84, 0x84, 0x3b, 0x9b, 0x16, 0x84, 0x92, 0x6d, - /* (2^ 51)P */ 0xdf, 0x2d, 0x3f, 0x38, 0x40, 0xe8, 0x67, 0x3a, 0x75, 0x9b, 0x4f, 0x0c, 0xa3, 0xc9, 0xee, 0x33, 0x47, 0xef, 0x83, 0xa7, 0x6f, 0xc8, 0xc7, 0x3e, 0xc4, 0xfb, 0xc9, 0xba, 0x9f, 0x44, 0xec, 0x26, - /* (2^ 52)P */ 0x7d, 0x9e, 0x9b, 0xa0, 0xcb, 0x38, 0x0f, 0x5c, 0x8c, 0x47, 0xa3, 0x62, 0xc7, 0x8c, 0x16, 0x81, 0x1c, 0x12, 0xfc, 0x06, 0xd3, 0xb0, 0x23, 0x3e, 0xdd, 0xdc, 0xef, 0xa5, 0xa0, 0x8a, 0x23, 0x5a, - /* (2^ 53)P */ 0xff, 0x43, 0xea, 0xc4, 0x21, 0x61, 0xa2, 0x1b, 0xb5, 0x32, 0x88, 0x7c, 0x7f, 0xc7, 0xf8, 0x36, 0x9a, 0xf9, 0xdc, 0x0a, 0x0b, 0xea, 0xfb, 0x88, 0xf9, 0xeb, 0x5b, 0xc2, 0x8e, 0x93, 0xa9, 0x5c, - /* (2^ 54)P */ 0xa0, 0xcd, 0xfc, 0x51, 0x5e, 0x6a, 0x43, 0xd5, 0x3b, 0x89, 0xcd, 0xc2, 0x97, 0x47, 0xbc, 0x1d, 0x08, 0x4a, 0x22, 0xd3, 0x65, 0x6a, 0x34, 0x19, 0x66, 0xf4, 0x9a, 0x9b, 0xe4, 0x34, 0x50, 0x0f, - /* (2^ 55)P */ 0x6e, 0xb9, 0xe0, 0xa1, 0x67, 0x39, 0x3c, 0xf2, 0x88, 0x4d, 0x7a, 0x86, 0xfa, 0x08, 0x8b, 0xe5, 0x79, 0x16, 0x34, 0xa7, 0xc6, 0xab, 0x2f, 0xfb, 0x46, 0x69, 0x02, 0xb6, 0x1e, 0x38, 0x75, 0x2a, - /* (2^ 56)P */ 0xac, 0x20, 0x94, 0xc1, 0xe4, 0x3b, 0x0a, 0xc8, 0xdc, 0xb6, 0xf2, 0x81, 0xc6, 0xf6, 0xb1, 0x66, 0x88, 0x33, 0xe9, 0x61, 0x67, 0x03, 0xf7, 0x7c, 0xc4, 0xa4, 0x60, 0xa6, 0xd8, 0xbb, 0xab, 0x25, - /* (2^ 57)P */ 0x98, 0x51, 0xfd, 0x14, 0xba, 0x12, 0xea, 0x91, 0xa9, 0xff, 0x3c, 0x4a, 0xfc, 0x50, 0x49, 0x68, 0x28, 0xad, 0xf5, 0x30, 0x21, 0x84, 0x26, 0xf8, 0x41, 0xa4, 0x01, 0x53, 0xf7, 0x88, 0xa9, 0x3e, - /* (2^ 58)P */ 0x6f, 0x8c, 0x5f, 0x69, 0x9a, 0x10, 0x78, 0xc9, 0xf3, 0xc3, 0x30, 0x05, 0x4a, 0xeb, 0x46, 0x17, 0x95, 0x99, 0x45, 0xb4, 0x77, 0x6d, 0x4d, 0x44, 0xc7, 0x5c, 0x4e, 0x05, 0x8c, 0x2b, 0x95, 0x75, - /* (2^ 59)P */ 0xaa, 0xd6, 0xf4, 0x15, 0x79, 0x3f, 0x70, 0xa3, 0xd8, 0x47, 0x26, 0x2f, 0x20, 0x46, 0xc3, 0x66, 0x4b, 0x64, 0x1d, 0x81, 0xdf, 0x69, 0x14, 0xd0, 0x1f, 0xd7, 0xa5, 0x81, 0x7d, 0xa4, 0xfe, 0x77, - /* (2^ 60)P */ 0x81, 0xa3, 0x7c, 0xf5, 0x9e, 0x52, 0xe9, 0xc5, 0x1a, 0x88, 0x2f, 0xce, 0xb9, 0xb4, 0xee, 0x6e, 0xd6, 0x9b, 0x00, 0xe8, 0x28, 0x1a, 0xe9, 0xb6, 0xec, 0x3f, 0xfc, 0x9a, 0x3e, 0xbe, 0x80, 0x4b, - /* (2^ 61)P */ 0xc5, 0xd2, 0xae, 0x26, 0xc5, 0x73, 0x37, 0x7e, 0x9d, 0xa4, 0xc9, 0x53, 0xb4, 0xfc, 0x4a, 0x1b, 0x4d, 0xb2, 0xff, 0xba, 0xd7, 0xbd, 0x20, 0xa9, 0x0e, 0x40, 0x2d, 0x12, 0x9f, 0x69, 0x54, 0x7c, - /* (2^ 62)P */ 0xc8, 0x4b, 0xa9, 0x4f, 0xe1, 0xc8, 0x46, 0xef, 0x5e, 0xed, 0x52, 0x29, 0xce, 0x74, 0xb0, 0xe0, 0xd5, 0x85, 0xd8, 0xdb, 0xe1, 0x50, 0xa4, 0xbe, 0x2c, 0x71, 0x0f, 0x32, 0x49, 0x86, 0xb6, 0x61, - /* (2^ 63)P */ 0xd1, 0xbd, 0xcc, 0x09, 0x73, 0x5f, 0x48, 0x8a, 0x2d, 0x1a, 0x4d, 0x7d, 0x0d, 0x32, 0x06, 0xbd, 0xf4, 0xbe, 0x2d, 0x32, 0x73, 0x29, 0x23, 0x25, 0x70, 0xf7, 0x17, 0x8c, 0x75, 0xc4, 0x5d, 0x44, - /* (2^ 64)P */ 0x3c, 0x93, 0xc8, 0x7c, 0x17, 0x34, 0x04, 0xdb, 0x9f, 0x05, 0xea, 0x75, 0x21, 0xe8, 0x6f, 0xed, 0x34, 0xdb, 0x53, 0xc0, 0xfd, 0xbe, 0xfe, 0x1e, 0x99, 0xaf, 0x5d, 0xc6, 0x67, 0xe8, 0xdb, 0x4a, - /* (2^ 65)P */ 0xdf, 0x09, 0x06, 0xa9, 0xa2, 0x71, 0xcd, 0x3a, 0x50, 0x40, 0xd0, 0x6d, 0x85, 0x91, 0xe9, 0xe5, 0x3c, 0xc2, 0x57, 0x81, 0x68, 0x9b, 0xc6, 0x1e, 0x4d, 0xfe, 0x5c, 0x88, 0xf6, 0x27, 0x74, 0x69, - /* (2^ 66)P */ 0x51, 0xa8, 0xe1, 0x65, 0x9b, 0x7b, 0xbe, 0xd7, 0xdd, 0x36, 0xc5, 0x22, 0xd5, 0x28, 0x3d, 0xa0, 0x45, 0xb6, 0xd2, 0x8f, 0x65, 0x9d, 0x39, 0x28, 0xe1, 0x41, 0x26, 0x7c, 0xe1, 0xb7, 0xe5, 0x49, - /* (2^ 67)P */ 0xa4, 0x57, 0x04, 0x70, 0x98, 0x3a, 0x8c, 0x6f, 0x78, 0x67, 0xbb, 0x5e, 0xa2, 0xf0, 0x78, 0x50, 0x0f, 0x96, 0x82, 0xc3, 0xcb, 0x3c, 0x3c, 0xd1, 0xb1, 0x84, 0xdf, 0xa7, 0x58, 0x32, 0x00, 0x2e, - /* (2^ 68)P */ 0x1c, 0x6a, 0x29, 0xe6, 0x9b, 0xf3, 0xd1, 0x8a, 0xb2, 0xbf, 0x5f, 0x2a, 0x65, 0xaa, 0xee, 0xc1, 0xcb, 0xf3, 0x26, 0xfd, 0x73, 0x06, 0xee, 0x33, 0xcc, 0x2c, 0x9d, 0xa6, 0x73, 0x61, 0x25, 0x59, - /* (2^ 69)P */ 0x41, 0xfc, 0x18, 0x4e, 0xaa, 0x07, 0xea, 0x41, 0x1e, 0xa5, 0x87, 0x7c, 0x52, 0x19, 0xfc, 0xd9, 0x6f, 0xca, 0x31, 0x58, 0x80, 0xcb, 0xaa, 0xbd, 0x4f, 0x69, 0x16, 0xc9, 0x2d, 0x65, 0x5b, 0x44, - /* (2^ 70)P */ 0x15, 0x23, 0x17, 0xf2, 0xa7, 0xa3, 0x92, 0xce, 0x64, 0x99, 0x1b, 0xe1, 0x2d, 0x28, 0xdc, 0x1e, 0x4a, 0x31, 0x4c, 0xe0, 0xaf, 0x3a, 0x82, 0xa1, 0x86, 0xf5, 0x7c, 0x43, 0x94, 0x2d, 0x0a, 0x79, - /* (2^ 71)P */ 0x09, 0xe0, 0xf6, 0x93, 0xfb, 0x47, 0xc4, 0x71, 0x76, 0x52, 0x84, 0x22, 0x67, 0xa5, 0x22, 0x89, 0x69, 0x51, 0x4f, 0x20, 0x3b, 0x90, 0x70, 0xbf, 0xfe, 0x19, 0xa3, 0x1b, 0x89, 0x89, 0x7a, 0x2f, - /* (2^ 72)P */ 0x0c, 0x14, 0xe2, 0x77, 0xb5, 0x8e, 0xa0, 0x02, 0xf4, 0xdc, 0x7b, 0x42, 0xd4, 0x4e, 0x9a, 0xed, 0xd1, 0x3c, 0x32, 0xe4, 0x44, 0xec, 0x53, 0x52, 0x5b, 0x35, 0xe9, 0x14, 0x3c, 0x36, 0x88, 0x3e, - /* (2^ 73)P */ 0x8c, 0x0b, 0x11, 0x77, 0x42, 0xc1, 0x66, 0xaa, 0x90, 0x33, 0xa2, 0x10, 0x16, 0x39, 0xe0, 0x1a, 0xa2, 0xc2, 0x3f, 0xc9, 0x12, 0xbd, 0x30, 0x20, 0xab, 0xc7, 0x55, 0x95, 0x57, 0x41, 0xe1, 0x3e, - /* (2^ 74)P */ 0x41, 0x7d, 0x6e, 0x6d, 0x3a, 0xde, 0x14, 0x92, 0xfe, 0x7e, 0xf1, 0x07, 0x86, 0xd8, 0xcd, 0x3c, 0x17, 0x12, 0xe1, 0xf8, 0x88, 0x12, 0x4f, 0x67, 0xd0, 0x93, 0x9f, 0x32, 0x0f, 0x25, 0x82, 0x56, - /* (2^ 75)P */ 0x6e, 0x39, 0x2e, 0x6d, 0x13, 0x0b, 0xf0, 0x6c, 0xbf, 0xde, 0x14, 0x10, 0x6f, 0xf8, 0x4c, 0x6e, 0x83, 0x4e, 0xcc, 0xbf, 0xb5, 0xb1, 0x30, 0x59, 0xb6, 0x16, 0xba, 0x8a, 0xb4, 0x69, 0x70, 0x04, - /* (2^ 76)P */ 0x93, 0x07, 0xb2, 0x69, 0xab, 0xe4, 0x4c, 0x0d, 0x9e, 0xfb, 0xd0, 0x97, 0x1a, 0xb9, 0x4d, 0xb2, 0x1d, 0xd0, 0x00, 0x4e, 0xf5, 0x50, 0xfa, 0xcd, 0xb5, 0xdd, 0x8b, 0x36, 0x85, 0x10, 0x1b, 0x22, - /* (2^ 77)P */ 0xd2, 0xd8, 0xe3, 0xb1, 0x68, 0x94, 0xe5, 0xe7, 0x93, 0x2f, 0x12, 0xbd, 0x63, 0x65, 0xc5, 0x53, 0x09, 0x3f, 0x66, 0xe0, 0x03, 0xa9, 0xe8, 0xee, 0x42, 0x3d, 0xbe, 0xcb, 0x62, 0xa6, 0xef, 0x61, - /* (2^ 78)P */ 0x2a, 0xab, 0x6e, 0xde, 0xdd, 0xdd, 0xf8, 0x2c, 0x31, 0xf2, 0x35, 0x14, 0xd5, 0x0a, 0xf8, 0x9b, 0x73, 0x49, 0xf0, 0xc9, 0xce, 0xda, 0xea, 0x5d, 0x27, 0x9b, 0xd2, 0x41, 0x5d, 0x5b, 0x27, 0x29, - /* (2^ 79)P */ 0x4f, 0xf1, 0xeb, 0x95, 0x08, 0x0f, 0xde, 0xcf, 0xa7, 0x05, 0x49, 0x05, 0x6b, 0xb9, 0xaa, 0xb9, 0xfd, 0x20, 0xc4, 0xa1, 0xd9, 0x0d, 0xe8, 0xca, 0xc7, 0xbb, 0x73, 0x16, 0x2f, 0xbf, 0x63, 0x0a, - /* (2^ 80)P */ 0x8c, 0xbc, 0x8f, 0x95, 0x11, 0x6e, 0x2f, 0x09, 0xad, 0x2f, 0x82, 0x04, 0xe8, 0x81, 0x2a, 0x67, 0x17, 0x25, 0xd5, 0x60, 0x15, 0x35, 0xc8, 0xca, 0xf8, 0x92, 0xf1, 0xc8, 0x22, 0x77, 0x3f, 0x6f, - /* (2^ 81)P */ 0xb7, 0x94, 0xe8, 0xc2, 0xcc, 0x90, 0xba, 0xf8, 0x0d, 0x9f, 0xff, 0x38, 0xa4, 0x57, 0x75, 0x2c, 0x59, 0x23, 0xe5, 0x5a, 0x85, 0x1d, 0x4d, 0x89, 0x69, 0x3d, 0x74, 0x7b, 0x15, 0x22, 0xe1, 0x68, - /* (2^ 82)P */ 0xf3, 0x19, 0xb9, 0xcf, 0x70, 0x55, 0x7e, 0xd8, 0xb9, 0x8d, 0x79, 0x95, 0xcd, 0xde, 0x2c, 0x3f, 0xce, 0xa2, 0xc0, 0x10, 0x47, 0x15, 0x21, 0x21, 0xb2, 0xc5, 0x6d, 0x24, 0x15, 0xa1, 0x66, 0x3c, - /* (2^ 83)P */ 0x72, 0xcb, 0x4e, 0x29, 0x62, 0xc5, 0xed, 0xcb, 0x16, 0x0b, 0x28, 0x6a, 0xc3, 0x43, 0x71, 0xba, 0x67, 0x8b, 0x07, 0xd4, 0xef, 0xc2, 0x10, 0x96, 0x1e, 0x4b, 0x6a, 0x94, 0x5d, 0x73, 0x44, 0x61, - /* (2^ 84)P */ 0x50, 0x33, 0x5b, 0xd7, 0x1e, 0x11, 0x6f, 0x53, 0x1b, 0xd8, 0x41, 0x20, 0x8c, 0xdb, 0x11, 0x02, 0x3c, 0x41, 0x10, 0x0e, 0x00, 0xb1, 0x3c, 0xf9, 0x76, 0x88, 0x9e, 0x03, 0x3c, 0xfd, 0x9d, 0x14, - /* (2^ 85)P */ 0x5b, 0x15, 0x63, 0x6b, 0xe4, 0xdd, 0x79, 0xd4, 0x76, 0x79, 0x83, 0x3c, 0xe9, 0x15, 0x6e, 0xb6, 0x38, 0xe0, 0x13, 0x1f, 0x3b, 0xe4, 0xfd, 0xda, 0x35, 0x0b, 0x4b, 0x2e, 0x1a, 0xda, 0xaf, 0x5f, - /* (2^ 86)P */ 0x81, 0x75, 0x19, 0x17, 0xdf, 0xbb, 0x00, 0x36, 0xc2, 0xd2, 0x3c, 0xbe, 0x0b, 0x05, 0x72, 0x39, 0x86, 0xbe, 0xd5, 0xbd, 0x6d, 0x90, 0x38, 0x59, 0x0f, 0x86, 0x9b, 0x3f, 0xe4, 0xe5, 0xfc, 0x34, - /* (2^ 87)P */ 0x02, 0x4d, 0xd1, 0x42, 0xcd, 0xa4, 0xa8, 0x75, 0x65, 0xdf, 0x41, 0x34, 0xc5, 0xab, 0x8d, 0x82, 0xd3, 0x31, 0xe1, 0xd2, 0xed, 0xab, 0xdc, 0x33, 0x5f, 0xd2, 0x14, 0xb8, 0x6f, 0xd7, 0xba, 0x3e, - /* (2^ 88)P */ 0x0f, 0xe1, 0x70, 0x6f, 0x56, 0x6f, 0x90, 0xd4, 0x5a, 0x0f, 0x69, 0x51, 0xaa, 0xf7, 0x12, 0x5d, 0xf2, 0xfc, 0xce, 0x76, 0x6e, 0xb1, 0xad, 0x45, 0x99, 0x29, 0x23, 0xad, 0xae, 0x68, 0xf7, 0x01, - /* (2^ 89)P */ 0xbd, 0xfe, 0x48, 0x62, 0x7b, 0xc7, 0x6c, 0x2b, 0xfd, 0xaf, 0x3a, 0xec, 0x28, 0x06, 0xd3, 0x3c, 0x6a, 0x48, 0xef, 0xd4, 0x80, 0x0b, 0x1c, 0xce, 0x23, 0x6c, 0xf6, 0xa6, 0x2e, 0xff, 0x3b, 0x4c, - /* (2^ 90)P */ 0x5f, 0xeb, 0xea, 0x4a, 0x09, 0xc4, 0x2e, 0x3f, 0xa7, 0x2c, 0x37, 0x6e, 0x28, 0x9b, 0xb1, 0x61, 0x1d, 0x70, 0x2a, 0xde, 0x66, 0xa9, 0xef, 0x5e, 0xef, 0xe3, 0x55, 0xde, 0x65, 0x05, 0xb2, 0x23, - /* (2^ 91)P */ 0x57, 0x85, 0xd5, 0x79, 0x52, 0xca, 0x01, 0xe3, 0x4f, 0x87, 0xc2, 0x27, 0xce, 0xd4, 0xb2, 0x07, 0x67, 0x1d, 0xcf, 0x9d, 0x8a, 0xcd, 0x32, 0xa5, 0x56, 0xff, 0x2b, 0x3f, 0xe2, 0xfe, 0x52, 0x2a, - /* (2^ 92)P */ 0x3d, 0x66, 0xd8, 0x7c, 0xb3, 0xef, 0x24, 0x86, 0x94, 0x75, 0xbd, 0xff, 0x20, 0xac, 0xc7, 0xbb, 0x45, 0x74, 0xd3, 0x82, 0x9c, 0x5e, 0xb8, 0x57, 0x66, 0xec, 0xa6, 0x86, 0xcb, 0x52, 0x30, 0x7b, - /* (2^ 93)P */ 0x1e, 0xe9, 0x25, 0x25, 0xad, 0xf0, 0x82, 0x34, 0xa0, 0xdc, 0x8e, 0xd2, 0x43, 0x80, 0xb6, 0x2c, 0x3a, 0x00, 0x1b, 0x2e, 0x05, 0x6d, 0x4f, 0xaf, 0x0a, 0x1b, 0x78, 0x29, 0x25, 0x8c, 0x5f, 0x18, - /* (2^ 94)P */ 0xd6, 0xe0, 0x0c, 0xd8, 0x5b, 0xde, 0x41, 0xaa, 0xd6, 0xe9, 0x53, 0x68, 0x41, 0xb2, 0x07, 0x94, 0x3a, 0x4c, 0x7f, 0x35, 0x6e, 0xc3, 0x3e, 0x56, 0xce, 0x7b, 0x29, 0x0e, 0xdd, 0xb8, 0xc4, 0x4c, - /* (2^ 95)P */ 0x0e, 0x73, 0xb8, 0xff, 0x52, 0x1a, 0xfc, 0xa2, 0x37, 0x8e, 0x05, 0x67, 0x6e, 0xf1, 0x11, 0x18, 0xe1, 0x4e, 0xdf, 0xcd, 0x66, 0xa3, 0xf9, 0x10, 0x99, 0xf0, 0xb9, 0xa0, 0xc4, 0xa0, 0xf4, 0x72, - /* (2^ 96)P */ 0xa7, 0x4e, 0x3f, 0x66, 0x6f, 0xc0, 0x16, 0x8c, 0xba, 0x0f, 0x97, 0x4e, 0xf7, 0x3a, 0x3b, 0x69, 0x45, 0xc3, 0x9e, 0xd6, 0xf1, 0xe7, 0x02, 0x21, 0x89, 0x80, 0x8a, 0x96, 0xbc, 0x3c, 0xa5, 0x0b, - /* (2^ 97)P */ 0x37, 0x55, 0xa1, 0xfe, 0xc7, 0x9d, 0x3d, 0xca, 0x93, 0x64, 0x53, 0x51, 0xbb, 0x24, 0x68, 0x4c, 0xb1, 0x06, 0x40, 0x84, 0x14, 0x63, 0x88, 0xb9, 0x60, 0xcc, 0x54, 0xb4, 0x2a, 0xa7, 0xd2, 0x40, - /* (2^ 98)P */ 0x75, 0x09, 0x57, 0x12, 0xb7, 0xa1, 0x36, 0x59, 0x57, 0xa6, 0xbd, 0xde, 0x48, 0xd6, 0xb9, 0x91, 0xea, 0x30, 0x43, 0xb6, 0x4b, 0x09, 0x44, 0x33, 0xd0, 0x51, 0xee, 0x12, 0x0d, 0xa1, 0x6b, 0x00, - /* (2^ 99)P */ 0x58, 0x5d, 0xde, 0xf5, 0x68, 0x84, 0x22, 0x19, 0xb0, 0x05, 0xcc, 0x38, 0x4c, 0x2f, 0xb1, 0x0e, 0x90, 0x19, 0x60, 0xd5, 0x9d, 0x9f, 0x03, 0xa1, 0x0b, 0x0e, 0xff, 0x4f, 0xce, 0xd4, 0x02, 0x45, - /* (2^100)P */ 0x89, 0xc1, 0x37, 0x68, 0x10, 0x54, 0x20, 0xeb, 0x3c, 0xb9, 0xd3, 0x6d, 0x4c, 0x54, 0xf6, 0xd0, 0x4f, 0xd7, 0x16, 0xc4, 0x64, 0x70, 0x72, 0x40, 0xf0, 0x2e, 0x50, 0x4b, 0x11, 0xc6, 0x15, 0x6e, - /* (2^101)P */ 0x6b, 0xa7, 0xb1, 0xcf, 0x98, 0xa3, 0xf2, 0x4d, 0xb1, 0xf6, 0xf2, 0x19, 0x74, 0x6c, 0x25, 0x11, 0x43, 0x60, 0x6e, 0x06, 0x62, 0x79, 0x49, 0x4a, 0x44, 0x5b, 0x35, 0x41, 0xab, 0x3a, 0x5b, 0x70, - /* (2^102)P */ 0xd8, 0xb1, 0x97, 0xd7, 0x36, 0xf5, 0x5e, 0x36, 0xdb, 0xf0, 0xdd, 0x22, 0xd6, 0x6b, 0x07, 0x00, 0x88, 0x5a, 0x57, 0xe0, 0xb0, 0x33, 0xbf, 0x3b, 0x4d, 0xca, 0xe4, 0xc8, 0x05, 0xaa, 0x77, 0x37, - /* (2^103)P */ 0x5f, 0xdb, 0x78, 0x55, 0xc8, 0x45, 0x27, 0x39, 0xe2, 0x5a, 0xae, 0xdb, 0x49, 0x41, 0xda, 0x6f, 0x67, 0x98, 0xdc, 0x8a, 0x0b, 0xb0, 0xf0, 0xb1, 0xa3, 0x1d, 0x6f, 0xd3, 0x37, 0x34, 0x96, 0x09, - /* (2^104)P */ 0x53, 0x38, 0xdc, 0xa5, 0x90, 0x4e, 0x82, 0x7e, 0xbd, 0x5c, 0x13, 0x1f, 0x64, 0xf6, 0xb5, 0xcc, 0xcc, 0x8f, 0xce, 0x87, 0x6c, 0xd8, 0x36, 0x67, 0x9f, 0x24, 0x04, 0x66, 0xe2, 0x3c, 0x5f, 0x62, - /* (2^105)P */ 0x3f, 0xf6, 0x02, 0x95, 0x05, 0xc8, 0x8a, 0xaf, 0x69, 0x14, 0x35, 0x2e, 0x0a, 0xe7, 0x05, 0x0c, 0x05, 0x63, 0x4b, 0x76, 0x9c, 0x2e, 0x29, 0x35, 0xc3, 0x3a, 0xe2, 0xc7, 0x60, 0x43, 0x39, 0x1a, - /* (2^106)P */ 0x64, 0x32, 0x18, 0x51, 0x32, 0xd5, 0xc6, 0xd5, 0x4f, 0xb7, 0xc2, 0x43, 0xbd, 0x5a, 0x06, 0x62, 0x9b, 0x3f, 0x97, 0x3b, 0xd0, 0xf5, 0xfb, 0xb5, 0x5e, 0x6e, 0x20, 0x61, 0x36, 0xda, 0xa3, 0x13, - /* (2^107)P */ 0xe5, 0x94, 0x5d, 0x72, 0x37, 0x58, 0xbd, 0xc6, 0xc5, 0x16, 0x50, 0x20, 0x12, 0x09, 0xe3, 0x18, 0x68, 0x3c, 0x03, 0x70, 0x15, 0xce, 0x88, 0x20, 0x87, 0x79, 0x83, 0x5c, 0x49, 0x1f, 0xba, 0x7f, - /* (2^108)P */ 0x9d, 0x07, 0xf9, 0xf2, 0x23, 0x74, 0x8c, 0x5a, 0xc5, 0x3f, 0x02, 0x34, 0x7b, 0x15, 0x35, 0x17, 0x51, 0xb3, 0xfa, 0xd2, 0x9a, 0xb4, 0xf9, 0xe4, 0x3c, 0xe3, 0x78, 0xc8, 0x72, 0xff, 0x91, 0x66, - /* (2^109)P */ 0x3e, 0xff, 0x5e, 0xdc, 0xde, 0x2a, 0x2c, 0x12, 0xf4, 0x6c, 0x95, 0xd8, 0xf1, 0x4b, 0xdd, 0xf8, 0xda, 0x5b, 0x9e, 0x9e, 0x5d, 0x20, 0x86, 0xeb, 0x43, 0xc7, 0x75, 0xd9, 0xb9, 0x92, 0x9b, 0x04, - /* (2^110)P */ 0x5a, 0xc0, 0xf6, 0xb0, 0x30, 0x97, 0x37, 0xa5, 0x53, 0xa5, 0xf3, 0xc6, 0xac, 0xff, 0xa0, 0x72, 0x6d, 0xcd, 0x0d, 0xb2, 0x34, 0x2c, 0x03, 0xb0, 0x4a, 0x16, 0xd5, 0x88, 0xbc, 0x9d, 0x0e, 0x47, - /* (2^111)P */ 0x47, 0xc0, 0x37, 0xa2, 0x0c, 0xf1, 0x9c, 0xb1, 0xa2, 0x81, 0x6c, 0x1f, 0x71, 0x66, 0x54, 0xb6, 0x43, 0x0b, 0xd8, 0x6d, 0xd1, 0x1b, 0x32, 0xb3, 0x8e, 0xbe, 0x5f, 0x0c, 0x60, 0x4f, 0xc1, 0x48, - /* (2^112)P */ 0x03, 0xc8, 0xa6, 0x4a, 0x26, 0x1c, 0x45, 0x66, 0xa6, 0x7d, 0xfa, 0xa4, 0x04, 0x39, 0x6e, 0xb6, 0x95, 0x83, 0x12, 0xb3, 0xb0, 0x19, 0x5f, 0xd4, 0x10, 0xbc, 0xc9, 0xc3, 0x27, 0x26, 0x60, 0x31, - /* (2^113)P */ 0x0d, 0xe1, 0xe4, 0x32, 0x48, 0xdc, 0x20, 0x31, 0xf7, 0x17, 0xc7, 0x56, 0x67, 0xc4, 0x20, 0xeb, 0x94, 0x02, 0x28, 0x67, 0x3f, 0x2e, 0xf5, 0x00, 0x09, 0xc5, 0x30, 0x47, 0xc1, 0x4f, 0x6d, 0x56, - /* (2^114)P */ 0x06, 0x72, 0x83, 0xfd, 0x40, 0x5d, 0x3a, 0x7e, 0x7a, 0x54, 0x59, 0x71, 0xdc, 0x26, 0xe9, 0xc1, 0x95, 0x60, 0x8d, 0xa6, 0xfb, 0x30, 0x67, 0x21, 0xa7, 0xce, 0x69, 0x3f, 0x84, 0xc3, 0xe8, 0x22, - /* (2^115)P */ 0x2b, 0x4b, 0x0e, 0x93, 0xe8, 0x74, 0xd0, 0x33, 0x16, 0x58, 0xd1, 0x84, 0x0e, 0x35, 0xe4, 0xb6, 0x65, 0x23, 0xba, 0xd6, 0x6a, 0xc2, 0x34, 0x55, 0xf3, 0xf3, 0xf1, 0x89, 0x2f, 0xc1, 0x73, 0x77, - /* (2^116)P */ 0xaa, 0x62, 0x79, 0xa5, 0x4d, 0x40, 0xba, 0x8c, 0x56, 0xce, 0x99, 0x19, 0xa8, 0x97, 0x98, 0x5b, 0xfc, 0x92, 0x16, 0x12, 0x2f, 0x86, 0x8e, 0x50, 0x91, 0xc2, 0x93, 0xa0, 0x7f, 0x90, 0x81, 0x3a, - /* (2^117)P */ 0x10, 0xa5, 0x25, 0x47, 0xff, 0xd0, 0xde, 0x0d, 0x03, 0xc5, 0x3f, 0x67, 0x10, 0xcc, 0xd8, 0x10, 0x89, 0x4e, 0x1f, 0x9f, 0x1c, 0x15, 0x9d, 0x5b, 0x4c, 0xa4, 0x09, 0xcb, 0xd5, 0xc1, 0xa5, 0x32, - /* (2^118)P */ 0xfb, 0x41, 0x05, 0xb9, 0x42, 0xa4, 0x0a, 0x1e, 0xdb, 0x85, 0xb4, 0xc1, 0x7c, 0xeb, 0x85, 0x5f, 0xe5, 0xf2, 0x9d, 0x8a, 0xce, 0x95, 0xe5, 0xbe, 0x36, 0x22, 0x42, 0x22, 0xc7, 0x96, 0xe4, 0x25, - /* (2^119)P */ 0xb9, 0xe5, 0x0f, 0xcd, 0x46, 0x3c, 0xdf, 0x5e, 0x88, 0x33, 0xa4, 0xd2, 0x7e, 0x5a, 0xe7, 0x34, 0x52, 0xe3, 0x61, 0xd7, 0x11, 0xde, 0x88, 0xe4, 0x5c, 0x54, 0x85, 0xa0, 0x01, 0x8a, 0x87, 0x0e, - /* (2^120)P */ 0x04, 0xbb, 0x21, 0xe0, 0x77, 0x3c, 0x49, 0xba, 0x9a, 0x89, 0xdf, 0xc7, 0x43, 0x18, 0x4d, 0x2b, 0x67, 0x0d, 0xe8, 0x7a, 0x48, 0x7a, 0xa3, 0x9e, 0x94, 0x17, 0xe4, 0x11, 0x80, 0x95, 0xa9, 0x67, - /* (2^121)P */ 0x65, 0xb0, 0x97, 0x66, 0x1a, 0x05, 0x58, 0x4b, 0xd4, 0xa6, 0x6b, 0x8d, 0x7d, 0x3f, 0xe3, 0x47, 0xc1, 0x46, 0xca, 0x83, 0xd4, 0xa8, 0x4d, 0xbb, 0x0d, 0xdb, 0xc2, 0x81, 0xa1, 0xca, 0xbe, 0x68, - /* (2^122)P */ 0xa5, 0x9a, 0x98, 0x0b, 0xe9, 0x80, 0x89, 0x8d, 0x9b, 0xc9, 0x93, 0x2c, 0x4a, 0xb1, 0x5e, 0xf9, 0xa2, 0x73, 0x6e, 0x79, 0xc4, 0xc7, 0xc6, 0x51, 0x69, 0xb5, 0xef, 0xb5, 0x63, 0x83, 0x22, 0x6e, - /* (2^123)P */ 0xc8, 0x24, 0xd6, 0x2d, 0xb0, 0xc0, 0xbb, 0xc6, 0xee, 0x70, 0x81, 0xec, 0x7d, 0xb4, 0x7e, 0x77, 0xa9, 0xaf, 0xcf, 0x04, 0xa0, 0x15, 0xde, 0x3c, 0x9b, 0xbf, 0x60, 0x71, 0x08, 0xbc, 0xc6, 0x1d, - /* (2^124)P */ 0x02, 0x40, 0xc3, 0xee, 0x43, 0xe0, 0x07, 0x2e, 0x7f, 0xdc, 0x68, 0x7a, 0x67, 0xfc, 0xe9, 0x18, 0x9a, 0x5b, 0xd1, 0x8b, 0x18, 0x03, 0xda, 0xd8, 0x53, 0x82, 0x56, 0x00, 0xbb, 0xc3, 0xfb, 0x48, - /* (2^125)P */ 0xe1, 0x4c, 0x65, 0xfb, 0x4c, 0x7d, 0x54, 0x57, 0xad, 0xe2, 0x58, 0xa0, 0x82, 0x5b, 0x56, 0xd3, 0x78, 0x44, 0x15, 0xbf, 0x0b, 0xaf, 0x3e, 0xf6, 0x18, 0xbb, 0xdf, 0x14, 0xf1, 0x1e, 0x53, 0x47, - /* (2^126)P */ 0x87, 0xc5, 0x78, 0x42, 0x0a, 0x63, 0xec, 0xe1, 0xf3, 0x83, 0x8e, 0xca, 0x46, 0xd5, 0x07, 0x55, 0x2b, 0x0c, 0xdc, 0x3a, 0xc6, 0x35, 0xe1, 0x85, 0x4e, 0x84, 0x82, 0x56, 0xa8, 0xef, 0xa7, 0x0a, - /* (2^127)P */ 0x15, 0xf6, 0xe1, 0xb3, 0xa8, 0x1b, 0x69, 0x72, 0xfa, 0x3f, 0xbe, 0x1f, 0x70, 0xe9, 0xb4, 0x32, 0x68, 0x78, 0xbb, 0x39, 0x2e, 0xd9, 0xb6, 0x97, 0xe8, 0x39, 0x2e, 0xa0, 0xde, 0x53, 0xfe, 0x2c, - /* (2^128)P */ 0xb0, 0x52, 0xcd, 0x85, 0xcd, 0x92, 0x73, 0x68, 0x31, 0x98, 0xe2, 0x10, 0xc9, 0x66, 0xff, 0x27, 0x06, 0x2d, 0x83, 0xa9, 0x56, 0x45, 0x13, 0x97, 0xa0, 0xf8, 0x84, 0x0a, 0x36, 0xb0, 0x9b, 0x26, - /* (2^129)P */ 0x5c, 0xf8, 0x43, 0x76, 0x45, 0x55, 0x6e, 0x70, 0x1b, 0x7d, 0x59, 0x9b, 0x8c, 0xa4, 0x34, 0x37, 0x72, 0xa4, 0xef, 0xc6, 0xe8, 0x91, 0xee, 0x7a, 0xe0, 0xd9, 0xa9, 0x98, 0xc1, 0xab, 0xd6, 0x5c, - /* (2^130)P */ 0x1a, 0xe4, 0x3c, 0xcb, 0x06, 0xde, 0x04, 0x0e, 0x38, 0xe1, 0x02, 0x34, 0x89, 0xeb, 0xc6, 0xd8, 0x72, 0x37, 0x6e, 0x68, 0xbb, 0x59, 0x46, 0x90, 0xc8, 0xa8, 0x6b, 0x74, 0x71, 0xc3, 0x15, 0x72, - /* (2^131)P */ 0xd9, 0xa2, 0xe4, 0xea, 0x7e, 0xa9, 0x12, 0xfd, 0xc5, 0xf2, 0x94, 0x63, 0x51, 0xb7, 0x14, 0x95, 0x94, 0xf2, 0x08, 0x92, 0x80, 0xd5, 0x6f, 0x26, 0xb9, 0x26, 0x9a, 0x61, 0x85, 0x70, 0x84, 0x5c, - /* (2^132)P */ 0xea, 0x94, 0xd6, 0xfe, 0x10, 0x54, 0x98, 0x52, 0x54, 0xd2, 0x2e, 0x4a, 0x93, 0x5b, 0x90, 0x3c, 0x67, 0xe4, 0x3b, 0x2d, 0x69, 0x47, 0xbb, 0x10, 0xe1, 0xe9, 0xe5, 0x69, 0x2d, 0x3d, 0x3b, 0x06, - /* (2^133)P */ 0xeb, 0x7d, 0xa5, 0xdd, 0xee, 0x26, 0x27, 0x47, 0x91, 0x18, 0xf4, 0x10, 0xae, 0xc4, 0xb6, 0xef, 0x14, 0x76, 0x30, 0x7b, 0x91, 0x41, 0x16, 0x2b, 0x7c, 0x5b, 0xf4, 0xc4, 0x4f, 0x55, 0x7c, 0x11, - /* (2^134)P */ 0x12, 0x88, 0x9d, 0x8f, 0x11, 0xf3, 0x7c, 0xc0, 0x39, 0x79, 0x01, 0x50, 0x20, 0xd8, 0xdb, 0x01, 0x27, 0x28, 0x1b, 0x17, 0xf4, 0x03, 0xe8, 0xd7, 0xea, 0x25, 0xd2, 0x87, 0x74, 0xe8, 0x15, 0x10, - /* (2^135)P */ 0x4d, 0xcc, 0x3a, 0xd2, 0xfe, 0xe3, 0x8d, 0xc5, 0x2d, 0xbe, 0xa7, 0x94, 0xc2, 0x91, 0xdb, 0x50, 0x57, 0xf4, 0x9c, 0x1c, 0x3d, 0xd4, 0x94, 0x0b, 0x4a, 0x52, 0x37, 0x6e, 0xfa, 0x40, 0x16, 0x6b, - /* (2^136)P */ 0x09, 0x0d, 0xda, 0x5f, 0x6c, 0x34, 0x2f, 0x69, 0x51, 0x31, 0x4d, 0xfa, 0x59, 0x1c, 0x0b, 0x20, 0x96, 0xa2, 0x77, 0x07, 0x76, 0x6f, 0xc4, 0xb8, 0xcf, 0xfb, 0xfd, 0x3f, 0x5f, 0x39, 0x38, 0x4b, - /* (2^137)P */ 0x71, 0xd6, 0x54, 0xbe, 0x00, 0x5e, 0xd2, 0x18, 0xa6, 0xab, 0xc8, 0xbe, 0x82, 0x05, 0xd5, 0x60, 0x82, 0xb9, 0x78, 0x3b, 0x26, 0x8f, 0xad, 0x87, 0x32, 0x04, 0xda, 0x9c, 0x4e, 0xf6, 0xfd, 0x50, - /* (2^138)P */ 0xf0, 0xdc, 0x78, 0xc5, 0xaa, 0x67, 0xf5, 0x90, 0x3b, 0x13, 0xa3, 0xf2, 0x0e, 0x9b, 0x1e, 0xef, 0x71, 0xde, 0xd9, 0x42, 0x92, 0xba, 0xeb, 0x0e, 0xc7, 0x01, 0x31, 0xf0, 0x9b, 0x3c, 0x47, 0x15, - /* (2^139)P */ 0x95, 0x80, 0xb7, 0x56, 0xae, 0xe8, 0x77, 0x7c, 0x8e, 0x07, 0x6f, 0x6e, 0x66, 0xe7, 0x78, 0xb6, 0x1f, 0xba, 0x48, 0x53, 0x61, 0xb9, 0xa0, 0x2d, 0x0b, 0x3f, 0x73, 0xff, 0xc1, 0x31, 0xf9, 0x7c, - /* (2^140)P */ 0x6c, 0x36, 0x0a, 0x0a, 0xf5, 0x57, 0xb3, 0x26, 0x32, 0xd7, 0x87, 0x2b, 0xf4, 0x8c, 0x70, 0xe9, 0xc0, 0xb2, 0x1c, 0xf9, 0xa5, 0xee, 0x3a, 0xc1, 0x4c, 0xbb, 0x43, 0x11, 0x99, 0x0c, 0xd9, 0x35, - /* (2^141)P */ 0xdc, 0xd9, 0xa0, 0xa9, 0x04, 0xc4, 0xc1, 0x47, 0x51, 0xd2, 0x72, 0x19, 0x45, 0x58, 0x9e, 0x65, 0x31, 0x8c, 0xb3, 0x73, 0xc4, 0xa8, 0x75, 0x38, 0x24, 0x1f, 0x56, 0x79, 0xd3, 0x9e, 0xbd, 0x1f, - /* (2^142)P */ 0x8d, 0xc2, 0x1e, 0xd4, 0x6f, 0xbc, 0xfa, 0x11, 0xca, 0x2d, 0x2a, 0xcd, 0xe3, 0xdf, 0xf8, 0x7e, 0x95, 0x45, 0x40, 0x8c, 0x5d, 0x3b, 0xe7, 0x72, 0x27, 0x2f, 0xb7, 0x54, 0x49, 0xfa, 0x35, 0x61, - /* (2^143)P */ 0x9c, 0xb6, 0x24, 0xde, 0xa2, 0x32, 0xfc, 0xcc, 0x88, 0x5d, 0x09, 0x1f, 0x8c, 0x69, 0x55, 0x3f, 0x29, 0xf9, 0xc3, 0x5a, 0xed, 0x50, 0x33, 0xbe, 0xeb, 0x7e, 0x47, 0xca, 0x06, 0xf8, 0x9b, 0x5e, - /* (2^144)P */ 0x68, 0x9f, 0x30, 0x3c, 0xb6, 0x8f, 0xce, 0xe9, 0xf4, 0xf9, 0xe1, 0x65, 0x35, 0xf6, 0x76, 0x53, 0xf1, 0x93, 0x63, 0x5a, 0xb3, 0xcf, 0xaf, 0xd1, 0x06, 0x35, 0x62, 0xe5, 0xed, 0xa1, 0x32, 0x66, - /* (2^145)P */ 0x4c, 0xed, 0x2d, 0x0c, 0x39, 0x6c, 0x7d, 0x0b, 0x1f, 0xcb, 0x04, 0xdf, 0x81, 0x32, 0xcb, 0x56, 0xc7, 0xc3, 0xec, 0x49, 0x12, 0x5a, 0x30, 0x66, 0x2a, 0xa7, 0x8c, 0xa3, 0x60, 0x8b, 0x58, 0x5d, - /* (2^146)P */ 0x2d, 0xf4, 0xe5, 0xe8, 0x78, 0xbf, 0xec, 0xa6, 0xec, 0x3e, 0x8a, 0x3c, 0x4b, 0xb4, 0xee, 0x86, 0x04, 0x16, 0xd2, 0xfb, 0x48, 0x9c, 0x21, 0xec, 0x31, 0x67, 0xc3, 0x17, 0xf5, 0x1a, 0xaf, 0x1a, - /* (2^147)P */ 0xe7, 0xbd, 0x69, 0x67, 0x83, 0xa2, 0x06, 0xc3, 0xdb, 0x2a, 0x1e, 0x2b, 0x62, 0x80, 0x82, 0x20, 0xa6, 0x94, 0xff, 0xfb, 0x1f, 0xf5, 0x27, 0x80, 0x6b, 0xf2, 0x24, 0x11, 0xce, 0xa1, 0xcf, 0x76, - /* (2^148)P */ 0xb6, 0xab, 0x22, 0x24, 0x56, 0x00, 0xeb, 0x18, 0xc3, 0x29, 0x8c, 0x8f, 0xd5, 0xc4, 0x77, 0xf3, 0x1a, 0x56, 0x31, 0xf5, 0x07, 0xc2, 0xbb, 0x4d, 0x27, 0x8a, 0x12, 0x82, 0xf0, 0xb7, 0x53, 0x02, - /* (2^149)P */ 0xe0, 0x17, 0x2c, 0xb6, 0x1c, 0x09, 0x1f, 0x3d, 0xa9, 0x28, 0x46, 0xd6, 0xab, 0xe1, 0x60, 0x48, 0x53, 0x42, 0x9d, 0x30, 0x36, 0x74, 0xd1, 0x52, 0x76, 0xe5, 0xfa, 0x3e, 0xe1, 0x97, 0x6f, 0x35, - /* (2^150)P */ 0x5b, 0x53, 0x50, 0xa1, 0x1a, 0xe1, 0x51, 0xd3, 0xcc, 0x78, 0xd8, 0x1d, 0xbb, 0x45, 0x6b, 0x3e, 0x98, 0x2c, 0xd9, 0xbe, 0x28, 0x61, 0x77, 0x0c, 0xb8, 0x85, 0x28, 0x03, 0x93, 0xae, 0x34, 0x1d, - /* (2^151)P */ 0xc3, 0xa4, 0x5b, 0xa8, 0x8c, 0x48, 0xa0, 0x4b, 0xce, 0xe6, 0x9c, 0x3c, 0xc3, 0x48, 0x53, 0x98, 0x70, 0xa7, 0xbd, 0x97, 0x6f, 0x4c, 0x12, 0x66, 0x4a, 0x12, 0x54, 0x06, 0x29, 0xa0, 0x81, 0x0f, - /* (2^152)P */ 0xfd, 0x86, 0x9b, 0x56, 0xa6, 0x9c, 0xd0, 0x9e, 0x2d, 0x9a, 0xaf, 0x18, 0xfd, 0x09, 0x10, 0x81, 0x0a, 0xc2, 0xd8, 0x93, 0x3f, 0xd0, 0x08, 0xff, 0x6b, 0xf2, 0xae, 0x9f, 0x19, 0x48, 0xa1, 0x52, - /* (2^153)P */ 0x73, 0x1b, 0x8d, 0x2d, 0xdc, 0xf9, 0x03, 0x3e, 0x70, 0x1a, 0x96, 0x73, 0x18, 0x80, 0x05, 0x42, 0x70, 0x59, 0xa3, 0x41, 0xf0, 0x87, 0xd9, 0xc0, 0x49, 0xd5, 0xc0, 0xa1, 0x15, 0x1f, 0xaa, 0x07, - /* (2^154)P */ 0x24, 0x72, 0xd2, 0x8c, 0xe0, 0x6c, 0xd4, 0xdf, 0x39, 0x42, 0x4e, 0x93, 0x4f, 0x02, 0x0a, 0x6d, 0x59, 0x7b, 0x89, 0x99, 0x63, 0x7a, 0x8a, 0x80, 0xa2, 0x95, 0x3d, 0xe1, 0xe9, 0x56, 0x45, 0x0a, - /* (2^155)P */ 0x45, 0x30, 0xc1, 0xe9, 0x1f, 0x99, 0x1a, 0xd2, 0xb8, 0x51, 0x77, 0xfe, 0x48, 0x85, 0x0e, 0x9b, 0x35, 0x00, 0xf3, 0x4b, 0xcb, 0x43, 0xa6, 0x5d, 0x21, 0xf7, 0x40, 0x39, 0xd6, 0x28, 0xdb, 0x77, - /* (2^156)P */ 0x11, 0x90, 0xdc, 0x4a, 0x61, 0xeb, 0x5e, 0xfc, 0xeb, 0x11, 0xc4, 0xe8, 0x9a, 0x41, 0x29, 0x52, 0x74, 0xcf, 0x1d, 0x7d, 0x78, 0xe7, 0xc3, 0x9e, 0xb5, 0x4c, 0x6e, 0x21, 0x3e, 0x05, 0x0d, 0x34, - /* (2^157)P */ 0xb4, 0xf2, 0x8d, 0xb4, 0x39, 0xaf, 0xc7, 0xca, 0x94, 0x0a, 0xa1, 0x71, 0x28, 0xec, 0xfa, 0xc0, 0xed, 0x75, 0xa5, 0x5c, 0x24, 0x69, 0x0a, 0x14, 0x4c, 0x3a, 0x27, 0x34, 0x71, 0xc3, 0xf1, 0x0c, - /* (2^158)P */ 0xa5, 0xb8, 0x24, 0xc2, 0x6a, 0x30, 0xee, 0xc8, 0xb0, 0x30, 0x49, 0xcb, 0x7c, 0xee, 0xea, 0x57, 0x4f, 0xe7, 0xcb, 0xaa, 0xbd, 0x06, 0xe8, 0xa1, 0x7d, 0x65, 0xeb, 0x2e, 0x74, 0x62, 0x9a, 0x7d, - /* (2^159)P */ 0x30, 0x48, 0x6c, 0x54, 0xef, 0xb6, 0xb6, 0x9e, 0x2e, 0x6e, 0xb3, 0xdd, 0x1f, 0xca, 0x5c, 0x88, 0x05, 0x71, 0x0d, 0xef, 0x83, 0xf3, 0xb9, 0xe6, 0x12, 0x04, 0x2e, 0x9d, 0xef, 0x4f, 0x65, 0x58, - /* (2^160)P */ 0x26, 0x8e, 0x0e, 0xbe, 0xff, 0xc4, 0x05, 0xa9, 0x6e, 0x81, 0x31, 0x9b, 0xdf, 0xe5, 0x2d, 0x94, 0xe1, 0x88, 0x2e, 0x80, 0x3f, 0x72, 0x7d, 0x49, 0x8d, 0x40, 0x2f, 0x60, 0xea, 0x4d, 0x68, 0x30, - /* (2^161)P */ 0x34, 0xcb, 0xe6, 0xa3, 0x78, 0xa2, 0xe5, 0x21, 0xc4, 0x1d, 0x15, 0x5b, 0x6f, 0x6e, 0xfb, 0xae, 0x15, 0xca, 0x77, 0x9d, 0x04, 0x8e, 0x0b, 0xb3, 0x81, 0x89, 0xb9, 0x53, 0xcf, 0xc9, 0xc3, 0x28, - /* (2^162)P */ 0x2a, 0xdd, 0x6c, 0x55, 0x21, 0xb7, 0x7f, 0x28, 0x74, 0x22, 0x02, 0x97, 0xa8, 0x7c, 0x31, 0x0d, 0x58, 0x32, 0x54, 0x3a, 0x42, 0xc7, 0x68, 0x74, 0x2f, 0x64, 0xb5, 0x4e, 0x46, 0x11, 0x7f, 0x4a, - /* (2^163)P */ 0xa6, 0x3a, 0x19, 0x4d, 0x77, 0xa4, 0x37, 0xa2, 0xa1, 0x29, 0x21, 0xa9, 0x6e, 0x98, 0x65, 0xd8, 0x88, 0x1a, 0x7c, 0xf8, 0xec, 0x15, 0xc5, 0x24, 0xeb, 0xf5, 0x39, 0x5f, 0x57, 0x03, 0x40, 0x60, - /* (2^164)P */ 0x27, 0x9b, 0x0a, 0x57, 0x89, 0xf1, 0xb9, 0x47, 0x78, 0x4b, 0x5e, 0x46, 0xde, 0xce, 0x98, 0x2b, 0x20, 0x5c, 0xb8, 0xdb, 0x51, 0xf5, 0x6d, 0x02, 0x01, 0x19, 0xe2, 0x47, 0x10, 0xd9, 0xfc, 0x74, - /* (2^165)P */ 0xa3, 0xbf, 0xc1, 0x23, 0x0a, 0xa9, 0xe2, 0x13, 0xf6, 0x19, 0x85, 0x47, 0x4e, 0x07, 0xb0, 0x0c, 0x44, 0xcf, 0xf6, 0x3a, 0xbe, 0xcb, 0xf1, 0x5f, 0xbe, 0x2d, 0x81, 0xbe, 0x38, 0x54, 0xfe, 0x67, - /* (2^166)P */ 0xb0, 0x05, 0x0f, 0xa4, 0x4f, 0xf6, 0x3c, 0xd1, 0x87, 0x37, 0x28, 0x32, 0x2f, 0xfb, 0x4d, 0x05, 0xea, 0x2a, 0x0d, 0x7f, 0x5b, 0x91, 0x73, 0x41, 0x4e, 0x0d, 0x61, 0x1f, 0x4f, 0x14, 0x2f, 0x48, - /* (2^167)P */ 0x34, 0x82, 0x7f, 0xb4, 0x01, 0x02, 0x21, 0xf6, 0x90, 0xb9, 0x70, 0x9e, 0x92, 0xe1, 0x0a, 0x5d, 0x7c, 0x56, 0x49, 0xb0, 0x55, 0xf4, 0xd7, 0xdc, 0x01, 0x6f, 0x91, 0xf0, 0xf1, 0xd0, 0x93, 0x7e, - /* (2^168)P */ 0xfa, 0xb4, 0x7d, 0x8a, 0xf1, 0xcb, 0x79, 0xdd, 0x2f, 0xc6, 0x74, 0x6f, 0xbf, 0x91, 0x83, 0xbe, 0xbd, 0x91, 0x82, 0x4b, 0xd1, 0x45, 0x71, 0x02, 0x05, 0x17, 0xbf, 0x2c, 0xea, 0x73, 0x5a, 0x58, - /* (2^169)P */ 0xb2, 0x0d, 0x8a, 0x92, 0x3e, 0xa0, 0x5c, 0x48, 0xe7, 0x57, 0x28, 0x74, 0xa5, 0x01, 0xfc, 0x10, 0xa7, 0x51, 0xd5, 0xd6, 0xdb, 0x2e, 0x48, 0x2f, 0x8a, 0xdb, 0x8f, 0x04, 0xb5, 0x33, 0x04, 0x0f, - /* (2^170)P */ 0x47, 0x62, 0xdc, 0xd7, 0x8d, 0x2e, 0xda, 0x60, 0x9a, 0x81, 0xd4, 0x8c, 0xd3, 0xc9, 0xb4, 0x88, 0x97, 0x66, 0xf6, 0x01, 0xc0, 0x3a, 0x03, 0x13, 0x75, 0x7d, 0x36, 0x3b, 0xfe, 0x24, 0x3b, 0x27, - /* (2^171)P */ 0xd4, 0xb9, 0xb3, 0x31, 0x6a, 0xf6, 0xe8, 0xc6, 0xd5, 0x49, 0xdf, 0x94, 0xa4, 0x14, 0x15, 0x28, 0xa7, 0x3d, 0xb2, 0xc8, 0xdf, 0x6f, 0x72, 0xd1, 0x48, 0xe5, 0xde, 0x03, 0xd1, 0xe7, 0x3a, 0x4b, - /* (2^172)P */ 0x7e, 0x9d, 0x4b, 0xce, 0x19, 0x6e, 0x25, 0xc6, 0x1c, 0xc6, 0xe3, 0x86, 0xf1, 0x5c, 0x5c, 0xff, 0x45, 0xc1, 0x8e, 0x4b, 0xa3, 0x3c, 0xc6, 0xac, 0x74, 0x65, 0xe6, 0xfe, 0x88, 0x18, 0x62, 0x74, - /* (2^173)P */ 0x1e, 0x0a, 0x29, 0x45, 0x96, 0x40, 0x6f, 0x95, 0x2e, 0x96, 0x3a, 0x26, 0xe3, 0xf8, 0x0b, 0xef, 0x7b, 0x64, 0xc2, 0x5e, 0xeb, 0x50, 0x6a, 0xed, 0x02, 0x75, 0xca, 0x9d, 0x3a, 0x28, 0x94, 0x06, - /* (2^174)P */ 0xd1, 0xdc, 0xa2, 0x43, 0x36, 0x96, 0x9b, 0x76, 0x53, 0x53, 0xfc, 0x09, 0xea, 0xc8, 0xb7, 0x42, 0xab, 0x7e, 0x39, 0x13, 0xee, 0x2a, 0x00, 0x4f, 0x3a, 0xd6, 0xb7, 0x19, 0x2c, 0x5e, 0x00, 0x63, - /* (2^175)P */ 0xea, 0x3b, 0x02, 0x63, 0xda, 0x36, 0x67, 0xca, 0xb7, 0x99, 0x2a, 0xb1, 0x6d, 0x7f, 0x6c, 0x96, 0xe1, 0xc5, 0x37, 0xc5, 0x90, 0x93, 0xe0, 0xac, 0xee, 0x89, 0xaa, 0xa1, 0x63, 0x60, 0x69, 0x0b, - /* (2^176)P */ 0xe5, 0x56, 0x8c, 0x28, 0x97, 0x3e, 0xb0, 0xeb, 0xe8, 0x8b, 0x8c, 0x93, 0x9f, 0x9f, 0x2a, 0x43, 0x71, 0x7f, 0x71, 0x5b, 0x3d, 0xa9, 0xa5, 0xa6, 0x97, 0x9d, 0x8f, 0xe1, 0xc3, 0xb4, 0x5f, 0x1a, - /* (2^177)P */ 0xce, 0xcd, 0x60, 0x1c, 0xad, 0xe7, 0x94, 0x1c, 0xa0, 0xc4, 0x02, 0xfc, 0x43, 0x2a, 0x20, 0xee, 0x20, 0x6a, 0xc4, 0x67, 0xd8, 0xe4, 0xaf, 0x8d, 0x58, 0x7b, 0xc2, 0x8a, 0x3c, 0x26, 0x10, 0x0a, - /* (2^178)P */ 0x4a, 0x2a, 0x43, 0xe4, 0xdf, 0xa9, 0xde, 0xd0, 0xc5, 0x77, 0x92, 0xbe, 0x7b, 0xf8, 0x6a, 0x85, 0x1a, 0xc7, 0x12, 0xc2, 0xac, 0x72, 0x84, 0xce, 0x91, 0x1e, 0xbb, 0x9b, 0x6d, 0x1b, 0x15, 0x6f, - /* (2^179)P */ 0x6a, 0xd5, 0xee, 0x7c, 0x52, 0x6c, 0x77, 0x26, 0xec, 0xfa, 0xf8, 0xfb, 0xb7, 0x1c, 0x21, 0x7d, 0xcc, 0x09, 0x46, 0xfd, 0xa6, 0x66, 0xae, 0x37, 0x42, 0x0c, 0x77, 0xd2, 0x02, 0xb7, 0x81, 0x1f, - /* (2^180)P */ 0x92, 0x83, 0xc5, 0xea, 0x57, 0xb0, 0xb0, 0x2f, 0x9d, 0x4e, 0x74, 0x29, 0xfe, 0x89, 0xdd, 0xe1, 0xf8, 0xb4, 0xbe, 0x17, 0xeb, 0xf8, 0x64, 0xc9, 0x1e, 0xd4, 0xa2, 0xc9, 0x73, 0x10, 0x57, 0x29, - /* (2^181)P */ 0x54, 0xe2, 0xc0, 0x81, 0x89, 0xa1, 0x48, 0xa9, 0x30, 0x28, 0xb2, 0x65, 0x9b, 0x36, 0xf6, 0x2d, 0xc6, 0xd3, 0xcf, 0x5f, 0xd7, 0xb2, 0x3e, 0xa3, 0x1f, 0xa0, 0x99, 0x41, 0xec, 0xd6, 0x8c, 0x07, - /* (2^182)P */ 0x2f, 0x0d, 0x90, 0xad, 0x41, 0x4a, 0x58, 0x4a, 0x52, 0x4c, 0xc7, 0xe2, 0x78, 0x2b, 0x14, 0x32, 0x78, 0xc9, 0x31, 0x84, 0x33, 0xe8, 0xc4, 0x68, 0xc2, 0x9f, 0x68, 0x08, 0x90, 0xea, 0x69, 0x7f, - /* (2^183)P */ 0x65, 0x82, 0xa3, 0x46, 0x1e, 0xc8, 0xf2, 0x52, 0xfd, 0x32, 0xa8, 0x04, 0x2d, 0x07, 0x78, 0xfd, 0x94, 0x9e, 0x35, 0x25, 0xfa, 0xd5, 0xd7, 0x8c, 0xd2, 0x29, 0xcc, 0x54, 0x74, 0x1b, 0xe7, 0x4d, - /* (2^184)P */ 0xc9, 0x6a, 0xda, 0x1e, 0xad, 0x60, 0xeb, 0x42, 0x3a, 0x9c, 0xc0, 0xdb, 0xdf, 0x37, 0xad, 0x0a, 0x91, 0xc1, 0x3c, 0xe3, 0x71, 0x4b, 0x00, 0x81, 0x3c, 0x80, 0x22, 0x51, 0x34, 0xbe, 0xe6, 0x44, - /* (2^185)P */ 0xdb, 0x20, 0x19, 0xba, 0x88, 0x83, 0xfe, 0x03, 0x08, 0xb0, 0x0d, 0x15, 0x32, 0x7c, 0xd5, 0xf5, 0x29, 0x0c, 0xf6, 0x1a, 0x28, 0xc4, 0xc8, 0x49, 0xee, 0x1a, 0x70, 0xde, 0x18, 0xb5, 0xed, 0x21, - /* (2^186)P */ 0x99, 0xdc, 0x06, 0x8f, 0x41, 0x3e, 0xb6, 0x7f, 0xb8, 0xd7, 0x66, 0xc1, 0x99, 0x0d, 0x46, 0xa4, 0x83, 0x0a, 0x52, 0xce, 0x48, 0x52, 0xdd, 0x24, 0x58, 0x83, 0x92, 0x2b, 0x71, 0xad, 0xc3, 0x5e, - /* (2^187)P */ 0x0f, 0x93, 0x17, 0xbd, 0x5f, 0x2a, 0x02, 0x15, 0xe3, 0x70, 0x25, 0xd8, 0x77, 0x4a, 0xf6, 0xa4, 0x12, 0x37, 0x78, 0x15, 0x69, 0x8d, 0xbc, 0x12, 0xbb, 0x0a, 0x62, 0xfc, 0xc0, 0x94, 0x81, 0x49, - /* (2^188)P */ 0x82, 0x6c, 0x68, 0x55, 0xd2, 0xd9, 0xa2, 0x38, 0xf0, 0x21, 0x3e, 0x19, 0xd9, 0x6b, 0x5c, 0x78, 0x84, 0x54, 0x4a, 0xb2, 0x1a, 0xc8, 0xd5, 0xe4, 0x89, 0x09, 0xe2, 0xb2, 0x60, 0x78, 0x30, 0x56, - /* (2^189)P */ 0xc4, 0x74, 0x4d, 0x8b, 0xf7, 0x55, 0x9d, 0x42, 0x31, 0x01, 0x35, 0x43, 0x46, 0x83, 0xf1, 0x22, 0xff, 0x1f, 0xc7, 0x98, 0x45, 0xc2, 0x60, 0x1e, 0xef, 0x83, 0x99, 0x97, 0x14, 0xf0, 0xf2, 0x59, - /* (2^190)P */ 0x44, 0x4a, 0x49, 0xeb, 0x56, 0x7d, 0xa4, 0x46, 0x8e, 0xa1, 0x36, 0xd6, 0x54, 0xa8, 0x22, 0x3e, 0x3b, 0x1c, 0x49, 0x74, 0x52, 0xe1, 0x46, 0xb3, 0xe7, 0xcd, 0x90, 0x53, 0x4e, 0xfd, 0xea, 0x2c, - /* (2^191)P */ 0x75, 0x66, 0x0d, 0xbe, 0x38, 0x85, 0x8a, 0xba, 0x23, 0x8e, 0x81, 0x50, 0xbb, 0x74, 0x90, 0x4b, 0xc3, 0x04, 0xd3, 0x85, 0x90, 0xb8, 0xda, 0xcb, 0xc4, 0x92, 0x61, 0xe5, 0xe0, 0x4f, 0xa2, 0x61, - /* (2^192)P */ 0xcb, 0x5b, 0x52, 0xdb, 0xe6, 0x15, 0x76, 0xcb, 0xca, 0xe4, 0x67, 0xa5, 0x35, 0x8c, 0x7d, 0xdd, 0x69, 0xdd, 0xfc, 0xca, 0x3a, 0x15, 0xb4, 0xe6, 0x66, 0x97, 0x3c, 0x7f, 0x09, 0x8e, 0x66, 0x2d, - /* (2^193)P */ 0xf0, 0x5e, 0xe5, 0x5c, 0x26, 0x7e, 0x7e, 0xa5, 0x67, 0xb9, 0xd4, 0x7c, 0x52, 0x4e, 0x9f, 0x5d, 0xe5, 0xd1, 0x2f, 0x49, 0x06, 0x36, 0xc8, 0xfb, 0xae, 0xf7, 0xc3, 0xb7, 0xbe, 0x52, 0x0d, 0x09, - /* (2^194)P */ 0x7c, 0x4d, 0x7b, 0x1e, 0x5a, 0x51, 0xb9, 0x09, 0xc0, 0x44, 0xda, 0x99, 0x25, 0x6a, 0x26, 0x1f, 0x04, 0x55, 0xc5, 0xe2, 0x48, 0x95, 0xc4, 0xa1, 0xcc, 0x15, 0x6f, 0x12, 0x87, 0x42, 0xf0, 0x7e, - /* (2^195)P */ 0x15, 0xef, 0x30, 0xbd, 0x9d, 0x65, 0xd1, 0xfe, 0x7b, 0x27, 0xe0, 0xc4, 0xee, 0xb9, 0x4a, 0x8b, 0x91, 0x32, 0xdf, 0xa5, 0x36, 0x62, 0x4d, 0x88, 0x88, 0xf7, 0x5c, 0xbf, 0xa6, 0x6e, 0xd9, 0x1f, - /* (2^196)P */ 0x9a, 0x0d, 0x19, 0x1f, 0x98, 0x61, 0xa1, 0x42, 0xc1, 0x52, 0x60, 0x7e, 0x50, 0x49, 0xd8, 0x61, 0xd5, 0x2c, 0x5a, 0x28, 0xbf, 0x13, 0xe1, 0x9f, 0xd8, 0x85, 0xad, 0xdb, 0x76, 0xd6, 0x22, 0x7c, - /* (2^197)P */ 0x7d, 0xd2, 0xfb, 0x2b, 0xed, 0x70, 0xe7, 0x82, 0xa5, 0xf5, 0x96, 0xe9, 0xec, 0xb2, 0x05, 0x4c, 0x50, 0x01, 0x90, 0xb0, 0xc2, 0xa9, 0x40, 0xcd, 0x64, 0xbf, 0xd9, 0x13, 0x92, 0x31, 0x95, 0x58, - /* (2^198)P */ 0x08, 0x2e, 0xea, 0x3f, 0x70, 0x5d, 0xcc, 0xe7, 0x8c, 0x18, 0xe2, 0x58, 0x12, 0x49, 0x0c, 0xb5, 0xf0, 0x5b, 0x20, 0x48, 0xaa, 0x0b, 0xe3, 0xcc, 0x62, 0x2d, 0xa3, 0xcf, 0x9c, 0x65, 0x7c, 0x53, - /* (2^199)P */ 0x88, 0xc0, 0xcf, 0x98, 0x3a, 0x62, 0xb6, 0x37, 0xa4, 0xac, 0xd6, 0xa4, 0x1f, 0xed, 0x9b, 0xfe, 0xb0, 0xd1, 0xa8, 0x56, 0x8e, 0x9b, 0xd2, 0x04, 0x75, 0x95, 0x51, 0x0b, 0xc4, 0x71, 0x5f, 0x72, - /* (2^200)P */ 0xe6, 0x9c, 0x33, 0xd0, 0x9c, 0xf8, 0xc7, 0x28, 0x8b, 0xc1, 0xdd, 0x69, 0x44, 0xb1, 0x67, 0x83, 0x2c, 0x65, 0xa1, 0xa6, 0x83, 0xda, 0x3a, 0x88, 0x17, 0x6c, 0x4d, 0x03, 0x74, 0x19, 0x5f, 0x58, - /* (2^201)P */ 0x88, 0x91, 0xb1, 0xf1, 0x66, 0xb2, 0xcf, 0x89, 0x17, 0x52, 0xc3, 0xe7, 0x63, 0x48, 0x3b, 0xe6, 0x6a, 0x52, 0xc0, 0xb4, 0xa6, 0x9d, 0x8c, 0xd8, 0x35, 0x46, 0x95, 0xf0, 0x9d, 0x5c, 0x03, 0x3e, - /* (2^202)P */ 0x9d, 0xde, 0x45, 0xfb, 0x12, 0x54, 0x9d, 0xdd, 0x0d, 0xf4, 0xcf, 0xe4, 0x32, 0x45, 0x68, 0xdd, 0x1c, 0x67, 0x1d, 0x15, 0x9b, 0x99, 0x5c, 0x4b, 0x90, 0xf6, 0xe7, 0x11, 0xc8, 0x2c, 0x8c, 0x2d, - /* (2^203)P */ 0x40, 0x5d, 0x05, 0x90, 0x1d, 0xbe, 0x54, 0x7f, 0x40, 0xaf, 0x4a, 0x46, 0xdf, 0xc5, 0x64, 0xa4, 0xbe, 0x17, 0xe9, 0xf0, 0x24, 0x96, 0x97, 0x33, 0x30, 0x6b, 0x35, 0x27, 0xc5, 0x8d, 0x01, 0x2c, - /* (2^204)P */ 0xd4, 0xb3, 0x30, 0xe3, 0x24, 0x50, 0x41, 0xa5, 0xd3, 0x52, 0x16, 0x69, 0x96, 0x3d, 0xff, 0x73, 0xf1, 0x59, 0x9b, 0xef, 0xc4, 0x42, 0xec, 0x94, 0x5a, 0x8e, 0xd0, 0x18, 0x16, 0x20, 0x47, 0x07, - /* (2^205)P */ 0x53, 0x1c, 0x41, 0xca, 0x8a, 0xa4, 0x6c, 0x4d, 0x19, 0x61, 0xa6, 0xcf, 0x2f, 0x5f, 0x41, 0x66, 0xff, 0x27, 0xe2, 0x51, 0x00, 0xd4, 0x4d, 0x9c, 0xeb, 0xf7, 0x02, 0x9a, 0xc0, 0x0b, 0x81, 0x59, - /* (2^206)P */ 0x1d, 0x10, 0xdc, 0xb3, 0x71, 0xb1, 0x7e, 0x2a, 0x8e, 0xf6, 0xfe, 0x9f, 0xb9, 0x5a, 0x1c, 0x44, 0xea, 0x59, 0xb3, 0x93, 0x9b, 0x5c, 0x02, 0x32, 0x2f, 0x11, 0x9d, 0x1e, 0xa7, 0xe0, 0x8c, 0x5e, - /* (2^207)P */ 0xfd, 0x03, 0x95, 0x42, 0x92, 0xcb, 0xcc, 0xbf, 0x55, 0x5d, 0x09, 0x2f, 0x75, 0xba, 0x71, 0xd2, 0x1e, 0x09, 0x2d, 0x97, 0x5e, 0xad, 0x5e, 0x34, 0xba, 0x03, 0x31, 0xa8, 0x11, 0xdf, 0xc8, 0x18, - /* (2^208)P */ 0x4c, 0x0f, 0xed, 0x9a, 0x9a, 0x94, 0xcd, 0x90, 0x7e, 0xe3, 0x60, 0x66, 0xcb, 0xf4, 0xd1, 0xc5, 0x0b, 0x2e, 0xc5, 0x56, 0x2d, 0xc5, 0xca, 0xb8, 0x0d, 0x8e, 0x80, 0xc5, 0x00, 0xe4, 0x42, 0x6e, - /* (2^209)P */ 0x23, 0xfd, 0xae, 0xee, 0x66, 0x69, 0xb4, 0xa3, 0xca, 0xcd, 0x9e, 0xe3, 0x0b, 0x1f, 0x4f, 0x0c, 0x1d, 0xa5, 0x83, 0xd6, 0xc9, 0xc8, 0x9d, 0x18, 0x1b, 0x35, 0x09, 0x4c, 0x05, 0x7f, 0xf2, 0x51, - /* (2^210)P */ 0x82, 0x06, 0x32, 0x2a, 0xcd, 0x7c, 0x48, 0x4c, 0x96, 0x1c, 0xdf, 0xb3, 0x5b, 0xa9, 0x7e, 0x58, 0xe8, 0xb8, 0x5c, 0x55, 0x9e, 0xf7, 0xcc, 0xc8, 0x3d, 0xd7, 0x06, 0xa2, 0x29, 0xc8, 0x7d, 0x54, - /* (2^211)P */ 0x06, 0x9b, 0xc3, 0x80, 0xcd, 0xa6, 0x22, 0xb8, 0xc6, 0xd4, 0x00, 0x20, 0x73, 0x54, 0x6d, 0xe9, 0x4d, 0x3b, 0x46, 0x91, 0x6f, 0x5b, 0x53, 0x28, 0x1d, 0x6e, 0x48, 0xe2, 0x60, 0x46, 0x8f, 0x22, - /* (2^212)P */ 0xbf, 0x3a, 0x8d, 0xde, 0x38, 0x95, 0x79, 0x98, 0x6e, 0xca, 0xeb, 0x45, 0x00, 0x33, 0xd8, 0x8c, 0x38, 0xe7, 0x21, 0x82, 0x00, 0x2a, 0x95, 0x79, 0xbb, 0xd2, 0x5c, 0x53, 0xa7, 0xe1, 0x22, 0x43, - /* (2^213)P */ 0x1c, 0x80, 0xd1, 0x19, 0x18, 0xc1, 0x14, 0xb1, 0xc7, 0x5e, 0x3f, 0x4f, 0xd8, 0xe4, 0x16, 0x20, 0x4c, 0x0f, 0x26, 0x09, 0xf4, 0x2d, 0x0e, 0xdd, 0x66, 0x72, 0x5f, 0xae, 0xc0, 0x62, 0xc3, 0x5e, - /* (2^214)P */ 0xee, 0xb4, 0xb2, 0xb8, 0x18, 0x2b, 0x46, 0xc0, 0xfb, 0x1a, 0x4d, 0x27, 0x50, 0xd9, 0xc8, 0x7c, 0xd2, 0x02, 0x6b, 0x43, 0x05, 0x71, 0x5f, 0xf2, 0xd3, 0xcc, 0xf9, 0xbf, 0xdc, 0xf8, 0xbb, 0x43, - /* (2^215)P */ 0xdf, 0xe9, 0x39, 0xa0, 0x67, 0x17, 0xad, 0xb6, 0x83, 0x35, 0x9d, 0xf6, 0xa8, 0x4d, 0x71, 0xb0, 0xf5, 0x31, 0x29, 0xb4, 0x18, 0xfa, 0x55, 0x5e, 0x61, 0x09, 0xc6, 0x33, 0x8f, 0x55, 0xd5, 0x4e, - /* (2^216)P */ 0xdd, 0xa5, 0x47, 0xc6, 0x01, 0x79, 0xe3, 0x1f, 0x57, 0xd3, 0x81, 0x80, 0x1f, 0xdf, 0x3d, 0x59, 0xa6, 0xd7, 0x3f, 0x81, 0xfd, 0xa4, 0x49, 0x02, 0x61, 0xaf, 0x9c, 0x4e, 0x27, 0xca, 0xac, 0x69, - /* (2^217)P */ 0xc9, 0x21, 0x07, 0x33, 0xea, 0xa3, 0x7b, 0x04, 0xa0, 0x1e, 0x7e, 0x0e, 0xc2, 0x3f, 0x42, 0x83, 0x60, 0x4a, 0x31, 0x01, 0xaf, 0xc0, 0xf4, 0x1d, 0x27, 0x95, 0x28, 0x89, 0xab, 0x2d, 0xa6, 0x09, - /* (2^218)P */ 0x00, 0xcb, 0xc6, 0x9c, 0xa4, 0x25, 0xb3, 0xa5, 0xb6, 0x6c, 0xb5, 0x54, 0xc6, 0x5d, 0x4b, 0xe9, 0xa0, 0x94, 0xc9, 0xad, 0x79, 0x87, 0xe2, 0x3b, 0xad, 0x4a, 0x3a, 0xba, 0xf8, 0xe8, 0x96, 0x42, - /* (2^219)P */ 0xab, 0x1e, 0x45, 0x1e, 0x76, 0x89, 0x86, 0x32, 0x4a, 0x59, 0x59, 0xff, 0x8b, 0x59, 0x4d, 0x2e, 0x4a, 0x08, 0xa7, 0xd7, 0x53, 0x68, 0xb9, 0x49, 0xa8, 0x20, 0x14, 0x60, 0x19, 0xa3, 0x80, 0x49, - /* (2^220)P */ 0x42, 0x2c, 0x55, 0x2f, 0xe1, 0xb9, 0x65, 0x95, 0x96, 0xfe, 0x00, 0x71, 0xdb, 0x18, 0x53, 0x8a, 0xd7, 0xd0, 0xad, 0x43, 0x4d, 0x0b, 0xc9, 0x05, 0xda, 0x4e, 0x5d, 0x6a, 0xd6, 0x4c, 0x8b, 0x53, - /* (2^221)P */ 0x9f, 0x03, 0x9f, 0xe8, 0xc3, 0x4f, 0xe9, 0xf4, 0x45, 0x80, 0x61, 0x6f, 0xf2, 0x9a, 0x2c, 0x59, 0x50, 0x95, 0x4b, 0xfd, 0xb5, 0x6e, 0xa3, 0x08, 0x19, 0x14, 0xed, 0xc2, 0xf6, 0xfa, 0xff, 0x25, - /* (2^222)P */ 0x54, 0xd3, 0x79, 0xcc, 0x59, 0x44, 0x43, 0x34, 0x6b, 0x47, 0xd5, 0xb1, 0xb4, 0xbf, 0xec, 0xee, 0x99, 0x5d, 0x61, 0x61, 0xa0, 0x34, 0xeb, 0xdd, 0x73, 0xb7, 0x64, 0xeb, 0xcc, 0xce, 0x29, 0x51, - /* (2^223)P */ 0x20, 0x35, 0x99, 0x94, 0x58, 0x21, 0x43, 0xee, 0x3b, 0x0b, 0x4c, 0xf1, 0x7c, 0x9c, 0x2f, 0x77, 0xd5, 0xda, 0xbe, 0x06, 0xe3, 0xfc, 0xe2, 0xd2, 0x97, 0x6a, 0xf0, 0x46, 0xb5, 0x42, 0x5f, 0x71, - /* (2^224)P */ 0x1a, 0x5f, 0x5b, 0xda, 0xce, 0xcd, 0x4e, 0x43, 0xa9, 0x41, 0x97, 0xa4, 0x15, 0x71, 0xa1, 0x0d, 0x2e, 0xad, 0xed, 0x73, 0x7c, 0xd7, 0x0b, 0x68, 0x41, 0x90, 0xdd, 0x4e, 0x35, 0x02, 0x7c, 0x48, - /* (2^225)P */ 0xc4, 0xd9, 0x0e, 0xa7, 0xf3, 0xef, 0xef, 0xb8, 0x02, 0xe3, 0x57, 0xe8, 0xa3, 0x2a, 0xa3, 0x56, 0xa0, 0xa5, 0xa2, 0x48, 0xbd, 0x68, 0x3a, 0xdf, 0x44, 0xc4, 0x76, 0x31, 0xb7, 0x50, 0xf6, 0x07, - /* (2^226)P */ 0xb1, 0xcc, 0xe0, 0x26, 0x16, 0x9b, 0x8b, 0xe3, 0x36, 0xfb, 0x09, 0x8b, 0xc1, 0x53, 0xe0, 0x79, 0x64, 0x49, 0xf9, 0xc9, 0x19, 0x03, 0xd9, 0x56, 0xc4, 0xf5, 0x9f, 0xac, 0xe7, 0x41, 0xa9, 0x1c, - /* (2^227)P */ 0xbb, 0xa0, 0x2f, 0x16, 0x29, 0xdf, 0xc4, 0x49, 0x05, 0x33, 0xb3, 0x82, 0x32, 0xcf, 0x88, 0x84, 0x7d, 0x43, 0xbb, 0xca, 0x14, 0xda, 0xdf, 0x95, 0x86, 0xad, 0xd5, 0x64, 0x82, 0xf7, 0x91, 0x33, - /* (2^228)P */ 0x5d, 0x09, 0xb5, 0xe2, 0x6a, 0xe0, 0x9a, 0x72, 0x46, 0xa9, 0x59, 0x32, 0xd7, 0x58, 0x8a, 0xd5, 0xed, 0x21, 0x39, 0xd1, 0x62, 0x42, 0x83, 0xe9, 0x92, 0xb5, 0x4b, 0xa5, 0xfa, 0xda, 0xfe, 0x27, - /* (2^229)P */ 0xbb, 0x48, 0xad, 0x29, 0xb8, 0xc5, 0x9d, 0xa9, 0x60, 0xe2, 0x9e, 0x49, 0x42, 0x57, 0x02, 0x5f, 0xfd, 0x13, 0x75, 0x5d, 0xcd, 0x8e, 0x2c, 0x80, 0x38, 0xd9, 0x6d, 0x3f, 0xef, 0xb3, 0xce, 0x78, - /* (2^230)P */ 0x94, 0x5d, 0x13, 0x8a, 0x4f, 0xf4, 0x42, 0xc3, 0xa3, 0xdd, 0x8c, 0x82, 0x44, 0xdb, 0x9e, 0x7b, 0xe7, 0xcf, 0x37, 0x05, 0x1a, 0xd1, 0x36, 0x94, 0xc8, 0xb4, 0x1a, 0xec, 0x64, 0xb1, 0x64, 0x50, - /* (2^231)P */ 0xfc, 0xb2, 0x7e, 0xd3, 0xcf, 0xec, 0x20, 0x70, 0xfc, 0x25, 0x0d, 0xd9, 0x3e, 0xea, 0x31, 0x1f, 0x34, 0xbb, 0xa1, 0xdf, 0x7b, 0x0d, 0x93, 0x1b, 0x44, 0x30, 0x11, 0x48, 0x7a, 0x46, 0x44, 0x53, - /* (2^232)P */ 0xfb, 0x6d, 0x5e, 0xf2, 0x70, 0x31, 0x07, 0x70, 0xc8, 0x4c, 0x11, 0x50, 0x1a, 0xdc, 0x85, 0xe3, 0x00, 0x4f, 0xfc, 0xc8, 0x8a, 0x69, 0x48, 0x23, 0xd8, 0x40, 0xdd, 0x84, 0x52, 0xa5, 0x77, 0x2a, - /* (2^233)P */ 0xe4, 0x6c, 0x8c, 0xc9, 0xe0, 0xaf, 0x06, 0xfe, 0xe4, 0xd6, 0xdf, 0xdd, 0x96, 0xdf, 0x35, 0xc2, 0xd3, 0x1e, 0xbf, 0x33, 0x1e, 0xd0, 0x28, 0x14, 0xaf, 0xbd, 0x00, 0x93, 0xec, 0x68, 0x57, 0x78, - /* (2^234)P */ 0x3b, 0xb6, 0xde, 0x91, 0x7a, 0xe5, 0x02, 0x97, 0x80, 0x8b, 0xce, 0xe5, 0xbf, 0xb8, 0xbd, 0x61, 0xac, 0x58, 0x1d, 0x3d, 0x6f, 0x42, 0x5b, 0x64, 0xbc, 0x57, 0xa5, 0x27, 0x22, 0xa8, 0x04, 0x48, - /* (2^235)P */ 0x01, 0x26, 0x4d, 0xb4, 0x8a, 0x04, 0x57, 0x8e, 0x35, 0x69, 0x3a, 0x4b, 0x1a, 0x50, 0xd6, 0x68, 0x93, 0xc2, 0xe1, 0xf9, 0xc3, 0x9e, 0x9c, 0xc3, 0xe2, 0x63, 0xde, 0xd4, 0x57, 0xf2, 0x72, 0x41, - /* (2^236)P */ 0x01, 0x64, 0x0c, 0x33, 0x50, 0xb4, 0x68, 0xd3, 0x91, 0x23, 0x8f, 0x41, 0x17, 0x30, 0x0d, 0x04, 0x0d, 0xd9, 0xb7, 0x90, 0x60, 0xbb, 0x34, 0x2c, 0x1f, 0xd5, 0xdf, 0x8f, 0x22, 0x49, 0xf6, 0x16, - /* (2^237)P */ 0xf5, 0x8e, 0x92, 0x2b, 0x8e, 0x81, 0xa6, 0xbe, 0x72, 0x1e, 0xc1, 0xcd, 0x91, 0xcf, 0x8c, 0xe2, 0xcd, 0x36, 0x7a, 0xe7, 0x68, 0xaa, 0x4a, 0x59, 0x0f, 0xfd, 0x7f, 0x6c, 0x80, 0x34, 0x30, 0x31, - /* (2^238)P */ 0x65, 0xbd, 0x49, 0x22, 0xac, 0x27, 0x9d, 0x8a, 0x12, 0x95, 0x8e, 0x01, 0x64, 0xb4, 0xa3, 0x19, 0xc7, 0x7e, 0xb3, 0x52, 0xf3, 0xcf, 0x6c, 0xc2, 0x21, 0x7b, 0x79, 0x1d, 0x34, 0x68, 0x6f, 0x05, - /* (2^239)P */ 0x27, 0x23, 0xfd, 0x7e, 0x75, 0xd6, 0x79, 0x5e, 0x15, 0xfe, 0x3a, 0x55, 0xb6, 0xbc, 0xbd, 0xfa, 0x60, 0x5a, 0xaf, 0x6e, 0x2c, 0x22, 0xe7, 0xd3, 0x3b, 0x74, 0xae, 0x4d, 0x6d, 0xc7, 0x46, 0x70, - /* (2^240)P */ 0x55, 0x4a, 0x8d, 0xb1, 0x72, 0xe8, 0x0b, 0x66, 0x96, 0x14, 0x4e, 0x57, 0x18, 0x25, 0x99, 0x19, 0xbb, 0xdc, 0x2b, 0x30, 0x3a, 0x05, 0x03, 0xc1, 0x8e, 0x8e, 0x21, 0x0b, 0x80, 0xe9, 0xd8, 0x3e, - /* (2^241)P */ 0x3e, 0xe0, 0x75, 0xfa, 0x39, 0x92, 0x0b, 0x7b, 0x83, 0xc0, 0x33, 0x46, 0x68, 0xfb, 0xe9, 0xef, 0x93, 0x77, 0x1a, 0x39, 0xbe, 0x5f, 0xa3, 0x98, 0x34, 0xfe, 0xd0, 0xe2, 0x0f, 0x51, 0x65, 0x60, - /* (2^242)P */ 0x0c, 0xad, 0xab, 0x48, 0x85, 0x66, 0xcb, 0x55, 0x27, 0xe5, 0x87, 0xda, 0x48, 0x45, 0x58, 0xb4, 0xdd, 0xc1, 0x07, 0x01, 0xea, 0xec, 0x43, 0x2c, 0x35, 0xde, 0x72, 0x93, 0x80, 0x28, 0x60, 0x52, - /* (2^243)P */ 0x1f, 0x3b, 0x21, 0xf9, 0x6a, 0xc5, 0x15, 0x34, 0xdb, 0x98, 0x7e, 0x01, 0x4d, 0x1a, 0xee, 0x5b, 0x9b, 0x70, 0xcf, 0xb5, 0x05, 0xb1, 0xf6, 0x13, 0xb6, 0x9a, 0xb2, 0x82, 0x34, 0x0e, 0xf2, 0x5f, - /* (2^244)P */ 0x90, 0x6c, 0x2e, 0xcc, 0x75, 0x9c, 0xa2, 0x0a, 0x06, 0xe2, 0x70, 0x3a, 0xca, 0x73, 0x7d, 0xfc, 0x15, 0xc5, 0xb5, 0xc4, 0x8f, 0xc3, 0x9f, 0x89, 0x07, 0xc2, 0xff, 0x24, 0xb1, 0x86, 0x03, 0x25, - /* (2^245)P */ 0x56, 0x2b, 0x3d, 0xae, 0xd5, 0x28, 0xea, 0x54, 0xce, 0x60, 0xde, 0xd6, 0x9d, 0x14, 0x13, 0x99, 0xc1, 0xd6, 0x06, 0x8f, 0xc5, 0x4f, 0x69, 0x16, 0xc7, 0x8f, 0x01, 0xeb, 0x75, 0x39, 0xb2, 0x46, - /* (2^246)P */ 0xe2, 0xb4, 0xb7, 0xb4, 0x0f, 0x6a, 0x0a, 0x47, 0xde, 0x53, 0x72, 0x8f, 0x5a, 0x47, 0x92, 0x5d, 0xdb, 0x3a, 0xbd, 0x2f, 0xb5, 0xe5, 0xee, 0xab, 0x68, 0x69, 0x80, 0xa0, 0x01, 0x08, 0xa2, 0x7f, - /* (2^247)P */ 0xd2, 0x14, 0x77, 0x9f, 0xf1, 0xfa, 0xf3, 0x76, 0xc3, 0x60, 0x46, 0x2f, 0xc1, 0x40, 0xe8, 0xb3, 0x4e, 0x74, 0x12, 0xf2, 0x8d, 0xcd, 0xb4, 0x0f, 0xd2, 0x2d, 0x3a, 0x1d, 0x25, 0x5a, 0x06, 0x4b, - /* (2^248)P */ 0x4a, 0xcd, 0x77, 0x3d, 0x38, 0xde, 0xeb, 0x5c, 0xb1, 0x9c, 0x2c, 0x88, 0xdf, 0x39, 0xdf, 0x6a, 0x59, 0xf7, 0x9a, 0xb0, 0x2e, 0x24, 0xdd, 0xa2, 0x22, 0x64, 0x5f, 0x0e, 0xe5, 0xc0, 0x47, 0x31, - /* (2^249)P */ 0xdb, 0x50, 0x13, 0x1d, 0x10, 0xa5, 0x4c, 0x16, 0x62, 0xc9, 0x3f, 0xc3, 0x79, 0x34, 0xd1, 0xf8, 0x08, 0xda, 0xe5, 0x13, 0x4d, 0xce, 0x40, 0xe6, 0xba, 0xf8, 0x61, 0x50, 0xc4, 0xe0, 0xde, 0x4b, - /* (2^250)P */ 0xc9, 0xb1, 0xed, 0xa4, 0xc1, 0x6d, 0xc4, 0xd7, 0x8a, 0xd9, 0x7f, 0x43, 0xb6, 0xd7, 0x14, 0x55, 0x0b, 0xc0, 0xa1, 0xb2, 0x6b, 0x2f, 0x94, 0x58, 0x0e, 0x71, 0x70, 0x1d, 0xab, 0xb2, 0xff, 0x2d, - /* (2^251)P */ 0x68, 0x6d, 0x8b, 0xc1, 0x2f, 0xcf, 0xdf, 0xcc, 0x67, 0x61, 0x80, 0xb7, 0xa8, 0xcb, 0xeb, 0xa8, 0xe3, 0x37, 0x29, 0x5e, 0xf9, 0x97, 0x06, 0x98, 0x8c, 0x6e, 0x12, 0xd0, 0x1c, 0xba, 0xfb, 0x02, - /* (2^252)P */ 0x65, 0x45, 0xff, 0xad, 0x60, 0xc3, 0x98, 0xcb, 0x19, 0x15, 0xdb, 0x4b, 0xd2, 0x01, 0x71, 0x44, 0xd5, 0x15, 0xfb, 0x75, 0x74, 0xc8, 0xc4, 0x98, 0x7d, 0xa2, 0x22, 0x6e, 0x6d, 0xc7, 0xf8, 0x05, - /* (2^253)P */ 0x94, 0xf4, 0xb9, 0xfe, 0xdf, 0xe5, 0x69, 0xab, 0x75, 0x6b, 0x40, 0x18, 0x9d, 0xc7, 0x09, 0xae, 0x1d, 0x2d, 0xa4, 0x94, 0xfb, 0x45, 0x9b, 0x19, 0x84, 0xfa, 0x2a, 0xae, 0xeb, 0x0a, 0x71, 0x79, - /* (2^254)P */ 0xdf, 0xd2, 0x34, 0xf3, 0xa7, 0xed, 0xad, 0xa6, 0xb4, 0x57, 0x2a, 0xaf, 0x51, 0x9c, 0xde, 0x7b, 0xa8, 0xea, 0xdc, 0x86, 0x4f, 0xc6, 0x8f, 0xa9, 0x7b, 0xd0, 0x0e, 0xc2, 0x35, 0x03, 0xbe, 0x6b, - /* (2^255)P */ 0x44, 0x43, 0x98, 0x53, 0xbe, 0xdc, 0x7f, 0x66, 0xa8, 0x49, 0x59, 0x00, 0x1c, 0xbc, 0x72, 0x07, 0x8e, 0xd6, 0xbe, 0x4e, 0x9f, 0xa4, 0x07, 0xba, 0xbf, 0x30, 0xdf, 0xba, 0x85, 0xb0, 0xa7, 0x1f, -} diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve.go b/backend/vendor/github.com/cloudflare/circl/dh/x448/curve.go deleted file mode 100644 index d59564e..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve.go +++ /dev/null @@ -1,104 +0,0 @@ -package x448 - -import ( - fp "github.com/cloudflare/circl/math/fp448" -) - -// ladderJoye calculates a fixed-point multiplication with the generator point. -// The algorithm is the right-to-left Joye's ladder as described -// in "How to precompute a ladder" in SAC'2017. -func ladderJoye(k *Key) { - w := [5]fp.Elt{} // [mu,x1,z1,x2,z2] order must be preserved. - w[1] = fp.Elt{ // x1 = S - 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - } - fp.SetOne(&w[2]) // z1 = 1 - w[3] = fp.Elt{ // x2 = G-S - 0x20, 0x27, 0x9d, 0xc9, 0x7d, 0x19, 0xb1, 0xac, - 0xf8, 0xba, 0x69, 0x1c, 0xff, 0x33, 0xac, 0x23, - 0x51, 0x1b, 0xce, 0x3a, 0x64, 0x65, 0xbd, 0xf1, - 0x23, 0xf8, 0xc1, 0x84, 0x9d, 0x45, 0x54, 0x29, - 0x67, 0xb9, 0x81, 0x1c, 0x03, 0xd1, 0xcd, 0xda, - 0x7b, 0xeb, 0xff, 0x1a, 0x88, 0x03, 0xcf, 0x3a, - 0x42, 0x44, 0x32, 0x01, 0x25, 0xb7, 0xfa, 0xf0, - } - fp.SetOne(&w[4]) // z2 = 1 - - const n = 448 - const h = 2 - swap := uint(1) - for s := 0; s < n-h; s++ { - i := (s + h) / 8 - j := (s + h) % 8 - bit := uint((k[i] >> uint(j)) & 1) - copy(w[0][:], tableGenerator[s*Size:(s+1)*Size]) - diffAdd(&w, swap^bit) - swap = bit - } - for s := 0; s < h; s++ { - double(&w[1], &w[2]) - } - toAffine((*[fp.Size]byte)(k), &w[1], &w[2]) -} - -// ladderMontgomery calculates a generic scalar point multiplication -// The algorithm implemented is the left-to-right Montgomery's ladder. -func ladderMontgomery(k, xP *Key) { - w := [5]fp.Elt{} // [x1, x2, z2, x3, z3] order must be preserved. - w[0] = *(*fp.Elt)(xP) // x1 = xP - fp.SetOne(&w[1]) // x2 = 1 - w[3] = *(*fp.Elt)(xP) // x3 = xP - fp.SetOne(&w[4]) // z3 = 1 - - move := uint(0) - for s := 448 - 1; s >= 0; s-- { - i := s / 8 - j := s % 8 - bit := uint((k[i] >> uint(j)) & 1) - ladderStep(&w, move^bit) - move = bit - } - toAffine((*[fp.Size]byte)(k), &w[1], &w[2]) -} - -func toAffine(k *[fp.Size]byte, x, z *fp.Elt) { - fp.Inv(z, z) - fp.Mul(x, x, z) - _ = fp.ToBytes(k[:], x) -} - -var lowOrderPoints = [3]fp.Elt{ - { /* (0,_,1) point of order 2 on Curve448 */ - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - }, - { /* (1,_,1) a point of order 4 on the twist of Curve448 */ - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - }, - { /* (-1,_,1) point of order 4 on Curve448 */ - 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - }, -} diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.go b/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.go deleted file mode 100644 index a062266..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.go +++ /dev/null @@ -1,30 +0,0 @@ -//go:build amd64 && !purego -// +build amd64,!purego - -package x448 - -import ( - fp "github.com/cloudflare/circl/math/fp448" - "golang.org/x/sys/cpu" -) - -var hasBmi2Adx = cpu.X86.HasBMI2 && cpu.X86.HasADX - -var _ = hasBmi2Adx - -func double(x, z *fp.Elt) { doubleAmd64(x, z) } -func diffAdd(w *[5]fp.Elt, b uint) { diffAddAmd64(w, b) } -func ladderStep(w *[5]fp.Elt, b uint) { ladderStepAmd64(w, b) } -func mulA24(z, x *fp.Elt) { mulA24Amd64(z, x) } - -//go:noescape -func doubleAmd64(x, z *fp.Elt) - -//go:noescape -func diffAddAmd64(w *[5]fp.Elt, b uint) - -//go:noescape -func ladderStepAmd64(w *[5]fp.Elt, b uint) - -//go:noescape -func mulA24Amd64(z, x *fp.Elt) diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.h b/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.h deleted file mode 100644 index 8c1ae4d..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.h +++ /dev/null @@ -1,111 +0,0 @@ -#define ladderStepLeg \ - addSub(x2,z2) \ - addSub(x3,z3) \ - integerMulLeg(b0,x2,z3) \ - integerMulLeg(b1,x3,z2) \ - reduceFromDoubleLeg(t0,b0) \ - reduceFromDoubleLeg(t1,b1) \ - addSub(t0,t1) \ - cselect(x2,x3,regMove) \ - cselect(z2,z3,regMove) \ - integerSqrLeg(b0,t0) \ - integerSqrLeg(b1,t1) \ - reduceFromDoubleLeg(x3,b0) \ - reduceFromDoubleLeg(z3,b1) \ - integerMulLeg(b0,x1,z3) \ - reduceFromDoubleLeg(z3,b0) \ - integerSqrLeg(b0,x2) \ - integerSqrLeg(b1,z2) \ - reduceFromDoubleLeg(x2,b0) \ - reduceFromDoubleLeg(z2,b1) \ - subtraction(t0,x2,z2) \ - multiplyA24Leg(t1,t0) \ - additionLeg(t1,t1,z2) \ - integerMulLeg(b0,x2,z2) \ - integerMulLeg(b1,t0,t1) \ - reduceFromDoubleLeg(x2,b0) \ - reduceFromDoubleLeg(z2,b1) - -#define ladderStepBmi2Adx \ - addSub(x2,z2) \ - addSub(x3,z3) \ - integerMulAdx(b0,x2,z3) \ - integerMulAdx(b1,x3,z2) \ - reduceFromDoubleAdx(t0,b0) \ - reduceFromDoubleAdx(t1,b1) \ - addSub(t0,t1) \ - cselect(x2,x3,regMove) \ - cselect(z2,z3,regMove) \ - integerSqrAdx(b0,t0) \ - integerSqrAdx(b1,t1) \ - reduceFromDoubleAdx(x3,b0) \ - reduceFromDoubleAdx(z3,b1) \ - integerMulAdx(b0,x1,z3) \ - reduceFromDoubleAdx(z3,b0) \ - integerSqrAdx(b0,x2) \ - integerSqrAdx(b1,z2) \ - reduceFromDoubleAdx(x2,b0) \ - reduceFromDoubleAdx(z2,b1) \ - subtraction(t0,x2,z2) \ - multiplyA24Adx(t1,t0) \ - additionAdx(t1,t1,z2) \ - integerMulAdx(b0,x2,z2) \ - integerMulAdx(b1,t0,t1) \ - reduceFromDoubleAdx(x2,b0) \ - reduceFromDoubleAdx(z2,b1) - -#define difAddLeg \ - addSub(x1,z1) \ - integerMulLeg(b0,z1,ui) \ - reduceFromDoubleLeg(z1,b0) \ - addSub(x1,z1) \ - integerSqrLeg(b0,x1) \ - integerSqrLeg(b1,z1) \ - reduceFromDoubleLeg(x1,b0) \ - reduceFromDoubleLeg(z1,b1) \ - integerMulLeg(b0,x1,z2) \ - integerMulLeg(b1,z1,x2) \ - reduceFromDoubleLeg(x1,b0) \ - reduceFromDoubleLeg(z1,b1) - -#define difAddBmi2Adx \ - addSub(x1,z1) \ - integerMulAdx(b0,z1,ui) \ - reduceFromDoubleAdx(z1,b0) \ - addSub(x1,z1) \ - integerSqrAdx(b0,x1) \ - integerSqrAdx(b1,z1) \ - reduceFromDoubleAdx(x1,b0) \ - reduceFromDoubleAdx(z1,b1) \ - integerMulAdx(b0,x1,z2) \ - integerMulAdx(b1,z1,x2) \ - reduceFromDoubleAdx(x1,b0) \ - reduceFromDoubleAdx(z1,b1) - -#define doubleLeg \ - addSub(x1,z1) \ - integerSqrLeg(b0,x1) \ - integerSqrLeg(b1,z1) \ - reduceFromDoubleLeg(x1,b0) \ - reduceFromDoubleLeg(z1,b1) \ - subtraction(t0,x1,z1) \ - multiplyA24Leg(t1,t0) \ - additionLeg(t1,t1,z1) \ - integerMulLeg(b0,x1,z1) \ - integerMulLeg(b1,t0,t1) \ - reduceFromDoubleLeg(x1,b0) \ - reduceFromDoubleLeg(z1,b1) - -#define doubleBmi2Adx \ - addSub(x1,z1) \ - integerSqrAdx(b0,x1) \ - integerSqrAdx(b1,z1) \ - reduceFromDoubleAdx(x1,b0) \ - reduceFromDoubleAdx(z1,b1) \ - subtraction(t0,x1,z1) \ - multiplyA24Adx(t1,t0) \ - additionAdx(t1,t1,z1) \ - integerMulAdx(b0,x1,z1) \ - integerMulAdx(b1,t0,t1) \ - reduceFromDoubleAdx(x1,b0) \ - reduceFromDoubleAdx(z1,b1) diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.s b/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.s deleted file mode 100644 index ed33ba3..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_amd64.s +++ /dev/null @@ -1,194 +0,0 @@ -//go:build amd64 && !purego -// +build amd64,!purego - -#include "textflag.h" - -// Depends on circl/math/fp448 package -#include "../../math/fp448/fp_amd64.h" -#include "curve_amd64.h" - -// CTE_A24 is (A+2)/4 from Curve448 -#define CTE_A24 39082 - -#define Size 56 - -// multiplyA24Leg multiplies x times CTE_A24 and stores in z -// Uses: AX, DX, R8-R15, FLAGS -// Instr: x86_64, cmov, adx -#define multiplyA24Leg(z,x) \ - MOVQ $CTE_A24, R15; \ - MOVQ 0+x, AX; MULQ R15; MOVQ AX, R8; ;;;;;;;;;;;; MOVQ DX, R9; \ - MOVQ 8+x, AX; MULQ R15; ADDQ AX, R9; ADCQ $0, DX; MOVQ DX, R10; \ - MOVQ 16+x, AX; MULQ R15; ADDQ AX, R10; ADCQ $0, DX; MOVQ DX, R11; \ - MOVQ 24+x, AX; MULQ R15; ADDQ AX, R11; ADCQ $0, DX; MOVQ DX, R12; \ - MOVQ 32+x, AX; MULQ R15; ADDQ AX, R12; ADCQ $0, DX; MOVQ DX, R13; \ - MOVQ 40+x, AX; MULQ R15; ADDQ AX, R13; ADCQ $0, DX; MOVQ DX, R14; \ - MOVQ 48+x, AX; MULQ R15; ADDQ AX, R14; ADCQ $0, DX; \ - MOVQ DX, AX; \ - SHLQ $32, AX; \ - ADDQ DX, R8; MOVQ $0, DX; \ - ADCQ $0, R9; \ - ADCQ $0, R10; \ - ADCQ AX, R11; \ - ADCQ $0, R12; \ - ADCQ $0, R13; \ - ADCQ $0, R14; \ - ADCQ $0, DX; \ - MOVQ DX, AX; \ - SHLQ $32, AX; \ - ADDQ DX, R8; \ - ADCQ $0, R9; \ - ADCQ $0, R10; \ - ADCQ AX, R11; \ - ADCQ $0, R12; \ - ADCQ $0, R13; \ - ADCQ $0, R14; \ - MOVQ R8, 0+z; \ - MOVQ R9, 8+z; \ - MOVQ R10, 16+z; \ - MOVQ R11, 24+z; \ - MOVQ R12, 32+z; \ - MOVQ R13, 40+z; \ - MOVQ R14, 48+z; - -// multiplyA24Adx multiplies x times CTE_A24 and stores in z -// Uses: AX, DX, R8-R14, FLAGS -// Instr: x86_64, bmi2 -#define multiplyA24Adx(z,x) \ - MOVQ $CTE_A24, DX; \ - MULXQ 0+x, R8, R9; \ - MULXQ 8+x, AX, R10; ADDQ AX, R9; \ - MULXQ 16+x, AX, R11; ADCQ AX, R10; \ - MULXQ 24+x, AX, R12; ADCQ AX, R11; \ - MULXQ 32+x, AX, R13; ADCQ AX, R12; \ - MULXQ 40+x, AX, R14; ADCQ AX, R13; \ - MULXQ 48+x, AX, DX; ADCQ AX, R14; \ - ;;;;;;;;;;;;;;;;;;;; ADCQ $0, DX; \ - MOVQ DX, AX; \ - SHLQ $32, AX; \ - ADDQ DX, R8; MOVQ $0, DX; \ - ADCQ $0, R9; \ - ADCQ $0, R10; \ - ADCQ AX, R11; \ - ADCQ $0, R12; \ - ADCQ $0, R13; \ - ADCQ $0, R14; \ - ADCQ $0, DX; \ - MOVQ DX, AX; \ - SHLQ $32, AX; \ - ADDQ DX, R8; \ - ADCQ $0, R9; \ - ADCQ $0, R10; \ - ADCQ AX, R11; \ - ADCQ $0, R12; \ - ADCQ $0, R13; \ - ADCQ $0, R14; \ - MOVQ R8, 0+z; \ - MOVQ R9, 8+z; \ - MOVQ R10, 16+z; \ - MOVQ R11, 24+z; \ - MOVQ R12, 32+z; \ - MOVQ R13, 40+z; \ - MOVQ R14, 48+z; - -#define mulA24Legacy \ - multiplyA24Leg(0(DI),0(SI)) -#define mulA24Bmi2Adx \ - multiplyA24Adx(0(DI),0(SI)) - -// func mulA24Amd64(z, x *fp448.Elt) -TEXT ·mulA24Amd64(SB),NOSPLIT,$0-16 - MOVQ z+0(FP), DI - MOVQ x+8(FP), SI - CHECK_BMI2ADX(LMA24, mulA24Legacy, mulA24Bmi2Adx) - -// func ladderStepAmd64(w *[5]fp448.Elt, b uint) -// ladderStepAmd64 calculates a point addition and doubling as follows: -// (x2,z2) = 2*(x2,z2) and (x3,z3) = (x2,z2)+(x3,z3) using as a difference (x1,-). -// w = {x1,x2,z2,x3,z4} are five fp255.Elt of 56 bytes. -// stack = (t0,t1) are two fp.Elt of fp.Size bytes, and -// (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes. -TEXT ·ladderStepAmd64(SB),NOSPLIT,$336-16 - // Parameters - #define regWork DI - #define regMove SI - #define x1 0*Size(regWork) - #define x2 1*Size(regWork) - #define z2 2*Size(regWork) - #define x3 3*Size(regWork) - #define z3 4*Size(regWork) - // Local variables - #define t0 0*Size(SP) - #define t1 1*Size(SP) - #define b0 2*Size(SP) - #define b1 4*Size(SP) - MOVQ w+0(FP), regWork - MOVQ b+8(FP), regMove - CHECK_BMI2ADX(LLADSTEP, ladderStepLeg, ladderStepBmi2Adx) - #undef regWork - #undef regMove - #undef x1 - #undef x2 - #undef z2 - #undef x3 - #undef z3 - #undef t0 - #undef t1 - #undef b0 - #undef b1 - -// func diffAddAmd64(work *[5]fp.Elt, swap uint) -// diffAddAmd64 calculates a differential point addition using a precomputed point. -// (x1,z1) = (x1,z1)+(mu) using a difference point (x2,z2) -// work = {mu,x1,z1,x2,z2} are five fp448.Elt of 56 bytes, and -// stack = (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes. -// This is Equation 7 at https://eprint.iacr.org/2017/264. -TEXT ·diffAddAmd64(SB),NOSPLIT,$224-16 - // Parameters - #define regWork DI - #define regSwap SI - #define ui 0*Size(regWork) - #define x1 1*Size(regWork) - #define z1 2*Size(regWork) - #define x2 3*Size(regWork) - #define z2 4*Size(regWork) - // Local variables - #define b0 0*Size(SP) - #define b1 2*Size(SP) - MOVQ w+0(FP), regWork - MOVQ b+8(FP), regSwap - cswap(x1,x2,regSwap) - cswap(z1,z2,regSwap) - CHECK_BMI2ADX(LDIFADD, difAddLeg, difAddBmi2Adx) - #undef regWork - #undef regSwap - #undef ui - #undef x1 - #undef z1 - #undef x2 - #undef z2 - #undef b0 - #undef b1 - -// func doubleAmd64(x, z *fp448.Elt) -// doubleAmd64 calculates a point doubling (x1,z1) = 2*(x1,z1). -// stack = (t0,t1) are two fp.Elt of fp.Size bytes, and -// (b0,b1) are two-double precision fp.Elt of 2*fp.Size bytes. -TEXT ·doubleAmd64(SB),NOSPLIT,$336-16 - // Parameters - #define x1 0(DI) - #define z1 0(SI) - // Local variables - #define t0 0*Size(SP) - #define t1 1*Size(SP) - #define b0 2*Size(SP) - #define b1 4*Size(SP) - MOVQ x+0(FP), DI - MOVQ z+8(FP), SI - CHECK_BMI2ADX(LDOUB,doubleLeg,doubleBmi2Adx) - #undef x1 - #undef z1 - #undef t0 - #undef t1 - #undef b0 - #undef b1 diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_generic.go b/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_generic.go deleted file mode 100644 index b0b65cc..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_generic.go +++ /dev/null @@ -1,100 +0,0 @@ -package x448 - -import ( - "encoding/binary" - "math/bits" - - "github.com/cloudflare/circl/math/fp448" -) - -func doubleGeneric(x, z *fp448.Elt) { - t0, t1 := &fp448.Elt{}, &fp448.Elt{} - fp448.AddSub(x, z) - fp448.Sqr(x, x) - fp448.Sqr(z, z) - fp448.Sub(t0, x, z) - mulA24Generic(t1, t0) - fp448.Add(t1, t1, z) - fp448.Mul(x, x, z) - fp448.Mul(z, t0, t1) -} - -func diffAddGeneric(w *[5]fp448.Elt, b uint) { - mu, x1, z1, x2, z2 := &w[0], &w[1], &w[2], &w[3], &w[4] - fp448.Cswap(x1, x2, b) - fp448.Cswap(z1, z2, b) - fp448.AddSub(x1, z1) - fp448.Mul(z1, z1, mu) - fp448.AddSub(x1, z1) - fp448.Sqr(x1, x1) - fp448.Sqr(z1, z1) - fp448.Mul(x1, x1, z2) - fp448.Mul(z1, z1, x2) -} - -func ladderStepGeneric(w *[5]fp448.Elt, b uint) { - x1, x2, z2, x3, z3 := &w[0], &w[1], &w[2], &w[3], &w[4] - t0 := &fp448.Elt{} - t1 := &fp448.Elt{} - fp448.AddSub(x2, z2) - fp448.AddSub(x3, z3) - fp448.Mul(t0, x2, z3) - fp448.Mul(t1, x3, z2) - fp448.AddSub(t0, t1) - fp448.Cmov(x2, x3, b) - fp448.Cmov(z2, z3, b) - fp448.Sqr(x3, t0) - fp448.Sqr(z3, t1) - fp448.Mul(z3, x1, z3) - fp448.Sqr(x2, x2) - fp448.Sqr(z2, z2) - fp448.Sub(t0, x2, z2) - mulA24Generic(t1, t0) - fp448.Add(t1, t1, z2) - fp448.Mul(x2, x2, z2) - fp448.Mul(z2, t0, t1) -} - -func mulA24Generic(z, x *fp448.Elt) { - const A24 = 39082 - const n = 8 - var xx [7]uint64 - for i := range xx { - xx[i] = binary.LittleEndian.Uint64(x[i*n : (i+1)*n]) - } - h0, l0 := bits.Mul64(xx[0], A24) - h1, l1 := bits.Mul64(xx[1], A24) - h2, l2 := bits.Mul64(xx[2], A24) - h3, l3 := bits.Mul64(xx[3], A24) - h4, l4 := bits.Mul64(xx[4], A24) - h5, l5 := bits.Mul64(xx[5], A24) - h6, l6 := bits.Mul64(xx[6], A24) - - l1, c0 := bits.Add64(h0, l1, 0) - l2, c1 := bits.Add64(h1, l2, c0) - l3, c2 := bits.Add64(h2, l3, c1) - l4, c3 := bits.Add64(h3, l4, c2) - l5, c4 := bits.Add64(h4, l5, c3) - l6, c5 := bits.Add64(h5, l6, c4) - l7, _ := bits.Add64(h6, 0, c5) - - l0, c0 = bits.Add64(l0, l7, 0) - l1, c1 = bits.Add64(l1, 0, c0) - l2, c2 = bits.Add64(l2, 0, c1) - l3, c3 = bits.Add64(l3, l7<<32, c2) - l4, c4 = bits.Add64(l4, 0, c3) - l5, c5 = bits.Add64(l5, 0, c4) - l6, l7 = bits.Add64(l6, 0, c5) - - xx[0], c0 = bits.Add64(l0, l7, 0) - xx[1], c1 = bits.Add64(l1, 0, c0) - xx[2], c2 = bits.Add64(l2, 0, c1) - xx[3], c3 = bits.Add64(l3, l7<<32, c2) - xx[4], c4 = bits.Add64(l4, 0, c3) - xx[5], c5 = bits.Add64(l5, 0, c4) - xx[6], _ = bits.Add64(l6, 0, c5) - - for i := range xx { - binary.LittleEndian.PutUint64(z[i*n:(i+1)*n], xx[i]) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_noasm.go b/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_noasm.go deleted file mode 100644 index 3755b7c..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x448/curve_noasm.go +++ /dev/null @@ -1,11 +0,0 @@ -//go:build !amd64 || purego -// +build !amd64 purego - -package x448 - -import fp "github.com/cloudflare/circl/math/fp448" - -func double(x, z *fp.Elt) { doubleGeneric(x, z) } -func diffAdd(w *[5]fp.Elt, b uint) { diffAddGeneric(w, b) } -func ladderStep(w *[5]fp.Elt, b uint) { ladderStepGeneric(w, b) } -func mulA24(z, x *fp.Elt) { mulA24Generic(z, x) } diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x448/doc.go b/backend/vendor/github.com/cloudflare/circl/dh/x448/doc.go deleted file mode 100644 index c02904f..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x448/doc.go +++ /dev/null @@ -1,19 +0,0 @@ -/* -Package x448 provides Diffie-Hellman functions as specified in RFC-7748. - -Validation of public keys. - -The Diffie-Hellman function, as described in RFC-7748 [1], works for any -public key. However, if a different protocol requires contributory -behaviour [2,3], then the public keys must be validated against low-order -points [3,4]. To do that, the Shared function performs this validation -internally and returns false when the public key is invalid (i.e., it -is a low-order point). - -References: - - [1] RFC7748 by Langley, Hamburg, Turner (https://rfc-editor.org/rfc/rfc7748.txt) - - [2] Curve25519 by Bernstein (https://cr.yp.to/ecdh.html) - - [3] Bernstein (https://cr.yp.to/ecdh.html#validate) - - [4] Cremers&Jackson (https://eprint.iacr.org/2019/526) -*/ -package x448 diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x448/key.go b/backend/vendor/github.com/cloudflare/circl/dh/x448/key.go deleted file mode 100644 index 2fdde51..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x448/key.go +++ /dev/null @@ -1,46 +0,0 @@ -package x448 - -import ( - "crypto/subtle" - - fp "github.com/cloudflare/circl/math/fp448" -) - -// Size is the length in bytes of a X448 key. -const Size = 56 - -// Key represents a X448 key. -type Key [Size]byte - -func (k *Key) clamp(in *Key) *Key { - *k = *in - k[0] &= 252 - k[55] |= 128 - return k -} - -// isValidPubKey verifies if the public key is not a low-order point. -func (k *Key) isValidPubKey() bool { - fp.Modp((*fp.Elt)(k)) - var isLowOrder int - for _, P := range lowOrderPoints { - isLowOrder |= subtle.ConstantTimeCompare(P[:], k[:]) - } - return isLowOrder == 0 -} - -// KeyGen obtains a public key given a secret key. -func KeyGen(public, secret *Key) { - ladderJoye(public.clamp(secret)) -} - -// Shared calculates Alice's shared key from Alice's secret key and Bob's -// public key returning true on success. A failure case happens when the public -// key is a low-order point, thus the shared key is all-zeros and the function -// returns false. -func Shared(shared, secret, public *Key) bool { - validPk := *public - ok := validPk.isValidPubKey() - ladderMontgomery(shared.clamp(secret), &validPk) - return ok -} diff --git a/backend/vendor/github.com/cloudflare/circl/dh/x448/table.go b/backend/vendor/github.com/cloudflare/circl/dh/x448/table.go deleted file mode 100644 index eef53c3..0000000 --- a/backend/vendor/github.com/cloudflare/circl/dh/x448/table.go +++ /dev/null @@ -1,460 +0,0 @@ -package x448 - -import fp "github.com/cloudflare/circl/math/fp448" - -// tableGenerator contains the set of points: -// -// t[i] = (xi+1)/(xi-1), -// -// where (xi,yi) = 2^iG and G is the generator point -// Size = (448)*(448/8) = 25088 bytes. -var tableGenerator = [448 * fp.Size]byte{ - /* (2^ 0)P */ 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f, - /* (2^ 1)P */ 0x37, 0xfa, 0xaa, 0x0d, 0x86, 0xa6, 0x24, 0xe9, 0x6c, 0x95, 0x08, 0x34, 0xba, 0x1a, 0x81, 0x3a, 0xae, 0x01, 0xa5, 0xa7, 0x05, 0x85, 0x96, 0x00, 0x06, 0x5a, 0xd7, 0xff, 0xee, 0x8e, 0x8f, 0x94, 0xd2, 0xdc, 0xd7, 0xfc, 0xe7, 0xe5, 0x99, 0x1d, 0x05, 0x46, 0x43, 0xe8, 0xbc, 0x12, 0xb7, 0xeb, 0x30, 0x5e, 0x7a, 0x85, 0x68, 0xed, 0x9d, 0x28, - /* (2^ 2)P */ 0xf1, 0x7d, 0x08, 0x2b, 0x32, 0x4a, 0x62, 0x80, 0x36, 0xe7, 0xa4, 0x76, 0x5a, 0x2a, 0x1e, 0xf7, 0x9e, 0x3c, 0x40, 0x46, 0x9a, 0x1b, 0x61, 0xc1, 0xbf, 0x1a, 0x1b, 0xae, 0x91, 0x80, 0xa3, 0x76, 0x6c, 0xd4, 0x8f, 0xa4, 0xee, 0x26, 0x39, 0x23, 0xa4, 0x80, 0xf4, 0x66, 0x92, 0xe4, 0xe1, 0x18, 0x76, 0xc5, 0xe2, 0x19, 0x87, 0xd5, 0xc3, 0xe8, - /* (2^ 3)P */ 0xfb, 0xc9, 0xf0, 0x07, 0xf2, 0x93, 0xd8, 0x50, 0x36, 0xed, 0xfb, 0xbd, 0xb2, 0xd3, 0xfc, 0xdf, 0xd5, 0x2a, 0x6e, 0x26, 0x09, 0xce, 0xd4, 0x07, 0x64, 0x9f, 0x40, 0x74, 0xad, 0x98, 0x2f, 0x1c, 0xb6, 0xdc, 0x2d, 0x42, 0xff, 0xbf, 0x97, 0xd8, 0xdb, 0xef, 0x99, 0xca, 0x73, 0x99, 0x1a, 0x04, 0x3b, 0x56, 0x2c, 0x1f, 0x87, 0x9d, 0x9f, 0x03, - /* (2^ 4)P */ 0x4c, 0x35, 0x97, 0xf7, 0x81, 0x2c, 0x84, 0xa6, 0xe0, 0xcb, 0xce, 0x37, 0x4c, 0x21, 0x1c, 0x67, 0xfa, 0xab, 0x18, 0x4d, 0xef, 0xd0, 0xf0, 0x44, 0xa9, 0xfb, 0xc0, 0x8e, 0xda, 0x57, 0xa1, 0xd8, 0xeb, 0x87, 0xf4, 0x17, 0xea, 0x66, 0x0f, 0x16, 0xea, 0xcd, 0x5f, 0x3e, 0x88, 0xea, 0x09, 0x68, 0x40, 0xdf, 0x43, 0xcc, 0x54, 0x61, 0x58, 0xaa, - /* (2^ 5)P */ 0x8d, 0xe7, 0x59, 0xd7, 0x5e, 0x63, 0x37, 0xa7, 0x3f, 0xd1, 0x49, 0x85, 0x01, 0xdd, 0x5e, 0xb3, 0xe6, 0x29, 0xcb, 0x25, 0x93, 0xdd, 0x08, 0x96, 0x83, 0x52, 0x76, 0x85, 0xf5, 0x5d, 0x02, 0xbf, 0xe9, 0x6d, 0x15, 0x27, 0xc1, 0x09, 0xd1, 0x14, 0x4d, 0x6e, 0xe8, 0xaf, 0x59, 0x58, 0x34, 0x9d, 0x2a, 0x99, 0x85, 0x26, 0xbe, 0x4b, 0x1e, 0xb9, - /* (2^ 6)P */ 0x8d, 0xce, 0x94, 0xe2, 0x18, 0x56, 0x0d, 0x82, 0x8e, 0xdf, 0x85, 0x01, 0x8f, 0x93, 0x3c, 0xc6, 0xbd, 0x61, 0xfb, 0xf4, 0x22, 0xc5, 0x16, 0x87, 0xd1, 0xb1, 0x9e, 0x09, 0xc5, 0x83, 0x2e, 0x4a, 0x07, 0x88, 0xee, 0xe0, 0x29, 0x8d, 0x2e, 0x1f, 0x88, 0xad, 0xfd, 0x18, 0x93, 0xb7, 0xed, 0x42, 0x86, 0x78, 0xf0, 0xb8, 0x70, 0xbe, 0x01, 0x67, - /* (2^ 7)P */ 0xdf, 0x62, 0x2d, 0x94, 0xc7, 0x35, 0x23, 0xda, 0x27, 0xbb, 0x2b, 0xdb, 0x30, 0x80, 0x68, 0x16, 0xa3, 0xae, 0xd7, 0xd2, 0xa7, 0x7c, 0xbf, 0x6a, 0x1d, 0x83, 0xde, 0x96, 0x0a, 0x43, 0xb6, 0x30, 0x37, 0xd6, 0xee, 0x63, 0x59, 0x9a, 0xbf, 0xa3, 0x30, 0x6c, 0xaf, 0x0c, 0xee, 0x3d, 0xcb, 0x35, 0x4b, 0x55, 0x5f, 0x84, 0x85, 0xcb, 0x4f, 0x1e, - /* (2^ 8)P */ 0x9d, 0x04, 0x68, 0x89, 0xa4, 0xa9, 0x0d, 0x87, 0xc1, 0x70, 0xf1, 0xeb, 0xfb, 0x47, 0x0a, 0xf0, 0xde, 0x67, 0xb7, 0x94, 0xcd, 0x36, 0x43, 0xa5, 0x49, 0x43, 0x67, 0xc3, 0xee, 0x3c, 0x6b, 0xec, 0xd0, 0x1a, 0xf4, 0xad, 0xef, 0x06, 0x4a, 0xe8, 0x46, 0x24, 0xd7, 0x93, 0xbf, 0xf0, 0xe3, 0x81, 0x61, 0xec, 0xea, 0x64, 0xfe, 0x67, 0xeb, 0xc7, - /* (2^ 9)P */ 0x95, 0x45, 0x79, 0xcf, 0x2c, 0xfd, 0x9b, 0xfe, 0x84, 0x46, 0x4b, 0x8f, 0xa1, 0xcf, 0xc3, 0x04, 0x94, 0x78, 0xdb, 0xc9, 0xa6, 0x01, 0x75, 0xa4, 0xb4, 0x93, 0x72, 0x43, 0xa7, 0x7d, 0xda, 0x31, 0x38, 0x54, 0xab, 0x4e, 0x3f, 0x89, 0xa6, 0xab, 0x57, 0xc0, 0x16, 0x65, 0xdb, 0x92, 0x96, 0xe4, 0xc8, 0xae, 0xe7, 0x4c, 0x7a, 0xeb, 0xbb, 0x5a, - /* (2^ 10)P */ 0xbe, 0xfe, 0x86, 0xc3, 0x97, 0xe0, 0x6a, 0x18, 0x20, 0x21, 0xca, 0x22, 0x55, 0xa1, 0xeb, 0xf5, 0x74, 0xe5, 0xc9, 0x59, 0xa7, 0x92, 0x65, 0x15, 0x08, 0x71, 0xd1, 0x09, 0x7e, 0x83, 0xfc, 0xbc, 0x5a, 0x93, 0x38, 0x0d, 0x43, 0x42, 0xfd, 0x76, 0x30, 0xe8, 0x63, 0x60, 0x09, 0x8d, 0x6c, 0xd3, 0xf8, 0x56, 0x3d, 0x68, 0x47, 0xab, 0xa0, 0x1d, - /* (2^ 11)P */ 0x38, 0x50, 0x1c, 0xb1, 0xac, 0x88, 0x8f, 0x38, 0xe3, 0x69, 0xe6, 0xfc, 0x4f, 0x8f, 0xe1, 0x9b, 0xb1, 0x1a, 0x09, 0x39, 0x19, 0xdf, 0xcd, 0x98, 0x7b, 0x64, 0x42, 0xf6, 0x11, 0xea, 0xc7, 0xe8, 0x92, 0x65, 0x00, 0x2c, 0x75, 0xb5, 0x94, 0x1e, 0x5b, 0xa6, 0x66, 0x81, 0x77, 0xf3, 0x39, 0x94, 0xac, 0xbd, 0xe4, 0x2a, 0x66, 0x84, 0x9c, 0x60, - /* (2^ 12)P */ 0xb5, 0xb6, 0xd9, 0x03, 0x67, 0xa4, 0xa8, 0x0a, 0x4a, 0x2b, 0x9d, 0xfa, 0x13, 0xe1, 0x99, 0x25, 0x4a, 0x5c, 0x67, 0xb9, 0xb2, 0xb7, 0xdd, 0x1e, 0xaf, 0xeb, 0x63, 0x41, 0xb6, 0xb9, 0xa0, 0x87, 0x0a, 0xe0, 0x06, 0x07, 0xaa, 0x97, 0xf8, 0xf9, 0x38, 0x4f, 0xdf, 0x0c, 0x40, 0x7c, 0xc3, 0x98, 0xa9, 0x74, 0xf1, 0x5d, 0xda, 0xd1, 0xc0, 0x0a, - /* (2^ 13)P */ 0xf2, 0x0a, 0xab, 0xab, 0x94, 0x50, 0xf0, 0xa3, 0x6f, 0xc6, 0x66, 0xba, 0xa6, 0xdc, 0x44, 0xdd, 0xd6, 0x08, 0xf4, 0xd3, 0xed, 0xb1, 0x40, 0x93, 0xee, 0xf6, 0xb8, 0x8e, 0xb4, 0x7c, 0xb9, 0x82, 0xc9, 0x9d, 0x45, 0x3b, 0x8e, 0x10, 0xcb, 0x70, 0x1e, 0xba, 0x3c, 0x62, 0x50, 0xda, 0xa9, 0x93, 0xb5, 0xd7, 0xd0, 0x6f, 0x29, 0x52, 0x95, 0xae, - /* (2^ 14)P */ 0x14, 0x68, 0x69, 0x23, 0xa8, 0x44, 0x87, 0x9e, 0x22, 0x91, 0xe8, 0x92, 0xdf, 0xf7, 0xae, 0xba, 0x1c, 0x96, 0xe1, 0xc3, 0x94, 0xed, 0x6c, 0x95, 0xae, 0x96, 0xa7, 0x15, 0x9f, 0xf1, 0x17, 0x11, 0x92, 0x42, 0xd5, 0xcd, 0x18, 0xe7, 0xa9, 0xb5, 0x2f, 0xcd, 0xde, 0x6c, 0xc9, 0x7d, 0xfc, 0x7e, 0xbd, 0x7f, 0x10, 0x3d, 0x01, 0x00, 0x8d, 0x95, - /* (2^ 15)P */ 0x3b, 0x76, 0x72, 0xae, 0xaf, 0x84, 0xf2, 0xf7, 0xd1, 0x6d, 0x13, 0x9c, 0x47, 0xe1, 0xb7, 0xa3, 0x19, 0x16, 0xee, 0x75, 0x45, 0xf6, 0x1a, 0x7b, 0x78, 0x49, 0x79, 0x05, 0x86, 0xf0, 0x7f, 0x9f, 0xfc, 0xc4, 0xbd, 0x86, 0xf3, 0x41, 0xa7, 0xfe, 0x01, 0xd5, 0x67, 0x16, 0x10, 0x5b, 0xa5, 0x16, 0xf3, 0x7f, 0x60, 0xce, 0xd2, 0x0c, 0x8e, 0x4b, - /* (2^ 16)P */ 0x4a, 0x07, 0x99, 0x4a, 0x0f, 0x74, 0x91, 0x14, 0x68, 0xb9, 0x48, 0xb7, 0x44, 0x77, 0x9b, 0x4a, 0xe0, 0x68, 0x0e, 0x43, 0x4d, 0x98, 0x98, 0xbf, 0xa8, 0x3a, 0xb7, 0x6d, 0x2a, 0x9a, 0x77, 0x5f, 0x62, 0xf5, 0x6b, 0x4a, 0xb7, 0x7d, 0xe5, 0x09, 0x6b, 0xc0, 0x8b, 0x9c, 0x88, 0x37, 0x33, 0xf2, 0x41, 0xac, 0x22, 0x1f, 0xcf, 0x3b, 0x82, 0x34, - /* (2^ 17)P */ 0x00, 0xc3, 0x78, 0x42, 0x32, 0x2e, 0xdc, 0xda, 0xb1, 0x96, 0x21, 0xa4, 0xe4, 0xbb, 0xe9, 0x9d, 0xbb, 0x0f, 0x93, 0xed, 0x26, 0x3d, 0xb5, 0xdb, 0x94, 0x31, 0x37, 0x07, 0xa2, 0xb2, 0xd5, 0x99, 0x0d, 0x93, 0xe1, 0xce, 0x3f, 0x0b, 0x96, 0x82, 0x47, 0xfe, 0x60, 0x6f, 0x8f, 0x61, 0x88, 0xd7, 0x05, 0x95, 0x0b, 0x46, 0x06, 0xb7, 0x32, 0x06, - /* (2^ 18)P */ 0x44, 0xf5, 0x34, 0xdf, 0x2f, 0x9c, 0x5d, 0x9f, 0x53, 0x5c, 0x42, 0x8f, 0xc9, 0xdc, 0xd8, 0x40, 0xa2, 0xe7, 0x6a, 0x4a, 0x05, 0xf7, 0x86, 0x77, 0x2b, 0xae, 0x37, 0xed, 0x48, 0xfb, 0xf7, 0x62, 0x7c, 0x17, 0x59, 0x92, 0x41, 0x61, 0x93, 0x38, 0x30, 0xd1, 0xef, 0x54, 0x54, 0x03, 0x17, 0x57, 0x91, 0x15, 0x11, 0x33, 0xb5, 0xfa, 0xfb, 0x17, - /* (2^ 19)P */ 0x29, 0xbb, 0xd4, 0xb4, 0x9c, 0xf1, 0x72, 0x94, 0xce, 0x6a, 0x29, 0xa8, 0x89, 0x18, 0x19, 0xf7, 0xb7, 0xcc, 0xee, 0x9a, 0x02, 0xe3, 0xc0, 0xb1, 0xe0, 0xee, 0x83, 0x78, 0xb4, 0x9e, 0x07, 0x87, 0xdf, 0xb0, 0x82, 0x26, 0x4e, 0xa4, 0x0c, 0x33, 0xaf, 0x40, 0x59, 0xb6, 0xdd, 0x52, 0x45, 0xf0, 0xb4, 0xf6, 0xe8, 0x4e, 0x4e, 0x79, 0x1a, 0x5d, - /* (2^ 20)P */ 0x27, 0x33, 0x4d, 0x4c, 0x6b, 0x4f, 0x75, 0xb1, 0xbc, 0x1f, 0xab, 0x5b, 0x2b, 0xf0, 0x1c, 0x57, 0x86, 0xdd, 0xfd, 0x60, 0xb0, 0x8c, 0xe7, 0x9a, 0xe5, 0x5c, 0xeb, 0x11, 0x3a, 0xda, 0x22, 0x25, 0x99, 0x06, 0x8d, 0xf4, 0xaf, 0x29, 0x7a, 0xc9, 0xe5, 0xd2, 0x16, 0x9e, 0xd4, 0x63, 0x1d, 0x64, 0xa6, 0x47, 0x96, 0x37, 0x6f, 0x93, 0x2c, 0xcc, - /* (2^ 21)P */ 0xc1, 0x94, 0x74, 0x86, 0x75, 0xf2, 0x91, 0x58, 0x23, 0x85, 0x63, 0x76, 0x54, 0xc7, 0xb4, 0x8c, 0xbc, 0x4e, 0xc4, 0xa7, 0xba, 0xa0, 0x55, 0x26, 0x71, 0xd5, 0x33, 0x72, 0xc9, 0xad, 0x1e, 0xf9, 0x5d, 0x78, 0x70, 0x93, 0x4e, 0x85, 0xfc, 0x39, 0x06, 0x73, 0x76, 0xff, 0xe8, 0x64, 0x69, 0x42, 0x45, 0xb2, 0x69, 0xb5, 0x32, 0xe7, 0x2c, 0xde, - /* (2^ 22)P */ 0xde, 0x16, 0xd8, 0x33, 0x49, 0x32, 0xe9, 0x0e, 0x3a, 0x60, 0xee, 0x2e, 0x24, 0x75, 0xe3, 0x9c, 0x92, 0x07, 0xdb, 0xad, 0x92, 0xf5, 0x11, 0xdf, 0xdb, 0xb0, 0x17, 0x5c, 0xd6, 0x1a, 0x70, 0x00, 0xb7, 0xe2, 0x18, 0xec, 0xdc, 0xc2, 0x02, 0x93, 0xb3, 0xc8, 0x3f, 0x4f, 0x1b, 0x96, 0xe6, 0x33, 0x8c, 0xfb, 0xcc, 0xa5, 0x4e, 0xe8, 0xe7, 0x11, - /* (2^ 23)P */ 0x05, 0x7a, 0x74, 0x52, 0xf8, 0xdf, 0x0d, 0x7c, 0x6a, 0x1a, 0x4e, 0x9a, 0x02, 0x1d, 0xae, 0x77, 0xf8, 0x8e, 0xf9, 0xa2, 0x38, 0x54, 0x50, 0xb2, 0x2c, 0x08, 0x9d, 0x9b, 0x9f, 0xfb, 0x2b, 0x06, 0xde, 0x9d, 0xc2, 0x03, 0x0b, 0x22, 0x2b, 0x10, 0x5b, 0x3a, 0x73, 0x29, 0x8e, 0x3e, 0x37, 0x08, 0x2c, 0x3b, 0xf8, 0x80, 0xc1, 0x66, 0x1e, 0x98, - /* (2^ 24)P */ 0xd8, 0xd6, 0x3e, 0xcd, 0x63, 0x8c, 0x2b, 0x41, 0x81, 0xc0, 0x0c, 0x06, 0x87, 0xd6, 0xe7, 0x92, 0xfe, 0xf1, 0x0c, 0x4a, 0x84, 0x5b, 0xaf, 0x40, 0x53, 0x6f, 0x60, 0xd6, 0x6b, 0x76, 0x4b, 0xc2, 0xad, 0xc9, 0xb6, 0xb6, 0x6a, 0xa2, 0xb3, 0xf5, 0xf5, 0xc2, 0x55, 0x83, 0xb2, 0xd3, 0xe9, 0x41, 0x6c, 0x63, 0x51, 0xb8, 0x81, 0x74, 0xc8, 0x2c, - /* (2^ 25)P */ 0xb2, 0xaf, 0x1c, 0xee, 0x07, 0xb0, 0x58, 0xa8, 0x2c, 0x6a, 0xc9, 0x2d, 0x62, 0x28, 0x75, 0x0c, 0x40, 0xb6, 0x11, 0x33, 0x96, 0x80, 0x28, 0x6d, 0xd5, 0x9e, 0x87, 0x90, 0x01, 0x66, 0x1d, 0x1c, 0xf8, 0xb4, 0x92, 0xac, 0x38, 0x18, 0x05, 0xc2, 0x4c, 0x4b, 0x54, 0x7d, 0x80, 0x46, 0x87, 0x2d, 0x99, 0x8e, 0x70, 0x80, 0x69, 0x71, 0x8b, 0xed, - /* (2^ 26)P */ 0x37, 0xa7, 0x6b, 0x71, 0x36, 0x75, 0x8e, 0xff, 0x0f, 0x42, 0xda, 0x5a, 0x46, 0xa6, 0x97, 0x79, 0x7e, 0x30, 0xb3, 0x8f, 0xc7, 0x3a, 0xa0, 0xcb, 0x1d, 0x9c, 0x78, 0x77, 0x36, 0xc2, 0xe7, 0xf4, 0x2f, 0x29, 0x07, 0xb1, 0x07, 0xfd, 0xed, 0x1b, 0x39, 0x77, 0x06, 0x38, 0x77, 0x0f, 0x50, 0x31, 0x12, 0xbf, 0x92, 0xbf, 0x72, 0x79, 0x54, 0xa9, - /* (2^ 27)P */ 0xbd, 0x4d, 0x46, 0x6b, 0x1a, 0x80, 0x46, 0x2d, 0xed, 0xfd, 0x64, 0x6d, 0x94, 0xbc, 0x4a, 0x6e, 0x0c, 0x12, 0xf6, 0x12, 0xab, 0x54, 0x88, 0xd3, 0x85, 0xac, 0x51, 0xae, 0x6f, 0xca, 0xc4, 0xb7, 0xec, 0x22, 0x54, 0x6d, 0x80, 0xb2, 0x1c, 0x63, 0x33, 0x76, 0x6b, 0x8e, 0x6d, 0x59, 0xcd, 0x73, 0x92, 0x5f, 0xff, 0xad, 0x10, 0x35, 0x70, 0x5f, - /* (2^ 28)P */ 0xb3, 0x84, 0xde, 0xc8, 0x04, 0x43, 0x63, 0xfa, 0x29, 0xd9, 0xf0, 0x69, 0x65, 0x5a, 0x0c, 0xe8, 0x2e, 0x0b, 0xfe, 0xb0, 0x7a, 0x42, 0xb3, 0xc3, 0xfc, 0xe6, 0xb8, 0x92, 0x29, 0xae, 0xed, 0xec, 0xd5, 0xe8, 0x4a, 0xa1, 0xbd, 0x3b, 0xd3, 0xc0, 0x07, 0xab, 0x65, 0x65, 0x35, 0x9a, 0xa6, 0x5e, 0x78, 0x18, 0x76, 0x1c, 0x15, 0x49, 0xe6, 0x75, - /* (2^ 29)P */ 0x45, 0xb3, 0x92, 0xa9, 0xc3, 0xb8, 0x11, 0x68, 0x64, 0x3a, 0x83, 0x5d, 0xa8, 0x94, 0x6a, 0x9d, 0xaa, 0x27, 0x9f, 0x98, 0x5d, 0xc0, 0x29, 0xf0, 0xc0, 0x4b, 0x14, 0x3c, 0x05, 0xe7, 0xf8, 0xbd, 0x38, 0x22, 0x96, 0x75, 0x65, 0x5e, 0x0d, 0x3f, 0xbb, 0x6f, 0xe8, 0x3f, 0x96, 0x76, 0x9f, 0xba, 0xd9, 0x44, 0x92, 0x96, 0x22, 0xe7, 0x52, 0xe7, - /* (2^ 30)P */ 0xf4, 0xa3, 0x95, 0x90, 0x47, 0xdf, 0x7d, 0xdc, 0xf4, 0x13, 0x87, 0x67, 0x7d, 0x4f, 0x9d, 0xa0, 0x00, 0x46, 0x72, 0x08, 0xc3, 0xa2, 0x7a, 0x3e, 0xe7, 0x6d, 0x52, 0x7c, 0x11, 0x36, 0x50, 0x83, 0x89, 0x64, 0xcb, 0x1f, 0x08, 0x83, 0x46, 0xcb, 0xac, 0xa6, 0xd8, 0x9c, 0x1b, 0xe8, 0x05, 0x47, 0xc7, 0x26, 0x06, 0x83, 0x39, 0xe9, 0xb1, 0x1c, - /* (2^ 31)P */ 0x11, 0xe8, 0xc8, 0x42, 0xbf, 0x30, 0x9c, 0xa3, 0xf1, 0x85, 0x96, 0x95, 0x4f, 0x4f, 0x52, 0xa2, 0xf5, 0x8b, 0x68, 0x24, 0x16, 0xac, 0x9b, 0xa9, 0x27, 0x28, 0x0e, 0x84, 0x03, 0x46, 0x22, 0x5f, 0xf7, 0x0d, 0xa6, 0x85, 0x88, 0xc1, 0x45, 0x4b, 0x85, 0x1a, 0x10, 0x7f, 0xc9, 0x94, 0x20, 0xb0, 0x04, 0x28, 0x12, 0x30, 0xb9, 0xe6, 0x40, 0x6b, - /* (2^ 32)P */ 0xac, 0x1b, 0x57, 0xb6, 0x42, 0xdb, 0x81, 0x8d, 0x76, 0xfd, 0x9b, 0x1c, 0x29, 0x30, 0xd5, 0x3a, 0xcc, 0x53, 0xd9, 0x26, 0x7a, 0x0f, 0x9c, 0x2e, 0x79, 0xf5, 0x62, 0xeb, 0x61, 0x9d, 0x9b, 0x80, 0x39, 0xcd, 0x60, 0x2e, 0x1f, 0x08, 0x22, 0xbc, 0x19, 0xb3, 0x2a, 0x43, 0x44, 0xf2, 0x4e, 0x66, 0xf4, 0x36, 0xa6, 0xa7, 0xbc, 0xa4, 0x15, 0x7e, - /* (2^ 33)P */ 0xc1, 0x90, 0x8a, 0xde, 0xff, 0x78, 0xc3, 0x73, 0x16, 0xee, 0x76, 0xa0, 0x84, 0x60, 0x8d, 0xe6, 0x82, 0x0f, 0xde, 0x4e, 0xc5, 0x99, 0x34, 0x06, 0x90, 0x44, 0x55, 0xf8, 0x91, 0xd8, 0xe1, 0xe4, 0x2c, 0x8a, 0xde, 0x94, 0x1e, 0x78, 0x25, 0x3d, 0xfd, 0xd8, 0x59, 0x7d, 0xaf, 0x6e, 0xbe, 0x96, 0xbe, 0x3c, 0x16, 0x23, 0x0f, 0x4c, 0xa4, 0x28, - /* (2^ 34)P */ 0xba, 0x11, 0x35, 0x57, 0x03, 0xb6, 0xf4, 0x24, 0x89, 0xb8, 0x5a, 0x0d, 0x50, 0x9c, 0xaa, 0x51, 0x7f, 0xa4, 0x0e, 0xfc, 0x71, 0xb3, 0x3b, 0xf1, 0x96, 0x50, 0x23, 0x15, 0xf5, 0xf5, 0xd4, 0x23, 0xdc, 0x8b, 0x26, 0x9e, 0xae, 0xb7, 0x50, 0xcd, 0xc4, 0x25, 0xf6, 0x75, 0x40, 0x9c, 0x37, 0x79, 0x33, 0x60, 0xd4, 0x4b, 0x13, 0x32, 0xee, 0xe2, - /* (2^ 35)P */ 0x43, 0xb8, 0x56, 0x59, 0xf0, 0x68, 0x23, 0xb3, 0xea, 0x70, 0x58, 0x4c, 0x1e, 0x5a, 0x16, 0x54, 0x03, 0xb2, 0xf4, 0x73, 0xb6, 0xd9, 0x5c, 0x9c, 0x6f, 0xcf, 0x82, 0x2e, 0x54, 0x15, 0x46, 0x2c, 0xa3, 0xda, 0x4e, 0x87, 0xf5, 0x2b, 0xba, 0x91, 0xa3, 0xa0, 0x89, 0xba, 0x48, 0x2b, 0xfa, 0x64, 0x02, 0x7f, 0x78, 0x03, 0xd1, 0xe8, 0x3b, 0xe9, - /* (2^ 36)P */ 0x15, 0xa4, 0x71, 0xd4, 0x0c, 0x24, 0xe9, 0x07, 0xa1, 0x43, 0xf4, 0x7f, 0xbb, 0xa2, 0xa6, 0x6b, 0xfa, 0xb7, 0xea, 0x58, 0xd1, 0x96, 0xb0, 0x24, 0x5c, 0xc7, 0x37, 0x4e, 0x60, 0x0f, 0x40, 0xf2, 0x2f, 0x44, 0x70, 0xea, 0x80, 0x63, 0xfe, 0xfc, 0x46, 0x59, 0x12, 0x27, 0xb5, 0x27, 0xfd, 0xb7, 0x73, 0x0b, 0xca, 0x8b, 0xc2, 0xd3, 0x71, 0x08, - /* (2^ 37)P */ 0x26, 0x0e, 0xd7, 0x52, 0x6f, 0xf1, 0xf2, 0x9d, 0xb8, 0x3d, 0xbd, 0xd4, 0x75, 0x97, 0xd8, 0xbf, 0xa8, 0x86, 0x96, 0xa5, 0x80, 0xa0, 0x45, 0x75, 0xf6, 0x77, 0x71, 0xdb, 0x77, 0x96, 0x55, 0x99, 0x31, 0xd0, 0x4f, 0x34, 0xf4, 0x35, 0x39, 0x41, 0xd3, 0x7d, 0xf7, 0xe2, 0x74, 0xde, 0xbe, 0x5b, 0x1f, 0x39, 0x10, 0x21, 0xa3, 0x4d, 0x3b, 0xc8, - /* (2^ 38)P */ 0x04, 0x00, 0x2a, 0x45, 0xb2, 0xaf, 0x9b, 0x18, 0x6a, 0xeb, 0x96, 0x28, 0xa4, 0x77, 0xd0, 0x13, 0xcf, 0x17, 0x65, 0xe8, 0xc5, 0x81, 0x28, 0xad, 0x39, 0x7a, 0x0b, 0xaa, 0x55, 0x2b, 0xf3, 0xfc, 0x86, 0x40, 0xad, 0x0d, 0x1e, 0x28, 0xa2, 0x2d, 0xc5, 0xd6, 0x04, 0x15, 0xa2, 0x30, 0x3d, 0x12, 0x8e, 0xd6, 0xb5, 0xf7, 0x69, 0xbb, 0x84, 0x20, - /* (2^ 39)P */ 0xd7, 0x7a, 0x77, 0x2c, 0xfb, 0x81, 0x80, 0xe9, 0x1e, 0xc6, 0x36, 0x31, 0x79, 0xc3, 0x7c, 0xa9, 0x57, 0x6b, 0xb5, 0x70, 0xfb, 0xe4, 0xa1, 0xff, 0xfd, 0x21, 0xa5, 0x7c, 0xfa, 0x44, 0xba, 0x0d, 0x96, 0x3d, 0xc4, 0x5c, 0x39, 0x52, 0x87, 0xd7, 0x22, 0x0f, 0x52, 0x88, 0x91, 0x87, 0x96, 0xac, 0xfa, 0x3b, 0xdf, 0xdc, 0x83, 0x8c, 0x99, 0x29, - /* (2^ 40)P */ 0x98, 0x6b, 0x3a, 0x8d, 0x83, 0x17, 0xe1, 0x62, 0xd8, 0x80, 0x4c, 0x97, 0xce, 0x6b, 0xaa, 0x10, 0xa7, 0xc4, 0xe9, 0xeb, 0xa5, 0xfb, 0xc9, 0xdd, 0x2d, 0xeb, 0xfc, 0x9a, 0x71, 0xcd, 0x68, 0x6e, 0xc0, 0x35, 0x64, 0x62, 0x1b, 0x95, 0x12, 0xe8, 0x53, 0xec, 0xf0, 0xf4, 0x86, 0x86, 0x78, 0x18, 0xc4, 0xc6, 0xbc, 0x5a, 0x59, 0x8f, 0x7c, 0x7e, - /* (2^ 41)P */ 0x7f, 0xd7, 0x1e, 0xc5, 0x83, 0xdc, 0x1f, 0xbe, 0x0b, 0xcf, 0x2e, 0x01, 0x01, 0xed, 0xac, 0x17, 0x3b, 0xed, 0xa4, 0x30, 0x96, 0x0e, 0x14, 0x7e, 0x19, 0x2b, 0xa5, 0x67, 0x1e, 0xb3, 0x34, 0x03, 0xa8, 0xbb, 0x0a, 0x7d, 0x08, 0x2d, 0xd5, 0x53, 0x19, 0x6f, 0x13, 0xd5, 0xc0, 0x90, 0x8a, 0xcc, 0xc9, 0x5c, 0xab, 0x24, 0xd7, 0x03, 0xf6, 0x57, - /* (2^ 42)P */ 0x49, 0xcb, 0xb4, 0x96, 0x5f, 0xa6, 0xf8, 0x71, 0x6f, 0x59, 0xad, 0x05, 0x24, 0x2d, 0xaf, 0x67, 0xa8, 0xbe, 0x95, 0xdf, 0x0d, 0x28, 0x5a, 0x7f, 0x6e, 0x87, 0x8c, 0x6e, 0x67, 0x0c, 0xf4, 0xe0, 0x1c, 0x30, 0xc2, 0x66, 0xae, 0x20, 0xa1, 0x34, 0xec, 0x9c, 0xbc, 0xae, 0x3d, 0xa1, 0x28, 0x28, 0x95, 0x1d, 0xc9, 0x3a, 0xa8, 0xfd, 0xfc, 0xa1, - /* (2^ 43)P */ 0xe2, 0x2b, 0x9d, 0xed, 0x02, 0x99, 0x67, 0xbb, 0x2e, 0x16, 0x62, 0x05, 0x70, 0xc7, 0x27, 0xb9, 0x1c, 0x3f, 0xf2, 0x11, 0x01, 0xd8, 0x51, 0xa4, 0x18, 0x92, 0xa9, 0x5d, 0xfb, 0xa9, 0xe4, 0x42, 0xba, 0x38, 0x34, 0x1a, 0x4a, 0xc5, 0x6a, 0x37, 0xde, 0xa7, 0x0c, 0xb4, 0x7e, 0x7f, 0xde, 0xa6, 0xee, 0xcd, 0x55, 0x57, 0x05, 0x06, 0xfd, 0x5d, - /* (2^ 44)P */ 0x2f, 0x32, 0xcf, 0x2e, 0x2c, 0x7b, 0xbe, 0x9a, 0x0c, 0x57, 0x35, 0xf8, 0x87, 0xda, 0x9c, 0xec, 0x48, 0xf2, 0xbb, 0xe2, 0xda, 0x10, 0x58, 0x20, 0xc6, 0xd3, 0x87, 0xe9, 0xc7, 0x26, 0xd1, 0x9a, 0x46, 0x87, 0x90, 0xda, 0xdc, 0xde, 0xc3, 0xb3, 0xf2, 0xe8, 0x6f, 0x4a, 0xe6, 0xe8, 0x9d, 0x98, 0x36, 0x20, 0x03, 0x47, 0x15, 0x3f, 0x64, 0x59, - /* (2^ 45)P */ 0xd4, 0x71, 0x49, 0x0a, 0x67, 0x97, 0xaa, 0x3f, 0xf4, 0x1b, 0x3a, 0x6e, 0x5e, 0x17, 0xcc, 0x0a, 0x8f, 0x81, 0x6a, 0x41, 0x38, 0x77, 0x40, 0x8a, 0x11, 0x42, 0x62, 0xd2, 0x50, 0x32, 0x79, 0x78, 0x28, 0xc2, 0x2e, 0x10, 0x01, 0x94, 0x30, 0x4f, 0x7f, 0x18, 0x17, 0x56, 0x85, 0x4e, 0xad, 0xf7, 0xcb, 0x87, 0x3c, 0x3f, 0x50, 0x2c, 0xc0, 0xba, - /* (2^ 46)P */ 0xbc, 0x30, 0x8e, 0x65, 0x8e, 0x57, 0x5b, 0x38, 0x7a, 0xd4, 0x95, 0x52, 0x7a, 0x32, 0x59, 0x69, 0xcd, 0x9d, 0x47, 0x34, 0x5b, 0x55, 0xa5, 0x24, 0x60, 0xdd, 0xc0, 0xc1, 0x62, 0x73, 0x44, 0xae, 0x4c, 0x9c, 0x65, 0x55, 0x1b, 0x9d, 0x8a, 0x29, 0xb0, 0x1a, 0x52, 0xa8, 0xf1, 0xe6, 0x9a, 0xb3, 0xf6, 0xa3, 0xc9, 0x0a, 0x70, 0x7d, 0x0f, 0xee, - /* (2^ 47)P */ 0x77, 0xd3, 0xe5, 0x8e, 0xfa, 0x00, 0xeb, 0x1b, 0x7f, 0xdc, 0x68, 0x3f, 0x92, 0xbd, 0xb7, 0x0b, 0xb7, 0xb5, 0x24, 0xdf, 0xc5, 0x67, 0x53, 0xd4, 0x36, 0x79, 0xc4, 0x7b, 0x57, 0xbc, 0x99, 0x97, 0x60, 0xef, 0xe4, 0x01, 0xa1, 0xa7, 0xaa, 0x12, 0x36, 0x29, 0xb1, 0x03, 0xc2, 0x83, 0x1c, 0x2b, 0x83, 0xef, 0x2e, 0x2c, 0x23, 0x92, 0xfd, 0xd1, - /* (2^ 48)P */ 0x94, 0xef, 0x03, 0x59, 0xfa, 0x8a, 0x18, 0x76, 0xee, 0x58, 0x08, 0x4d, 0x44, 0xce, 0xf1, 0x52, 0x33, 0x49, 0xf6, 0x69, 0x71, 0xe3, 0xa9, 0xbc, 0x86, 0xe3, 0x43, 0xde, 0x33, 0x7b, 0x90, 0x8b, 0x3e, 0x7d, 0xd5, 0x4a, 0xf0, 0x23, 0x99, 0xa6, 0xea, 0x5f, 0x08, 0xe5, 0xb9, 0x49, 0x8b, 0x0d, 0x6a, 0x21, 0xab, 0x07, 0x62, 0xcd, 0xc4, 0xbe, - /* (2^ 49)P */ 0x61, 0xbf, 0x70, 0x14, 0xfa, 0x4e, 0x9e, 0x7c, 0x0c, 0xf8, 0xb2, 0x48, 0x71, 0x62, 0x83, 0xd6, 0xd1, 0xdc, 0x9c, 0x29, 0x66, 0xb1, 0x34, 0x9c, 0x8d, 0xe6, 0x88, 0xaf, 0xbe, 0xdc, 0x4d, 0xeb, 0xb0, 0xe7, 0x28, 0xae, 0xb2, 0x05, 0x56, 0xc6, 0x0e, 0x10, 0x26, 0xab, 0x2c, 0x59, 0x72, 0x03, 0x66, 0xfe, 0x8f, 0x2c, 0x51, 0x2d, 0xdc, 0xae, - /* (2^ 50)P */ 0xdc, 0x63, 0xf1, 0x8b, 0x5c, 0x65, 0x0b, 0xf1, 0xa6, 0x22, 0xe2, 0xd9, 0xdb, 0x49, 0xb1, 0x3c, 0x47, 0xc2, 0xfe, 0xac, 0x86, 0x07, 0x52, 0xec, 0xb0, 0x08, 0x69, 0xfb, 0xd1, 0x06, 0xdc, 0x48, 0x5c, 0x3d, 0xb2, 0x4d, 0xb8, 0x1a, 0x4e, 0xda, 0xb9, 0xc1, 0x2b, 0xab, 0x4b, 0x62, 0x81, 0x21, 0x9a, 0xfc, 0x3d, 0x39, 0x83, 0x11, 0x36, 0xeb, - /* (2^ 51)P */ 0x94, 0xf3, 0x17, 0xef, 0xf9, 0x60, 0x54, 0xc3, 0xd7, 0x27, 0x35, 0xc5, 0x98, 0x5e, 0xf6, 0x63, 0x6c, 0xa0, 0x4a, 0xd3, 0xa3, 0x98, 0xd9, 0x42, 0xe3, 0xf1, 0xf8, 0x81, 0x96, 0xa9, 0xea, 0x6d, 0x4b, 0x8e, 0x33, 0xca, 0x94, 0x0d, 0xa0, 0xf7, 0xbb, 0x64, 0xa3, 0x36, 0x6f, 0xdc, 0x5a, 0x94, 0x42, 0xca, 0x06, 0xb2, 0x2b, 0x9a, 0x9f, 0x71, - /* (2^ 52)P */ 0xec, 0xdb, 0xa6, 0x1f, 0xdf, 0x15, 0x36, 0xa3, 0xda, 0x8a, 0x7a, 0xb6, 0xa7, 0xe3, 0xaf, 0x52, 0xe0, 0x8d, 0xe8, 0xf2, 0x44, 0x20, 0xeb, 0xa1, 0x20, 0xc4, 0x65, 0x3c, 0x7c, 0x6c, 0x49, 0xed, 0x2f, 0x66, 0x23, 0x68, 0x61, 0x91, 0x40, 0x9f, 0x50, 0x19, 0xd1, 0x84, 0xa7, 0xe2, 0xed, 0x34, 0x37, 0xe3, 0xe4, 0x11, 0x7f, 0x87, 0x55, 0x0f, - /* (2^ 53)P */ 0xb3, 0xa1, 0x0f, 0xb0, 0x48, 0xc0, 0x4d, 0x96, 0xa7, 0xcf, 0x5a, 0x81, 0xb8, 0x4a, 0x46, 0xef, 0x0a, 0xd3, 0x40, 0x7e, 0x02, 0xe3, 0x63, 0xaa, 0x50, 0xd1, 0x2a, 0x37, 0x22, 0x4a, 0x7f, 0x4f, 0xb6, 0xf9, 0x01, 0x82, 0x78, 0x3d, 0x93, 0x14, 0x11, 0x8a, 0x90, 0x60, 0xcd, 0x45, 0x4e, 0x7b, 0x42, 0xb9, 0x3e, 0x6e, 0x68, 0x1f, 0x36, 0x41, - /* (2^ 54)P */ 0x13, 0x73, 0x0e, 0x4f, 0x79, 0x93, 0x9e, 0x29, 0x70, 0x7b, 0x4a, 0x59, 0x1a, 0x9a, 0xf4, 0x55, 0x08, 0xf0, 0xdb, 0x17, 0x58, 0xec, 0x64, 0xad, 0x7f, 0x29, 0xeb, 0x3f, 0x85, 0x4e, 0x60, 0x28, 0x98, 0x1f, 0x73, 0x4e, 0xe6, 0xa8, 0xab, 0xd5, 0xd6, 0xfc, 0xa1, 0x36, 0x6d, 0x15, 0xc6, 0x13, 0x83, 0xa0, 0xc2, 0x6e, 0xd9, 0xdb, 0xc9, 0xcc, - /* (2^ 55)P */ 0xff, 0xd8, 0x52, 0xa3, 0xdc, 0x99, 0xcf, 0x3e, 0x19, 0xb3, 0x68, 0xd0, 0xb5, 0x0d, 0xb8, 0xee, 0x3f, 0xef, 0x6e, 0xc0, 0x38, 0x28, 0x44, 0x92, 0x78, 0x91, 0x1a, 0x08, 0x78, 0x6c, 0x65, 0x24, 0xf3, 0xa2, 0x3d, 0xf2, 0xe5, 0x79, 0x62, 0x69, 0x29, 0xf4, 0x22, 0xc5, 0xdb, 0x6a, 0xae, 0xf4, 0x44, 0xa3, 0x6f, 0xc7, 0x86, 0xab, 0xef, 0xef, - /* (2^ 56)P */ 0xbf, 0x54, 0x9a, 0x09, 0x5d, 0x17, 0xd0, 0xde, 0xfb, 0xf5, 0xca, 0xff, 0x13, 0x20, 0x88, 0x82, 0x3a, 0xe2, 0xd0, 0x3b, 0xfb, 0x05, 0x76, 0xd1, 0xc0, 0x02, 0x71, 0x3b, 0x94, 0xe8, 0xc9, 0x84, 0xcf, 0xa4, 0xe9, 0x28, 0x7b, 0xf5, 0x09, 0xc3, 0x2b, 0x22, 0x40, 0xf1, 0x68, 0x24, 0x24, 0x7d, 0x9f, 0x6e, 0xcd, 0xfe, 0xb0, 0x19, 0x61, 0xf5, - /* (2^ 57)P */ 0xe8, 0x63, 0x51, 0xb3, 0x95, 0x6b, 0x7b, 0x74, 0x92, 0x52, 0x45, 0xa4, 0xed, 0xea, 0x0e, 0x0d, 0x2b, 0x01, 0x1e, 0x2c, 0xbc, 0x91, 0x06, 0x69, 0xdb, 0x1f, 0xb5, 0x77, 0x1d, 0x56, 0xf5, 0xb4, 0x02, 0x80, 0x49, 0x56, 0x12, 0xce, 0x86, 0x05, 0xc9, 0xd9, 0xae, 0xf3, 0x6d, 0xe6, 0x3f, 0x40, 0x52, 0xe9, 0x49, 0x2b, 0x31, 0x06, 0x86, 0x14, - /* (2^ 58)P */ 0xf5, 0x09, 0x3b, 0xd2, 0xff, 0xdf, 0x11, 0xa5, 0x1c, 0x99, 0xe8, 0x1b, 0xa4, 0x2c, 0x7d, 0x8e, 0xc8, 0xf7, 0x03, 0x46, 0xfa, 0xb6, 0xde, 0x73, 0x91, 0x7e, 0x5a, 0x7a, 0xd7, 0x9a, 0x5b, 0x80, 0x24, 0x62, 0x5e, 0x92, 0xf1, 0xa3, 0x45, 0xa3, 0x43, 0x92, 0x8a, 0x2a, 0x5b, 0x0c, 0xb4, 0xc8, 0xad, 0x1c, 0xb6, 0x6c, 0x5e, 0x81, 0x18, 0x91, - /* (2^ 59)P */ 0x96, 0xb3, 0xca, 0x2b, 0xe3, 0x7a, 0x59, 0x72, 0x17, 0x74, 0x29, 0x21, 0xe7, 0x78, 0x07, 0xad, 0xda, 0xb6, 0xcd, 0xf9, 0x27, 0x4d, 0xc8, 0xf2, 0x98, 0x22, 0xca, 0xf2, 0x33, 0x74, 0x7a, 0xdd, 0x1e, 0x71, 0xec, 0xe3, 0x3f, 0xe2, 0xa2, 0xd2, 0x38, 0x75, 0xb0, 0xd0, 0x0a, 0xcf, 0x7d, 0x36, 0xdc, 0x49, 0x38, 0x25, 0x34, 0x4f, 0x20, 0x9a, - /* (2^ 60)P */ 0x2b, 0x6e, 0x04, 0x0d, 0x4f, 0x3d, 0x3b, 0x24, 0xf6, 0x4e, 0x5e, 0x0a, 0xbd, 0x48, 0x96, 0xba, 0x81, 0x8f, 0x39, 0x82, 0x13, 0xe6, 0x72, 0xf3, 0x0f, 0xb6, 0x94, 0xf4, 0xc5, 0x90, 0x74, 0x91, 0xa8, 0xf2, 0xc9, 0xca, 0x9a, 0x4d, 0x98, 0xf2, 0xdf, 0x52, 0x4e, 0x97, 0x2f, 0xeb, 0x84, 0xd3, 0xaf, 0xc2, 0xcc, 0xfb, 0x4c, 0x26, 0x4b, 0xe4, - /* (2^ 61)P */ 0x12, 0x9e, 0xfb, 0x9d, 0x78, 0x79, 0x99, 0xdd, 0xb3, 0x0b, 0x2e, 0x56, 0x41, 0x8e, 0x3f, 0x39, 0xb8, 0x97, 0x89, 0x53, 0x9b, 0x8a, 0x3c, 0x40, 0x9d, 0xa4, 0x6c, 0x2e, 0x31, 0x71, 0xc6, 0x0a, 0x41, 0xd4, 0x95, 0x06, 0x5e, 0xc1, 0xab, 0xc2, 0x14, 0xc4, 0xc7, 0x15, 0x08, 0x3a, 0xad, 0x7a, 0xb4, 0x62, 0xa3, 0x0c, 0x90, 0xf4, 0x47, 0x08, - /* (2^ 62)P */ 0x7f, 0xec, 0x09, 0x82, 0xf5, 0x94, 0x09, 0x93, 0x32, 0xd3, 0xdc, 0x56, 0x80, 0x7b, 0x5b, 0x22, 0x80, 0x6a, 0x96, 0x72, 0xb1, 0xc2, 0xd9, 0xa1, 0x8b, 0x66, 0x42, 0x16, 0xe2, 0x07, 0xb3, 0x2d, 0xf1, 0x75, 0x35, 0x72, 0xc7, 0x98, 0xbe, 0x63, 0x3b, 0x20, 0x75, 0x05, 0xc1, 0x3e, 0x31, 0x5a, 0xf7, 0xaa, 0xae, 0x4b, 0xdb, 0x1d, 0xd0, 0x74, - /* (2^ 63)P */ 0x36, 0x5c, 0x74, 0xe6, 0x5d, 0x59, 0x3f, 0x15, 0x4b, 0x4d, 0x4e, 0x67, 0x41, 0xfe, 0x98, 0x1f, 0x49, 0x76, 0x91, 0x0f, 0x9b, 0xf4, 0xaf, 0x86, 0xaf, 0x66, 0x19, 0xed, 0x46, 0xf1, 0x05, 0x9a, 0xcc, 0xd1, 0x14, 0x1f, 0x82, 0x12, 0x8e, 0xe6, 0xf4, 0xc3, 0x42, 0x5c, 0x4e, 0x33, 0x93, 0xbe, 0x30, 0xe7, 0x64, 0xa9, 0x35, 0x00, 0x4d, 0xf9, - /* (2^ 64)P */ 0x1f, 0xc1, 0x1e, 0xb7, 0xe3, 0x7c, 0xfa, 0xa3, 0x6b, 0x76, 0xaf, 0x9c, 0x05, 0x85, 0x4a, 0xa9, 0xfb, 0xe3, 0x7e, 0xf2, 0x49, 0x56, 0xdc, 0x2f, 0x57, 0x10, 0xba, 0x37, 0xb2, 0x62, 0xf5, 0x6b, 0xe5, 0x8f, 0x0a, 0x87, 0xd1, 0x6a, 0xcb, 0x9d, 0x07, 0xd0, 0xf6, 0x38, 0x99, 0x2c, 0x61, 0x4a, 0x4e, 0xd8, 0xd2, 0x88, 0x29, 0x99, 0x11, 0x95, - /* (2^ 65)P */ 0x6f, 0xdc, 0xd5, 0xd6, 0xd6, 0xa7, 0x4c, 0x46, 0x93, 0x65, 0x62, 0x23, 0x95, 0x32, 0x9c, 0xde, 0x40, 0x41, 0x68, 0x2c, 0x18, 0x4e, 0x5a, 0x8c, 0xc0, 0xc5, 0xc5, 0xea, 0x5c, 0x45, 0x0f, 0x60, 0x78, 0x39, 0xb6, 0x36, 0x23, 0x12, 0xbc, 0x21, 0x9a, 0xf8, 0x91, 0xac, 0xc4, 0x70, 0xdf, 0x85, 0x8e, 0x3c, 0xec, 0x22, 0x04, 0x98, 0xa8, 0xaa, - /* (2^ 66)P */ 0xcc, 0x52, 0x10, 0x5b, 0x4b, 0x6c, 0xc5, 0xfa, 0x3e, 0xd4, 0xf8, 0x1c, 0x04, 0x14, 0x48, 0x33, 0xd9, 0xfc, 0x5f, 0xb0, 0xa5, 0x48, 0x8c, 0x45, 0x8a, 0xee, 0x3e, 0xa7, 0xc1, 0x2e, 0x34, 0xca, 0xf6, 0xc9, 0xeb, 0x10, 0xbb, 0xe1, 0x59, 0x84, 0x25, 0xe8, 0x81, 0x70, 0xc0, 0x09, 0x42, 0xa7, 0x3b, 0x0d, 0x33, 0x00, 0xb5, 0x77, 0xbe, 0x25, - /* (2^ 67)P */ 0xcd, 0x1f, 0xbc, 0x7d, 0xef, 0xe5, 0xca, 0x91, 0xaf, 0xa9, 0x59, 0x6a, 0x09, 0xca, 0xd6, 0x1b, 0x3d, 0x55, 0xde, 0xa2, 0x6a, 0x80, 0xd6, 0x95, 0x47, 0xe4, 0x5f, 0x68, 0x54, 0x08, 0xdf, 0x29, 0xba, 0x2a, 0x02, 0x84, 0xe8, 0xe9, 0x00, 0x77, 0x99, 0x36, 0x03, 0xf6, 0x4a, 0x3e, 0x21, 0x81, 0x7d, 0xb8, 0xa4, 0x8a, 0xa2, 0x05, 0xef, 0xbc, - /* (2^ 68)P */ 0x7c, 0x59, 0x5f, 0x66, 0xd9, 0xb7, 0x83, 0x43, 0x8a, 0xa1, 0x8d, 0x51, 0x70, 0xba, 0xf2, 0x9b, 0x95, 0xc0, 0x4b, 0x4c, 0xa0, 0x14, 0xd3, 0xa4, 0x5d, 0x4a, 0x37, 0x36, 0x97, 0x31, 0x1e, 0x12, 0xe7, 0xbb, 0x08, 0x67, 0xa5, 0x23, 0xd7, 0xfb, 0x97, 0xd8, 0x6a, 0x03, 0xb1, 0xf8, 0x7f, 0xda, 0x58, 0xd9, 0x3f, 0x73, 0x4a, 0x53, 0xe1, 0x7b, - /* (2^ 69)P */ 0x55, 0x83, 0x98, 0x78, 0x6c, 0x56, 0x5e, 0xed, 0xf7, 0x23, 0x3e, 0x4c, 0x7d, 0x09, 0x2d, 0x09, 0x9c, 0x58, 0x8b, 0x32, 0xca, 0xfe, 0xbf, 0x47, 0x03, 0xeb, 0x4d, 0xe7, 0xeb, 0x9c, 0x83, 0x05, 0x68, 0xaa, 0x80, 0x89, 0x44, 0xf9, 0xd4, 0xdc, 0xdb, 0xb1, 0xdb, 0x77, 0xac, 0xf9, 0x2a, 0xae, 0x35, 0xac, 0x74, 0xb5, 0x95, 0x62, 0x18, 0x85, - /* (2^ 70)P */ 0xab, 0x82, 0x7e, 0x10, 0xd7, 0xe6, 0x57, 0xd1, 0x66, 0x12, 0x31, 0x9c, 0x9c, 0xa6, 0x27, 0x59, 0x71, 0x2e, 0xeb, 0xa0, 0x68, 0xc5, 0x87, 0x51, 0xf4, 0xca, 0x3f, 0x98, 0x56, 0xb0, 0x89, 0xb1, 0xc7, 0x7b, 0x46, 0xb3, 0xae, 0x36, 0xf2, 0xee, 0x15, 0x1a, 0x60, 0xf4, 0x50, 0x76, 0x4f, 0xc4, 0x53, 0x0d, 0x36, 0x4d, 0x31, 0xb1, 0x20, 0x51, - /* (2^ 71)P */ 0xf7, 0x1d, 0x8c, 0x1b, 0x5e, 0xe5, 0x02, 0x6f, 0xc5, 0xa5, 0xe0, 0x5f, 0xc6, 0xb6, 0x63, 0x43, 0xaf, 0x3c, 0x19, 0x6c, 0xf4, 0xaf, 0xa4, 0x33, 0xb1, 0x0a, 0x37, 0x3d, 0xd9, 0x4d, 0xe2, 0x29, 0x24, 0x26, 0x94, 0x7c, 0x02, 0xe4, 0xe2, 0xf2, 0xbe, 0xbd, 0xac, 0x1b, 0x48, 0xb8, 0xdd, 0xe9, 0x0d, 0x9a, 0x50, 0x1a, 0x98, 0x71, 0x6e, 0xdc, - /* (2^ 72)P */ 0x9f, 0x40, 0xb1, 0xb3, 0x66, 0x28, 0x6c, 0xfe, 0xa6, 0x7d, 0xf8, 0x3e, 0xb8, 0xf3, 0xde, 0x52, 0x76, 0x52, 0xa3, 0x92, 0x98, 0x23, 0xab, 0x4f, 0x88, 0x97, 0xfc, 0x22, 0xe1, 0x6b, 0x67, 0xcd, 0x13, 0x95, 0xda, 0x65, 0xdd, 0x3b, 0x67, 0x3f, 0x5f, 0x4c, 0xf2, 0x8a, 0xad, 0x98, 0xa7, 0x94, 0x24, 0x45, 0x87, 0x11, 0x7c, 0x75, 0x79, 0x85, - /* (2^ 73)P */ 0x70, 0xbf, 0xf9, 0x3b, 0xa9, 0x44, 0x57, 0x72, 0x96, 0xc9, 0xa4, 0x98, 0x65, 0xbf, 0x87, 0xb3, 0x3a, 0x39, 0x12, 0xde, 0xe5, 0x39, 0x01, 0x4f, 0xf7, 0xc0, 0x71, 0x52, 0x36, 0x85, 0xb3, 0x18, 0xf8, 0x14, 0xc0, 0x6d, 0xae, 0x9e, 0x4f, 0xb0, 0x72, 0x87, 0xac, 0x5c, 0xd1, 0x6c, 0x41, 0x6c, 0x90, 0x9d, 0x22, 0x81, 0xe4, 0x2b, 0xea, 0xe5, - /* (2^ 74)P */ 0xfc, 0xea, 0x1a, 0x65, 0xd9, 0x49, 0x6a, 0x39, 0xb5, 0x96, 0x72, 0x7b, 0x32, 0xf1, 0xd0, 0xe9, 0x45, 0xd9, 0x31, 0x55, 0xc7, 0x34, 0xe9, 0x5a, 0xec, 0x73, 0x0b, 0x03, 0xc4, 0xb3, 0xe6, 0xc9, 0x5e, 0x0a, 0x17, 0xfe, 0x53, 0x66, 0x7f, 0x21, 0x18, 0x74, 0x54, 0x1b, 0xc9, 0x49, 0x16, 0xd2, 0x48, 0xaf, 0x5b, 0x47, 0x7b, 0xeb, 0xaa, 0xc9, - /* (2^ 75)P */ 0x47, 0x04, 0xf5, 0x5a, 0x87, 0x77, 0x9e, 0x21, 0x34, 0x4e, 0x83, 0x88, 0xaf, 0x02, 0x1d, 0xb0, 0x5a, 0x1d, 0x1d, 0x7d, 0x8d, 0x2c, 0xd3, 0x8d, 0x63, 0xa9, 0x45, 0xfb, 0x15, 0x6d, 0x86, 0x45, 0xcd, 0x38, 0x0e, 0xf7, 0x37, 0x79, 0xed, 0x6d, 0x5a, 0xbc, 0x32, 0xcc, 0x66, 0xf1, 0x3a, 0xb2, 0x87, 0x6f, 0x70, 0x71, 0xd9, 0xf2, 0xfa, 0x7b, - /* (2^ 76)P */ 0x68, 0x07, 0xdc, 0x61, 0x40, 0xe4, 0xec, 0x32, 0xc8, 0xbe, 0x66, 0x30, 0x54, 0x80, 0xfd, 0x13, 0x7a, 0xef, 0xae, 0xed, 0x2e, 0x00, 0x6d, 0x3f, 0xbd, 0xfc, 0x91, 0x24, 0x53, 0x7f, 0x63, 0x9d, 0x2e, 0xe3, 0x76, 0xe0, 0xf3, 0xe1, 0x8f, 0x7a, 0xc4, 0x77, 0x0c, 0x91, 0xc0, 0xc2, 0x18, 0x6b, 0x04, 0xad, 0xb6, 0x70, 0x9a, 0x64, 0xc5, 0x82, - /* (2^ 77)P */ 0x7f, 0xea, 0x13, 0xd8, 0x9e, 0xfc, 0x5b, 0x06, 0xb5, 0x4f, 0xda, 0x38, 0xe0, 0x9c, 0xd2, 0x3a, 0xc1, 0x1c, 0x62, 0x70, 0x7f, 0xc6, 0x24, 0x0a, 0x47, 0x04, 0x01, 0xc4, 0x55, 0x09, 0xd1, 0x7a, 0x07, 0xba, 0xa3, 0x80, 0x4f, 0xc1, 0x65, 0x36, 0x6d, 0xc0, 0x10, 0xcf, 0x94, 0xa9, 0xa2, 0x01, 0x44, 0xd1, 0xf9, 0x1c, 0x4c, 0xfb, 0xf8, 0x99, - /* (2^ 78)P */ 0x6c, 0xb9, 0x6b, 0xee, 0x43, 0x5b, 0xb9, 0xbb, 0xee, 0x2e, 0x52, 0xc1, 0xc6, 0xb9, 0x61, 0xd2, 0x93, 0xa5, 0xaf, 0x52, 0xf4, 0xa4, 0x1a, 0x51, 0x61, 0xa7, 0xcb, 0x9e, 0xbb, 0x56, 0x65, 0xe2, 0xbf, 0x75, 0xb9, 0x9c, 0x50, 0x96, 0x60, 0x81, 0x74, 0x47, 0xc0, 0x04, 0x88, 0x71, 0x76, 0x39, 0x9a, 0xa7, 0xb1, 0x4e, 0x43, 0x15, 0xe0, 0xbb, - /* (2^ 79)P */ 0xbb, 0xce, 0xe2, 0xbb, 0xf9, 0x17, 0x0f, 0x82, 0x40, 0xad, 0x73, 0xe3, 0xeb, 0x3b, 0x06, 0x1a, 0xcf, 0x8e, 0x6e, 0x28, 0xb8, 0x26, 0xd9, 0x5b, 0xb7, 0xb3, 0xcf, 0xb4, 0x6a, 0x1c, 0xbf, 0x7f, 0xb8, 0xb5, 0x79, 0xcf, 0x45, 0x68, 0x7d, 0xc5, 0xeb, 0xf3, 0xbe, 0x39, 0x40, 0xfc, 0x07, 0x90, 0x7a, 0x62, 0xad, 0x86, 0x08, 0x71, 0x25, 0xe1, - /* (2^ 80)P */ 0x9b, 0x46, 0xac, 0xef, 0xc1, 0x4e, 0xa1, 0x97, 0x95, 0x76, 0xf9, 0x1b, 0xc2, 0xb2, 0x6a, 0x41, 0xea, 0x80, 0x3d, 0xe9, 0x08, 0x52, 0x5a, 0xe3, 0xf2, 0x08, 0xc5, 0xea, 0x39, 0x3f, 0x44, 0x71, 0x4d, 0xea, 0x0d, 0x05, 0x23, 0xe4, 0x2e, 0x3c, 0x89, 0xfe, 0x12, 0x8a, 0x95, 0x42, 0x0a, 0x68, 0xea, 0x5a, 0x28, 0x06, 0x9e, 0xe3, 0x5f, 0xe0, - /* (2^ 81)P */ 0x00, 0x61, 0x6c, 0x98, 0x9b, 0xe7, 0xb9, 0x06, 0x1c, 0xc5, 0x1b, 0xed, 0xbe, 0xc8, 0xb3, 0xea, 0x87, 0xf0, 0xc4, 0x24, 0x7d, 0xbb, 0x5d, 0xa4, 0x1d, 0x7a, 0x16, 0x00, 0x55, 0x94, 0x67, 0x78, 0xbd, 0x58, 0x02, 0x82, 0x90, 0x53, 0x76, 0xd4, 0x72, 0x99, 0x51, 0x6f, 0x7b, 0xcf, 0x80, 0x30, 0x31, 0x3b, 0x01, 0xc7, 0xc1, 0xef, 0xe6, 0x42, - /* (2^ 82)P */ 0xe2, 0x35, 0xaf, 0x4b, 0x79, 0xc6, 0x12, 0x24, 0x99, 0xc0, 0x68, 0xb0, 0x43, 0x3e, 0xe5, 0xef, 0xe2, 0x29, 0xea, 0xb8, 0xb3, 0xbc, 0x6a, 0x53, 0x2c, 0x69, 0x18, 0x5a, 0xf9, 0x15, 0xae, 0x66, 0x58, 0x18, 0xd3, 0x2d, 0x4b, 0x00, 0xfd, 0x84, 0xab, 0x4f, 0xae, 0x70, 0x6b, 0x9e, 0x9a, 0xdf, 0x83, 0xfd, 0x2e, 0x3c, 0xcf, 0xf8, 0x88, 0x5b, - /* (2^ 83)P */ 0xa4, 0x90, 0x31, 0x85, 0x13, 0xcd, 0xdf, 0x64, 0xc9, 0xa1, 0x0b, 0xe7, 0xb6, 0x73, 0x8a, 0x1b, 0x22, 0x78, 0x4c, 0xd4, 0xae, 0x48, 0x18, 0x00, 0x00, 0xa8, 0x9f, 0x06, 0xf9, 0xfb, 0x2d, 0xc3, 0xb1, 0x2a, 0xbc, 0x13, 0x99, 0x57, 0xaf, 0xf0, 0x8d, 0x61, 0x54, 0x29, 0xd5, 0xf2, 0x72, 0x00, 0x96, 0xd1, 0x85, 0x12, 0x8a, 0xf0, 0x23, 0xfb, - /* (2^ 84)P */ 0x69, 0xc7, 0xdb, 0xd9, 0x92, 0x75, 0x08, 0x9b, 0xeb, 0xa5, 0x93, 0xd1, 0x1a, 0xf4, 0xf5, 0xaf, 0xe6, 0xc4, 0x4a, 0x0d, 0x35, 0x26, 0x39, 0x9d, 0xd3, 0x17, 0x3e, 0xae, 0x2d, 0xbf, 0x73, 0x9f, 0xb7, 0x74, 0x91, 0xd1, 0xd8, 0x5c, 0x14, 0xf9, 0x75, 0xdf, 0xeb, 0xc2, 0x22, 0xd8, 0x14, 0x8d, 0x86, 0x23, 0x4d, 0xd1, 0x2d, 0xdb, 0x6b, 0x42, - /* (2^ 85)P */ 0x8c, 0xda, 0xc6, 0xf8, 0x71, 0xba, 0x2b, 0x06, 0x78, 0xae, 0xcc, 0x3a, 0xe3, 0xe3, 0xa1, 0x8b, 0xe2, 0x34, 0x6d, 0x28, 0x9e, 0x46, 0x13, 0x4d, 0x9e, 0xa6, 0x73, 0x49, 0x65, 0x79, 0x88, 0xb9, 0x3a, 0xd1, 0x6d, 0x2f, 0x48, 0x2b, 0x0a, 0x7f, 0x58, 0x20, 0x37, 0xf4, 0x0e, 0xbb, 0x4a, 0x95, 0x58, 0x0c, 0x88, 0x30, 0xc4, 0x74, 0xdd, 0xfd, - /* (2^ 86)P */ 0x6d, 0x13, 0x4e, 0x89, 0x2d, 0xa9, 0xa3, 0xed, 0x09, 0xe3, 0x0e, 0x71, 0x3e, 0x4a, 0xab, 0x90, 0xde, 0x03, 0xeb, 0x56, 0x46, 0x60, 0x06, 0xf5, 0x71, 0xe5, 0xee, 0x9b, 0xef, 0xff, 0xc4, 0x2c, 0x9f, 0x37, 0x48, 0x45, 0x94, 0x12, 0x41, 0x81, 0x15, 0x70, 0x91, 0x99, 0x5e, 0x56, 0x6b, 0xf4, 0xa6, 0xc9, 0xf5, 0x69, 0x9d, 0x78, 0x37, 0x57, - /* (2^ 87)P */ 0xf3, 0x51, 0x57, 0x7e, 0x43, 0x6f, 0xc6, 0x67, 0x59, 0x0c, 0xcf, 0x94, 0xe6, 0x3d, 0xb5, 0x07, 0xc9, 0x77, 0x48, 0xc9, 0x68, 0x0d, 0x98, 0x36, 0x62, 0x35, 0x38, 0x1c, 0xf5, 0xc5, 0xec, 0x66, 0x78, 0xfe, 0x47, 0xab, 0x26, 0xd6, 0x44, 0xb6, 0x06, 0x0f, 0x89, 0xe3, 0x19, 0x40, 0x1a, 0xe7, 0xd8, 0x65, 0x55, 0xf7, 0x1a, 0xfc, 0xa3, 0x0e, - /* (2^ 88)P */ 0x0e, 0x30, 0xa6, 0xb7, 0x58, 0x60, 0x62, 0x2a, 0x6c, 0x13, 0xa8, 0x14, 0x9b, 0xb8, 0xf2, 0x70, 0xd8, 0xb1, 0x71, 0x88, 0x8c, 0x18, 0x31, 0x25, 0x93, 0x90, 0xb4, 0xc7, 0x49, 0xd8, 0xd4, 0xdb, 0x1e, 0x1e, 0x7f, 0xaa, 0xba, 0xc9, 0xf2, 0x5d, 0xa9, 0x3a, 0x43, 0xb4, 0x5c, 0xee, 0x7b, 0xc7, 0x97, 0xb7, 0x66, 0xd7, 0x23, 0xd9, 0x22, 0x59, - /* (2^ 89)P */ 0x28, 0x19, 0xa6, 0xf9, 0x89, 0x20, 0x78, 0xd4, 0x6d, 0xcb, 0x79, 0x8f, 0x61, 0x6f, 0xb2, 0x5c, 0x4f, 0xa6, 0x54, 0x84, 0x95, 0x24, 0x36, 0x64, 0xcb, 0x39, 0xe7, 0x8f, 0x97, 0x9c, 0x5c, 0x3c, 0xfb, 0x51, 0x11, 0x01, 0x17, 0xdb, 0xc9, 0x9b, 0x51, 0x03, 0x9a, 0xe9, 0xe5, 0x24, 0x1e, 0xf5, 0xda, 0xe0, 0x48, 0x02, 0x23, 0xd0, 0x2c, 0x81, - /* (2^ 90)P */ 0x42, 0x1b, 0xe4, 0x91, 0x85, 0x2a, 0x0c, 0xd2, 0x28, 0x66, 0x57, 0x9e, 0x33, 0x8d, 0x25, 0x71, 0x10, 0x65, 0x76, 0xa2, 0x8c, 0x21, 0x86, 0x81, 0x15, 0xc2, 0x27, 0xeb, 0x54, 0x2d, 0x4f, 0x6c, 0xe6, 0xd6, 0x24, 0x9c, 0x1a, 0x12, 0xb8, 0x81, 0xe2, 0x0a, 0xf3, 0xd3, 0xf0, 0xd3, 0xe1, 0x74, 0x1f, 0x9b, 0x11, 0x47, 0xd0, 0xcf, 0xb6, 0x54, - /* (2^ 91)P */ 0x26, 0x45, 0xa2, 0x10, 0xd4, 0x2d, 0xae, 0xc0, 0xb0, 0xe8, 0x86, 0xb3, 0xc7, 0xea, 0x70, 0x87, 0x61, 0xb5, 0xa5, 0x55, 0xbe, 0x88, 0x1d, 0x7a, 0xd9, 0x6f, 0xeb, 0x83, 0xe2, 0x44, 0x7f, 0x98, 0x04, 0xd6, 0x50, 0x9d, 0xa7, 0x86, 0x66, 0x09, 0x63, 0xe1, 0xed, 0x72, 0xb1, 0xe4, 0x1d, 0x3a, 0xfd, 0x47, 0xce, 0x1c, 0xaa, 0x3b, 0x8f, 0x1b, - /* (2^ 92)P */ 0xf4, 0x3c, 0x4a, 0xb6, 0xc2, 0x9c, 0xe0, 0x2e, 0xb7, 0x38, 0xea, 0x61, 0x35, 0x97, 0x10, 0x90, 0xae, 0x22, 0x48, 0xb3, 0xa9, 0xc6, 0x7a, 0xbb, 0x23, 0xf2, 0xf8, 0x1b, 0xa7, 0xa1, 0x79, 0xcc, 0xc4, 0xf8, 0x08, 0x76, 0x8a, 0x5a, 0x1c, 0x1b, 0xc5, 0x33, 0x91, 0xa9, 0xb8, 0xb9, 0xd3, 0xf8, 0x49, 0xcd, 0xe5, 0x82, 0x43, 0xf7, 0xca, 0x68, - /* (2^ 93)P */ 0x38, 0xba, 0xae, 0x44, 0xfe, 0x57, 0x64, 0x56, 0x7c, 0x0e, 0x9c, 0xca, 0xff, 0xa9, 0x82, 0xbb, 0x38, 0x4a, 0xa7, 0xf7, 0x47, 0xab, 0xbe, 0x6d, 0x23, 0x0b, 0x8a, 0xed, 0xc2, 0xb9, 0x8f, 0xf1, 0xec, 0x91, 0x44, 0x73, 0x64, 0xba, 0xd5, 0x8f, 0x37, 0x38, 0x0d, 0xd5, 0xf8, 0x73, 0x57, 0xb6, 0xc2, 0x45, 0xdc, 0x25, 0xb2, 0xb6, 0xea, 0xd9, - /* (2^ 94)P */ 0xbf, 0xe9, 0x1a, 0x40, 0x4d, 0xcc, 0xe6, 0x1d, 0x70, 0x1a, 0x65, 0xcc, 0x34, 0x2c, 0x37, 0x2c, 0x2d, 0x6b, 0x6d, 0xe5, 0x2f, 0x19, 0x9e, 0xe4, 0xe1, 0xaa, 0xd4, 0xab, 0x54, 0xf4, 0xa8, 0xe4, 0x69, 0x2d, 0x8e, 0x4d, 0xd7, 0xac, 0xb0, 0x5b, 0xfe, 0xe3, 0x26, 0x07, 0xc3, 0xf8, 0x1b, 0x43, 0xa8, 0x1d, 0x64, 0xa5, 0x25, 0x88, 0xbb, 0x77, - /* (2^ 95)P */ 0x92, 0xcd, 0x6e, 0xa0, 0x79, 0x04, 0x18, 0xf4, 0x11, 0x58, 0x48, 0xb5, 0x3c, 0x7b, 0xd1, 0xcc, 0xd3, 0x14, 0x2c, 0xa0, 0xdd, 0x04, 0x44, 0x11, 0xb3, 0x6d, 0x2f, 0x0d, 0xf5, 0x2a, 0x75, 0x5d, 0x1d, 0xda, 0x86, 0x8d, 0x7d, 0x6b, 0x32, 0x68, 0xb6, 0x6c, 0x64, 0x9e, 0xde, 0x80, 0x88, 0xce, 0x08, 0xbf, 0x0b, 0xe5, 0x8e, 0x4f, 0x1d, 0xfb, - /* (2^ 96)P */ 0xaf, 0xe8, 0x85, 0xbf, 0x7f, 0x37, 0x8d, 0x66, 0x7c, 0xd5, 0xd3, 0x96, 0xa5, 0x81, 0x67, 0x95, 0xff, 0x48, 0xde, 0xde, 0xd7, 0x7a, 0x46, 0x34, 0xb1, 0x13, 0x70, 0x29, 0xed, 0x87, 0x90, 0xb0, 0x40, 0x2c, 0xa6, 0x43, 0x6e, 0xb6, 0xbc, 0x48, 0x8a, 0xc1, 0xae, 0xb8, 0xd4, 0xe2, 0xc0, 0x32, 0xb2, 0xa6, 0x2a, 0x8f, 0xb5, 0x16, 0x9e, 0xc3, - /* (2^ 97)P */ 0xff, 0x4d, 0xd2, 0xd6, 0x74, 0xef, 0x2c, 0x96, 0xc1, 0x11, 0xa8, 0xb8, 0xfe, 0x94, 0x87, 0x3e, 0xa0, 0xfb, 0x57, 0xa3, 0xfc, 0x7a, 0x7e, 0x6a, 0x59, 0x6c, 0x54, 0xbb, 0xbb, 0xa2, 0x25, 0x38, 0x1b, 0xdf, 0x5d, 0x7b, 0x94, 0x14, 0xde, 0x07, 0x6e, 0xd3, 0xab, 0x02, 0x26, 0x74, 0x16, 0x12, 0xdf, 0x2e, 0x2a, 0xa7, 0xb0, 0xe8, 0x29, 0xc0, - /* (2^ 98)P */ 0x6a, 0x38, 0x0b, 0xd3, 0xba, 0x45, 0x23, 0xe0, 0x04, 0x3b, 0x83, 0x39, 0xc5, 0x11, 0xe6, 0xcf, 0x39, 0x0a, 0xb3, 0xb0, 0x3b, 0x27, 0x29, 0x63, 0x1c, 0xf3, 0x00, 0xe6, 0xd2, 0x55, 0x21, 0x1f, 0x84, 0x97, 0x9f, 0x01, 0x49, 0x43, 0x30, 0x5f, 0xe0, 0x1d, 0x24, 0xc4, 0x4e, 0xa0, 0x2b, 0x0b, 0x12, 0x55, 0xc3, 0x27, 0xae, 0x08, 0x83, 0x7c, - /* (2^ 99)P */ 0x5d, 0x1a, 0xb7, 0xa9, 0xf5, 0xfd, 0xec, 0xad, 0xb7, 0x87, 0x02, 0x5f, 0x0d, 0x30, 0x4d, 0xe2, 0x65, 0x87, 0xa4, 0x41, 0x45, 0x1d, 0x67, 0xe0, 0x30, 0x5c, 0x13, 0x87, 0xf6, 0x2e, 0x08, 0xc1, 0xc7, 0x12, 0x45, 0xc8, 0x9b, 0xad, 0xb8, 0xd5, 0x57, 0xbb, 0x5c, 0x48, 0x3a, 0xe1, 0x91, 0x5e, 0xf6, 0x4d, 0x8a, 0x63, 0x75, 0x69, 0x0c, 0x01, - /* (2^100)P */ 0x8f, 0x53, 0x2d, 0xa0, 0x71, 0x3d, 0xfc, 0x45, 0x10, 0x96, 0xcf, 0x56, 0xf9, 0xbb, 0x40, 0x3c, 0x86, 0x52, 0x76, 0xbe, 0x84, 0xf9, 0xa6, 0x9d, 0x3d, 0x27, 0xbe, 0xb4, 0x00, 0x49, 0x94, 0xf5, 0x5d, 0xe1, 0x62, 0x85, 0x66, 0xe5, 0xb8, 0x20, 0x2c, 0x09, 0x7d, 0x9d, 0x3d, 0x6e, 0x74, 0x39, 0xab, 0xad, 0xa0, 0x90, 0x97, 0x5f, 0xbb, 0xa7, - /* (2^101)P */ 0xdb, 0x2d, 0x99, 0x08, 0x16, 0x46, 0x83, 0x7a, 0xa8, 0xea, 0x3d, 0x28, 0x5b, 0x49, 0xfc, 0xb9, 0x6d, 0x00, 0x9e, 0x54, 0x4f, 0x47, 0x64, 0x9b, 0x58, 0x4d, 0x07, 0x0c, 0x6f, 0x29, 0x56, 0x0b, 0x00, 0x14, 0x85, 0x96, 0x41, 0x04, 0xb9, 0x5c, 0xa4, 0xf6, 0x16, 0x73, 0x6a, 0xc7, 0x62, 0x0c, 0x65, 0x2f, 0x93, 0xbf, 0xf7, 0xb9, 0xb7, 0xf1, - /* (2^102)P */ 0xeb, 0x6d, 0xb3, 0x46, 0x32, 0xd2, 0xcb, 0x08, 0x94, 0x14, 0xbf, 0x3f, 0xc5, 0xcb, 0x5f, 0x9f, 0x8a, 0x89, 0x0c, 0x1b, 0x45, 0xad, 0x4c, 0x50, 0xb4, 0xe1, 0xa0, 0x6b, 0x11, 0x92, 0xaf, 0x1f, 0x00, 0xcc, 0xe5, 0x13, 0x7e, 0xe4, 0x2e, 0xa0, 0x57, 0xf3, 0xa7, 0x84, 0x79, 0x7a, 0xc2, 0xb7, 0xb7, 0xfc, 0x5d, 0xa5, 0xa9, 0x64, 0xcc, 0xd8, - /* (2^103)P */ 0xa9, 0xc4, 0x12, 0x8b, 0x34, 0x78, 0x3e, 0x38, 0xfd, 0x3f, 0x87, 0xfa, 0x88, 0x94, 0xd5, 0xd9, 0x7f, 0xeb, 0x58, 0xff, 0xb9, 0x45, 0xdb, 0xa1, 0xed, 0x22, 0x28, 0x1d, 0x00, 0x6d, 0x79, 0x85, 0x7a, 0x75, 0x5d, 0xf0, 0xb1, 0x9e, 0x47, 0x28, 0x8c, 0x62, 0xdf, 0xfb, 0x4c, 0x7b, 0xc5, 0x1a, 0x42, 0x95, 0xef, 0x9a, 0xb7, 0x27, 0x7e, 0xda, - /* (2^104)P */ 0xca, 0xd5, 0xc0, 0x17, 0xa1, 0x66, 0x79, 0x9c, 0x2a, 0xb7, 0x0a, 0xfe, 0x62, 0xe4, 0x26, 0x78, 0x90, 0xa7, 0xcb, 0xb0, 0x4f, 0x6d, 0xf9, 0x8f, 0xf7, 0x7d, 0xac, 0xb8, 0x78, 0x1f, 0x41, 0xea, 0x97, 0x1e, 0x62, 0x97, 0x43, 0x80, 0x58, 0x80, 0xb6, 0x69, 0x7d, 0xee, 0x16, 0xd2, 0xa1, 0x81, 0xd7, 0xb1, 0x27, 0x03, 0x48, 0xda, 0xab, 0xec, - /* (2^105)P */ 0x5b, 0xed, 0x40, 0x8e, 0x8c, 0xc1, 0x66, 0x90, 0x7f, 0x0c, 0xb2, 0xfc, 0xbd, 0x16, 0xac, 0x7d, 0x4c, 0x6a, 0xf9, 0xae, 0xe7, 0x4e, 0x11, 0x12, 0xe9, 0xbe, 0x17, 0x09, 0xc6, 0xc1, 0x5e, 0xb5, 0x7b, 0x50, 0x5c, 0x27, 0xfb, 0x80, 0xab, 0x01, 0xfa, 0x5b, 0x9b, 0x75, 0x16, 0x6e, 0xb2, 0x5c, 0x8c, 0x2f, 0xa5, 0x6a, 0x1a, 0x68, 0xa6, 0x90, - /* (2^106)P */ 0x75, 0xfe, 0xb6, 0x96, 0x96, 0x87, 0x4c, 0x12, 0xa9, 0xd1, 0xd8, 0x03, 0xa3, 0xc1, 0x15, 0x96, 0xe8, 0xa0, 0x75, 0x82, 0xa0, 0x6d, 0xea, 0x54, 0xdc, 0x5f, 0x0d, 0x7e, 0xf6, 0x70, 0xb5, 0xdc, 0x7a, 0xf6, 0xc4, 0xd4, 0x21, 0x49, 0xf5, 0xd4, 0x14, 0x6d, 0x48, 0x1d, 0x7c, 0x99, 0x42, 0xdf, 0x78, 0x6b, 0x9d, 0xb9, 0x30, 0x3c, 0xd0, 0x29, - /* (2^107)P */ 0x85, 0xd6, 0xd8, 0xf3, 0x91, 0x74, 0xdd, 0xbd, 0x72, 0x96, 0x10, 0xe4, 0x76, 0x02, 0x5a, 0x72, 0x67, 0xd3, 0x17, 0x72, 0x14, 0x9a, 0x20, 0x5b, 0x0f, 0x8d, 0xed, 0x6d, 0x4e, 0xe3, 0xd9, 0x82, 0xc2, 0x99, 0xee, 0x39, 0x61, 0x69, 0x8a, 0x24, 0x01, 0x92, 0x15, 0xe7, 0xfc, 0xf9, 0x4d, 0xac, 0xf1, 0x30, 0x49, 0x01, 0x0b, 0x6e, 0x0f, 0x20, - /* (2^108)P */ 0xd8, 0x25, 0x94, 0x5e, 0x43, 0x29, 0xf5, 0xcc, 0xe8, 0xe3, 0x55, 0x41, 0x3c, 0x9f, 0x58, 0x5b, 0x00, 0xeb, 0xc5, 0xdf, 0xcf, 0xfb, 0xfd, 0x6e, 0x92, 0xec, 0x99, 0x30, 0xd6, 0x05, 0xdd, 0x80, 0x7a, 0x5d, 0x6d, 0x16, 0x85, 0xd8, 0x9d, 0x43, 0x65, 0xd8, 0x2c, 0x33, 0x2f, 0x5c, 0x41, 0xea, 0xb7, 0x95, 0x77, 0xf2, 0x9e, 0x59, 0x09, 0xe8, - /* (2^109)P */ 0x00, 0xa0, 0x03, 0x80, 0xcd, 0x60, 0xe5, 0x17, 0xd4, 0x15, 0x99, 0xdd, 0x4f, 0xbf, 0x66, 0xb8, 0xc0, 0xf5, 0xf9, 0xfc, 0x6d, 0x42, 0x18, 0x34, 0x1c, 0x7d, 0x5b, 0xb5, 0x09, 0xd0, 0x99, 0x57, 0x81, 0x0b, 0x62, 0xb3, 0xa2, 0xf9, 0x0b, 0xae, 0x95, 0xb8, 0xc2, 0x3b, 0x0d, 0x5b, 0x00, 0xf1, 0xed, 0xbc, 0x05, 0x9d, 0x61, 0xbc, 0x73, 0x9d, - /* (2^110)P */ 0xd4, 0xdb, 0x29, 0xe5, 0x85, 0xe9, 0xc6, 0x89, 0x2a, 0xa8, 0x54, 0xab, 0xb3, 0x7f, 0x88, 0xc0, 0x4d, 0xe0, 0xd1, 0x74, 0x6e, 0xa3, 0xa7, 0x39, 0xd5, 0xcc, 0xa1, 0x8a, 0xcb, 0x5b, 0x34, 0xad, 0x92, 0xb4, 0xd8, 0xd5, 0x17, 0xf6, 0x77, 0x18, 0x9e, 0xaf, 0x45, 0x3b, 0x03, 0xe2, 0xf8, 0x52, 0x60, 0xdc, 0x15, 0x20, 0x9e, 0xdf, 0xd8, 0x5d, - /* (2^111)P */ 0x02, 0xc1, 0xac, 0x1a, 0x15, 0x8e, 0x6c, 0xf5, 0x1e, 0x1e, 0xba, 0x7e, 0xc2, 0xda, 0x7d, 0x02, 0xda, 0x43, 0xae, 0x04, 0x70, 0x28, 0x54, 0x78, 0x94, 0xf5, 0x4f, 0x07, 0x84, 0x8f, 0xed, 0xaa, 0xc0, 0xb8, 0xcd, 0x7f, 0x7e, 0x33, 0xa3, 0xbe, 0x21, 0x29, 0xc8, 0x56, 0x34, 0xc0, 0x76, 0x87, 0x8f, 0xc7, 0x73, 0x58, 0x90, 0x16, 0xfc, 0xd6, - /* (2^112)P */ 0xb8, 0x3f, 0xe1, 0xdf, 0x3a, 0x91, 0x25, 0x0c, 0xf6, 0x47, 0xa8, 0x89, 0xc4, 0xc6, 0x61, 0xec, 0x86, 0x2c, 0xfd, 0xbe, 0xa4, 0x6f, 0xc2, 0xd4, 0x46, 0x19, 0x70, 0x5d, 0x09, 0x02, 0x86, 0xd3, 0x4b, 0xe9, 0x16, 0x7b, 0xf0, 0x0d, 0x6c, 0xff, 0x91, 0x05, 0xbf, 0x55, 0xb4, 0x00, 0x8d, 0xe5, 0x6d, 0x68, 0x20, 0x90, 0x12, 0xb5, 0x5c, 0x32, - /* (2^113)P */ 0x80, 0x45, 0xc8, 0x51, 0x87, 0xba, 0x1c, 0x5c, 0xcf, 0x5f, 0x4b, 0x3c, 0x9e, 0x3b, 0x36, 0xd2, 0x26, 0xa2, 0x7f, 0xab, 0xb7, 0xbf, 0xda, 0x68, 0x23, 0x8f, 0xc3, 0xa0, 0xfd, 0xad, 0xf1, 0x56, 0x3b, 0xd0, 0x75, 0x2b, 0x44, 0x61, 0xd8, 0xf4, 0xf1, 0x05, 0x49, 0x53, 0x07, 0xee, 0x47, 0xef, 0xc0, 0x7c, 0x9d, 0xe4, 0x15, 0x88, 0xc5, 0x47, - /* (2^114)P */ 0x2d, 0xb5, 0x09, 0x80, 0xb9, 0xd3, 0xd8, 0xfe, 0x4c, 0xd2, 0xa6, 0x6e, 0xd3, 0x75, 0xcf, 0xb0, 0x99, 0xcb, 0x50, 0x8d, 0xe9, 0x67, 0x9b, 0x20, 0xe8, 0x57, 0xd8, 0x14, 0x85, 0x73, 0x6a, 0x74, 0xe0, 0x99, 0xf0, 0x6b, 0x6e, 0x59, 0x30, 0x31, 0x33, 0x96, 0x5f, 0xa1, 0x0c, 0x1b, 0xf4, 0xca, 0x09, 0xe1, 0x9b, 0xb5, 0xcf, 0x6d, 0x0b, 0xeb, - /* (2^115)P */ 0x1a, 0xde, 0x50, 0xa9, 0xac, 0x3e, 0x10, 0x43, 0x4f, 0x82, 0x4f, 0xc0, 0xfe, 0x3f, 0x33, 0xd2, 0x64, 0x86, 0x50, 0xa9, 0x51, 0x76, 0x5e, 0x50, 0x97, 0x6c, 0x73, 0x8d, 0x77, 0xa3, 0x75, 0x03, 0xbc, 0xc9, 0xfb, 0x50, 0xd9, 0x6d, 0x16, 0xad, 0x5d, 0x32, 0x3d, 0xac, 0x44, 0xdf, 0x51, 0xf7, 0x19, 0xd4, 0x0b, 0x57, 0x78, 0x0b, 0x81, 0x4e, - /* (2^116)P */ 0x32, 0x24, 0xf1, 0x6c, 0x55, 0x62, 0x1d, 0xb3, 0x1f, 0xda, 0xfa, 0x6a, 0x8f, 0x98, 0x01, 0x16, 0xde, 0x44, 0x50, 0x0d, 0x2e, 0x6c, 0x0b, 0xa2, 0xd3, 0x74, 0x0e, 0xa9, 0xbf, 0x8d, 0xa9, 0xc8, 0xc8, 0x2f, 0x62, 0xc1, 0x35, 0x5e, 0xfd, 0x3a, 0xb3, 0x83, 0x2d, 0xee, 0x4e, 0xfd, 0x5c, 0x5e, 0xad, 0x85, 0xa5, 0x10, 0xb5, 0x4f, 0x34, 0xa7, - /* (2^117)P */ 0xd1, 0x58, 0x6f, 0xe6, 0x54, 0x2c, 0xc2, 0xcd, 0xcf, 0x83, 0xdc, 0x88, 0x0c, 0xb9, 0xb4, 0x62, 0x18, 0x89, 0x65, 0x28, 0xe9, 0x72, 0x4b, 0x65, 0xcf, 0xd6, 0x90, 0x88, 0xd7, 0x76, 0x17, 0x4f, 0x74, 0x64, 0x1e, 0xcb, 0xd3, 0xf5, 0x4b, 0xaa, 0x2e, 0x4d, 0x2d, 0x7c, 0x13, 0x1f, 0xfd, 0xd9, 0x60, 0x83, 0x7e, 0xda, 0x64, 0x1c, 0xdc, 0x9f, - /* (2^118)P */ 0xad, 0xef, 0xac, 0x1b, 0xc1, 0x30, 0x5a, 0x15, 0xc9, 0x1f, 0xac, 0xf1, 0xca, 0x44, 0x95, 0x95, 0xea, 0xf2, 0x22, 0xe7, 0x8d, 0x25, 0xf0, 0xff, 0xd8, 0x71, 0xf7, 0xf8, 0x8f, 0x8f, 0xcd, 0xf4, 0x1e, 0xfe, 0x6c, 0x68, 0x04, 0xb8, 0x78, 0xa1, 0x5f, 0xa6, 0x5d, 0x5e, 0xf9, 0x8d, 0xea, 0x80, 0xcb, 0xf3, 0x17, 0xa6, 0x03, 0xc9, 0x38, 0xd5, - /* (2^119)P */ 0x79, 0x14, 0x31, 0xc3, 0x38, 0xe5, 0xaa, 0xbf, 0x17, 0xa3, 0x04, 0x4e, 0x80, 0x59, 0x9c, 0x9f, 0x19, 0x39, 0xe4, 0x2d, 0x23, 0x54, 0x4a, 0x7f, 0x3e, 0xf3, 0xd9, 0xc7, 0xba, 0x6c, 0x8f, 0x6b, 0xfa, 0x34, 0xb5, 0x23, 0x17, 0x1d, 0xff, 0x1d, 0xea, 0x1f, 0xd7, 0xba, 0x61, 0xb2, 0xe0, 0x38, 0x6a, 0xe9, 0xcf, 0x48, 0x5d, 0x6a, 0x10, 0x9c, - /* (2^120)P */ 0xc8, 0xbb, 0x13, 0x1c, 0x3f, 0x3c, 0x34, 0xfd, 0xac, 0x37, 0x52, 0x44, 0x25, 0xa8, 0xde, 0x1d, 0x63, 0xf4, 0x81, 0x9a, 0xbe, 0x0b, 0x74, 0x2e, 0xc8, 0x51, 0x16, 0xd3, 0xac, 0x4a, 0xaf, 0xe2, 0x5f, 0x3a, 0x89, 0x32, 0xd1, 0x9b, 0x7c, 0x90, 0x0d, 0xac, 0xdc, 0x8b, 0x73, 0x45, 0x45, 0x97, 0xb1, 0x90, 0x2c, 0x1b, 0x31, 0xca, 0xb1, 0x94, - /* (2^121)P */ 0x07, 0x28, 0xdd, 0x10, 0x14, 0xa5, 0x95, 0x7e, 0xf3, 0xe4, 0xd4, 0x14, 0xb4, 0x7e, 0x76, 0xdb, 0x42, 0xd6, 0x94, 0x3e, 0xeb, 0x44, 0x64, 0x88, 0x0d, 0xec, 0xc1, 0x21, 0xf0, 0x79, 0xe0, 0x83, 0x67, 0x55, 0x53, 0xc2, 0xf6, 0xc5, 0xc5, 0x89, 0x39, 0xe8, 0x42, 0xd0, 0x17, 0xbd, 0xff, 0x35, 0x59, 0x0e, 0xc3, 0x06, 0x86, 0xd4, 0x64, 0xcf, - /* (2^122)P */ 0x91, 0xa8, 0xdb, 0x57, 0x9b, 0xe2, 0x96, 0x31, 0x10, 0x6e, 0xd7, 0x9a, 0x97, 0xb3, 0xab, 0xb5, 0x15, 0x66, 0xbe, 0xcc, 0x6d, 0x9a, 0xac, 0x06, 0xb3, 0x0d, 0xaa, 0x4b, 0x9c, 0x96, 0x79, 0x6c, 0x34, 0xee, 0x9e, 0x53, 0x4d, 0x6e, 0xbd, 0x88, 0x02, 0xbf, 0x50, 0x54, 0x12, 0x5d, 0x01, 0x02, 0x46, 0xc6, 0x74, 0x02, 0x8c, 0x24, 0xae, 0xb1, - /* (2^123)P */ 0xf5, 0x22, 0xea, 0xac, 0x7d, 0x9c, 0x33, 0x8a, 0xa5, 0x36, 0x79, 0x6a, 0x4f, 0xa4, 0xdc, 0xa5, 0x73, 0x64, 0xc4, 0x6f, 0x43, 0x02, 0x3b, 0x94, 0x66, 0xd2, 0x4b, 0x4f, 0xf6, 0x45, 0x33, 0x5d, 0x10, 0x33, 0x18, 0x1e, 0xa3, 0xfc, 0xf7, 0xd2, 0xb8, 0xc8, 0xa7, 0xe0, 0x76, 0x8a, 0xcd, 0xff, 0x4f, 0x99, 0x34, 0x47, 0x84, 0x91, 0x96, 0x9f, - /* (2^124)P */ 0x8a, 0x48, 0x3b, 0x48, 0x4a, 0xbc, 0xac, 0xe2, 0x80, 0xd6, 0xd2, 0x35, 0xde, 0xd0, 0x56, 0x42, 0x33, 0xb3, 0x56, 0x5a, 0xcd, 0xb8, 0x3d, 0xb5, 0x25, 0xc1, 0xed, 0xff, 0x87, 0x0b, 0x79, 0xff, 0xf2, 0x62, 0xe1, 0x76, 0xc6, 0xa2, 0x0f, 0xa8, 0x9b, 0x0d, 0xcc, 0x3f, 0x3d, 0x35, 0x27, 0x8d, 0x0b, 0x74, 0xb0, 0xc3, 0x78, 0x8c, 0xcc, 0xc8, - /* (2^125)P */ 0xfc, 0x9a, 0x0c, 0xa8, 0x49, 0x42, 0xb8, 0xdf, 0xcf, 0xb3, 0x19, 0xa6, 0x64, 0x57, 0xfe, 0xe8, 0xf8, 0xa6, 0x4b, 0x86, 0xa1, 0xd5, 0x83, 0x7f, 0x14, 0x99, 0x18, 0x0c, 0x7d, 0x5b, 0xf7, 0x3d, 0xf9, 0x4b, 0x79, 0xb1, 0x86, 0x30, 0xb4, 0x5e, 0x6a, 0xe8, 0x9d, 0xfa, 0x8a, 0x41, 0xc4, 0x30, 0xfc, 0x56, 0x74, 0x14, 0x42, 0xc8, 0x96, 0x0e, - /* (2^126)P */ 0xdf, 0x66, 0xec, 0xbc, 0x44, 0xdb, 0x19, 0xce, 0xd4, 0xb5, 0x49, 0x40, 0x07, 0x49, 0xe0, 0x3a, 0x61, 0x10, 0xfb, 0x7d, 0xba, 0xb1, 0xe0, 0x28, 0x5b, 0x99, 0x59, 0x96, 0xa2, 0xee, 0xe0, 0x23, 0x37, 0x39, 0x1f, 0xe6, 0x57, 0x9f, 0xf8, 0xf8, 0xdc, 0x74, 0xf6, 0x8f, 0x4f, 0x5e, 0x51, 0xa4, 0x12, 0xac, 0xbe, 0xe4, 0xf3, 0xd1, 0xf0, 0x24, - /* (2^127)P */ 0x1e, 0x3e, 0x9a, 0x5f, 0xdf, 0x9f, 0xd6, 0x4e, 0x8a, 0x28, 0xc3, 0xcd, 0x96, 0x9d, 0x57, 0xc7, 0x61, 0x81, 0x90, 0xff, 0xae, 0xb1, 0x4f, 0xc2, 0x96, 0x8b, 0x1a, 0x18, 0xf4, 0x50, 0xcb, 0x31, 0xe1, 0x57, 0xf4, 0x90, 0xa8, 0xea, 0xac, 0xe7, 0x61, 0x98, 0xb6, 0x15, 0xc1, 0x7b, 0x29, 0xa4, 0xc3, 0x18, 0xef, 0xb9, 0xd8, 0xdf, 0xf6, 0xac, - /* (2^128)P */ 0xca, 0xa8, 0x6c, 0xf1, 0xb4, 0xca, 0xfe, 0x31, 0xee, 0x48, 0x38, 0x8b, 0x0e, 0xbb, 0x7a, 0x30, 0xaa, 0xf9, 0xee, 0x27, 0x53, 0x24, 0xdc, 0x2e, 0x15, 0xa6, 0x48, 0x8f, 0xa0, 0x7e, 0xf1, 0xdc, 0x93, 0x87, 0x39, 0xeb, 0x7f, 0x38, 0x92, 0x92, 0x4c, 0x29, 0xe9, 0x57, 0xd8, 0x59, 0xfc, 0xe9, 0x9c, 0x44, 0xc0, 0x65, 0xcf, 0xac, 0x4b, 0xdc, - /* (2^129)P */ 0xa3, 0xd0, 0x37, 0x8f, 0x86, 0x2f, 0xc6, 0x47, 0x55, 0x46, 0x65, 0x26, 0x4b, 0x91, 0xe2, 0x18, 0x5c, 0x4f, 0x23, 0xc1, 0x37, 0x29, 0xb9, 0xc1, 0x27, 0xc5, 0x3c, 0xbf, 0x7e, 0x23, 0xdb, 0x73, 0x99, 0xbd, 0x1b, 0xb2, 0x31, 0x68, 0x3a, 0xad, 0xb7, 0xb0, 0x10, 0xc5, 0xe5, 0x11, 0x51, 0xba, 0xa7, 0x60, 0x66, 0x54, 0xf0, 0x08, 0xd7, 0x69, - /* (2^130)P */ 0x89, 0x41, 0x79, 0xcc, 0xeb, 0x0a, 0xf5, 0x4b, 0xa3, 0x4c, 0xce, 0x52, 0xb0, 0xa7, 0xe4, 0x41, 0x75, 0x7d, 0x04, 0xbb, 0x09, 0x4c, 0x50, 0x9f, 0xdf, 0xea, 0x74, 0x61, 0x02, 0xad, 0xb4, 0x9d, 0xb7, 0x05, 0xb9, 0xea, 0xeb, 0x91, 0x35, 0xe7, 0x49, 0xea, 0xd3, 0x4f, 0x3c, 0x60, 0x21, 0x7a, 0xde, 0xc7, 0xe2, 0x5a, 0xee, 0x8e, 0x93, 0xc7, - /* (2^131)P */ 0x00, 0xe8, 0xed, 0xd0, 0xb3, 0x0d, 0xaf, 0xb2, 0xde, 0x2c, 0xf6, 0x00, 0xe2, 0xea, 0x6d, 0xf8, 0x0e, 0xd9, 0x67, 0x59, 0xa9, 0x50, 0xbb, 0x17, 0x8f, 0xff, 0xb1, 0x9f, 0x17, 0xb6, 0xf2, 0xb5, 0xba, 0x80, 0xf7, 0x0f, 0xba, 0xd5, 0x09, 0x43, 0xaa, 0x4e, 0x3a, 0x67, 0x6a, 0x89, 0x9b, 0x18, 0x65, 0x35, 0xf8, 0x3a, 0x49, 0x91, 0x30, 0x51, - /* (2^132)P */ 0x8d, 0x25, 0xe9, 0x0e, 0x7d, 0x50, 0x76, 0xe4, 0x58, 0x7e, 0xb9, 0x33, 0xe6, 0x65, 0x90, 0xc2, 0x50, 0x9d, 0x50, 0x2e, 0x11, 0xad, 0xd5, 0x43, 0x52, 0x32, 0x41, 0x4f, 0x7b, 0xb6, 0xa0, 0xec, 0x81, 0x75, 0x36, 0x7c, 0x77, 0x85, 0x59, 0x70, 0xe4, 0xf9, 0xef, 0x66, 0x8d, 0x35, 0xc8, 0x2a, 0x6e, 0x5b, 0xc6, 0x0d, 0x0b, 0x29, 0x60, 0x68, - /* (2^133)P */ 0xf8, 0xce, 0xb0, 0x3a, 0x56, 0x7d, 0x51, 0x9a, 0x25, 0x73, 0xea, 0xdd, 0xe4, 0xe0, 0x0e, 0xf0, 0x07, 0xc0, 0x31, 0x00, 0x73, 0x35, 0xd0, 0x39, 0xc4, 0x9b, 0xb7, 0x95, 0xe0, 0x62, 0x70, 0x36, 0x0b, 0xcb, 0xa0, 0x42, 0xde, 0x51, 0xcf, 0x41, 0xe0, 0xb8, 0xb4, 0xc0, 0xe5, 0x46, 0x99, 0x9f, 0x02, 0x7f, 0x14, 0x8c, 0xc1, 0x4e, 0xef, 0xe8, - /* (2^134)P */ 0x10, 0x01, 0x57, 0x0a, 0xbe, 0x8b, 0x18, 0xc8, 0xca, 0x00, 0x28, 0x77, 0x4a, 0x9a, 0xc7, 0x55, 0x2a, 0xcc, 0x0c, 0x7b, 0xb9, 0xe9, 0xc8, 0x97, 0x7c, 0x02, 0xe3, 0x09, 0x2f, 0x62, 0x30, 0xb8, 0x40, 0x09, 0x65, 0xe9, 0x55, 0x63, 0xb5, 0x07, 0xca, 0x9f, 0x00, 0xdf, 0x9d, 0x5c, 0xc7, 0xee, 0x57, 0xa5, 0x90, 0x15, 0x1e, 0x22, 0xa0, 0x12, - /* (2^135)P */ 0x71, 0x2d, 0xc9, 0xef, 0x27, 0xb9, 0xd8, 0x12, 0x43, 0x6b, 0xa8, 0xce, 0x3b, 0x6d, 0x6e, 0x91, 0x43, 0x23, 0xbc, 0x32, 0xb3, 0xbf, 0xe1, 0xc7, 0x39, 0xcf, 0x7c, 0x42, 0x4c, 0xb1, 0x30, 0xe2, 0xdd, 0x69, 0x06, 0xe5, 0xea, 0xf0, 0x2a, 0x16, 0x50, 0x71, 0xca, 0x92, 0xdf, 0xc1, 0xcc, 0xec, 0xe6, 0x54, 0x07, 0xf3, 0x18, 0x8d, 0xd8, 0x29, - /* (2^136)P */ 0x98, 0x51, 0x48, 0x8f, 0xfa, 0x2e, 0x5e, 0x67, 0xb0, 0xc6, 0x17, 0x12, 0xb6, 0x7d, 0xc9, 0xad, 0x81, 0x11, 0xad, 0x0c, 0x1c, 0x2d, 0x45, 0xdf, 0xac, 0x66, 0xbd, 0x08, 0x6f, 0x7c, 0xc7, 0x06, 0x6e, 0x19, 0x08, 0x39, 0x64, 0xd7, 0xe4, 0xd1, 0x11, 0x5f, 0x1c, 0xf4, 0x67, 0xc3, 0x88, 0x6a, 0xe6, 0x07, 0xa3, 0x83, 0xd7, 0xfd, 0x2a, 0xf9, - /* (2^137)P */ 0x87, 0xed, 0xeb, 0xd9, 0xdf, 0xff, 0x43, 0x8b, 0xaa, 0x20, 0x58, 0xb0, 0xb4, 0x6b, 0x14, 0xb8, 0x02, 0xc5, 0x40, 0x20, 0x22, 0xbb, 0xf7, 0xb4, 0xf3, 0x05, 0x1e, 0x4d, 0x94, 0xff, 0xe3, 0xc5, 0x22, 0x82, 0xfe, 0xaf, 0x90, 0x42, 0x98, 0x6b, 0x76, 0x8b, 0x3e, 0x89, 0x3f, 0x42, 0x2a, 0xa7, 0x26, 0x00, 0xda, 0x5c, 0xa2, 0x2b, 0xec, 0xdd, - /* (2^138)P */ 0x5c, 0x21, 0x16, 0x0d, 0x46, 0xb8, 0xd0, 0xa7, 0x88, 0xe7, 0x25, 0xcb, 0x3e, 0x50, 0x73, 0x61, 0xe7, 0xaf, 0x5a, 0x3f, 0x47, 0x8b, 0x3d, 0x97, 0x79, 0x2c, 0xe6, 0x6d, 0x95, 0x74, 0x65, 0x70, 0x36, 0xfd, 0xd1, 0x9e, 0x13, 0x18, 0x63, 0xb1, 0x2d, 0x0b, 0xb5, 0x36, 0x3e, 0xe7, 0x35, 0x42, 0x3b, 0xe6, 0x1f, 0x4d, 0x9d, 0x59, 0xa2, 0x43, - /* (2^139)P */ 0x8c, 0x0c, 0x7c, 0x24, 0x9e, 0xe0, 0xf8, 0x05, 0x1c, 0x9e, 0x1f, 0x31, 0xc0, 0x70, 0xb3, 0xfb, 0x4e, 0xf8, 0x0a, 0x57, 0xb7, 0x49, 0xb5, 0x73, 0xa1, 0x5f, 0x9b, 0x6a, 0x07, 0x6c, 0x87, 0x71, 0x87, 0xd4, 0xbe, 0x98, 0x1e, 0x98, 0xee, 0x52, 0xc1, 0x7b, 0x95, 0x0f, 0x28, 0x32, 0x36, 0x28, 0xd0, 0x3a, 0x0f, 0x7d, 0x2a, 0xa9, 0x62, 0xb9, - /* (2^140)P */ 0x97, 0xe6, 0x18, 0x77, 0xf9, 0x34, 0xac, 0xbc, 0xe0, 0x62, 0x9f, 0x42, 0xde, 0xbd, 0x2f, 0xf7, 0x1f, 0xb7, 0x14, 0x52, 0x8a, 0x79, 0xb2, 0x3f, 0xd2, 0x95, 0x71, 0x01, 0xe8, 0xaf, 0x8c, 0xa4, 0xa4, 0xa7, 0x27, 0xf3, 0x5c, 0xdf, 0x3e, 0x57, 0x7a, 0xf1, 0x76, 0x49, 0xe6, 0x42, 0x3f, 0x8f, 0x1e, 0x63, 0x4a, 0x65, 0xb5, 0x41, 0xf5, 0x02, - /* (2^141)P */ 0x72, 0x85, 0xc5, 0x0b, 0xe1, 0x47, 0x64, 0x02, 0xc5, 0x4d, 0x81, 0x69, 0xb2, 0xcf, 0x0f, 0x6c, 0xd4, 0x6d, 0xd0, 0xc7, 0xb4, 0x1c, 0xd0, 0x32, 0x59, 0x89, 0xe2, 0xe0, 0x96, 0x8b, 0x12, 0x98, 0xbf, 0x63, 0x7a, 0x4c, 0x76, 0x7e, 0x58, 0x17, 0x8f, 0x5b, 0x0a, 0x59, 0x65, 0x75, 0xbc, 0x61, 0x1f, 0xbe, 0xc5, 0x6e, 0x0a, 0x57, 0x52, 0x70, - /* (2^142)P */ 0x92, 0x1c, 0x77, 0xbb, 0x62, 0x02, 0x6c, 0x25, 0x9c, 0x66, 0x07, 0x83, 0xab, 0xcc, 0x80, 0x5d, 0xd2, 0x76, 0x0c, 0xa4, 0xc5, 0xb4, 0x8a, 0x68, 0x23, 0x31, 0x32, 0x29, 0x8a, 0x47, 0x92, 0x12, 0x80, 0xb3, 0xfa, 0x18, 0xe4, 0x8d, 0xc0, 0x4d, 0xfe, 0x97, 0x5f, 0x72, 0x41, 0xb5, 0x5c, 0x7a, 0xbd, 0xf0, 0xcf, 0x5e, 0x97, 0xaa, 0x64, 0x32, - /* (2^143)P */ 0x35, 0x3f, 0x75, 0xc1, 0x7a, 0x75, 0x7e, 0xa9, 0xc6, 0x0b, 0x4e, 0x32, 0x62, 0xec, 0xe3, 0x5c, 0xfb, 0x01, 0x43, 0xb6, 0xd4, 0x5b, 0x75, 0xd2, 0xee, 0x7f, 0x5d, 0x23, 0x2b, 0xb3, 0x54, 0x34, 0x4c, 0xd3, 0xb4, 0x32, 0x84, 0x81, 0xb5, 0x09, 0x76, 0x19, 0xda, 0x58, 0xda, 0x7c, 0xdb, 0x2e, 0xdd, 0x4c, 0x8e, 0xdd, 0x5d, 0x89, 0x10, 0x10, - /* (2^144)P */ 0x57, 0x25, 0x6a, 0x08, 0x37, 0x92, 0xa8, 0xdf, 0x24, 0xef, 0x8f, 0x33, 0x34, 0x52, 0xa4, 0x4c, 0xf0, 0x77, 0x9f, 0x69, 0x77, 0xd5, 0x8f, 0xd2, 0x9a, 0xb3, 0xb6, 0x1d, 0x2d, 0xa6, 0xf7, 0x1f, 0xda, 0xd7, 0xcb, 0x75, 0x11, 0xc3, 0x6b, 0xc0, 0x38, 0xb1, 0xd5, 0x2d, 0x96, 0x84, 0x16, 0xfa, 0x26, 0xb9, 0xcc, 0x3f, 0x16, 0x47, 0x23, 0x74, - /* (2^145)P */ 0x9b, 0x61, 0x2a, 0x1c, 0xdd, 0x39, 0xa5, 0xfa, 0x1c, 0x7d, 0x63, 0x50, 0xca, 0xe6, 0x9d, 0xfa, 0xb7, 0xc4, 0x4c, 0x6a, 0x97, 0x5f, 0x36, 0x4e, 0x47, 0xdd, 0x17, 0xf7, 0xf9, 0x19, 0xce, 0x75, 0x17, 0xad, 0xce, 0x2a, 0xf3, 0xfe, 0x27, 0x8f, 0x3e, 0x48, 0xc0, 0x60, 0x87, 0x24, 0x19, 0xae, 0x59, 0xe4, 0x5a, 0x00, 0x2a, 0xba, 0xa2, 0x1f, - /* (2^146)P */ 0x26, 0x88, 0x42, 0x60, 0x9f, 0x6e, 0x2c, 0x7c, 0x39, 0x0f, 0x47, 0x6a, 0x0e, 0x02, 0xbb, 0x4b, 0x34, 0x29, 0x55, 0x18, 0x36, 0xcf, 0x3b, 0x47, 0xf1, 0x2e, 0xfc, 0x6e, 0x94, 0xff, 0xe8, 0x6b, 0x06, 0xd2, 0xba, 0x77, 0x5e, 0x60, 0xd7, 0x19, 0xef, 0x02, 0x9d, 0x3a, 0xc2, 0xb7, 0xa9, 0xd8, 0x57, 0xee, 0x7e, 0x2b, 0xf2, 0x6d, 0x28, 0xda, - /* (2^147)P */ 0xdf, 0xd9, 0x92, 0x11, 0x98, 0x23, 0xe2, 0x45, 0x2f, 0x74, 0x70, 0xee, 0x0e, 0x55, 0x65, 0x79, 0x86, 0x38, 0x17, 0x92, 0x85, 0x87, 0x99, 0x50, 0xd9, 0x7c, 0xdb, 0xa1, 0x10, 0xec, 0x30, 0xb7, 0x40, 0xa3, 0x23, 0x9b, 0x0e, 0x27, 0x49, 0x29, 0x03, 0x94, 0xff, 0x53, 0xdc, 0xd7, 0xed, 0x49, 0xa9, 0x5a, 0x3b, 0xee, 0xd7, 0xc7, 0x65, 0xaf, - /* (2^148)P */ 0xa0, 0xbd, 0xbe, 0x03, 0xee, 0x0c, 0xbe, 0x32, 0x00, 0x7b, 0x52, 0xcb, 0x92, 0x29, 0xbf, 0xa0, 0xc6, 0xd9, 0xd2, 0xd6, 0x15, 0xe8, 0x3a, 0x75, 0x61, 0x65, 0x56, 0xae, 0xad, 0x3c, 0x2a, 0x64, 0x14, 0x3f, 0x8e, 0xc1, 0x2d, 0x0c, 0x8d, 0x20, 0xdb, 0x58, 0x4b, 0xe5, 0x40, 0x15, 0x4b, 0xdc, 0xa8, 0xbd, 0xef, 0x08, 0xa7, 0xd1, 0xf4, 0xb0, - /* (2^149)P */ 0xa9, 0x0f, 0x05, 0x94, 0x66, 0xac, 0x1f, 0x65, 0x3f, 0xe1, 0xb8, 0xe1, 0x34, 0x5e, 0x1d, 0x8f, 0xe3, 0x93, 0x03, 0x15, 0xff, 0xb6, 0x65, 0xb6, 0x6e, 0xc0, 0x2f, 0xd4, 0x2e, 0xb9, 0x2c, 0x13, 0x3c, 0x99, 0x1c, 0xb5, 0x87, 0xba, 0x79, 0xcb, 0xf0, 0x18, 0x06, 0x86, 0x04, 0x14, 0x25, 0x09, 0xcd, 0x1c, 0x14, 0xda, 0x35, 0xd0, 0x38, 0x3b, - /* (2^150)P */ 0x1b, 0x04, 0xa3, 0x27, 0xb4, 0xd3, 0x37, 0x48, 0x1e, 0x8f, 0x69, 0xd3, 0x5a, 0x2f, 0x20, 0x02, 0x36, 0xbe, 0x06, 0x7b, 0x6b, 0x6c, 0x12, 0x5b, 0x80, 0x74, 0x44, 0xe6, 0xf8, 0xf5, 0x95, 0x59, 0x29, 0xab, 0x51, 0x47, 0x83, 0x28, 0xe0, 0xad, 0xde, 0xaa, 0xd3, 0xb1, 0x1a, 0xcb, 0xa3, 0xcd, 0x8b, 0x6a, 0xb1, 0xa7, 0x0a, 0xd1, 0xf9, 0xbe, - /* (2^151)P */ 0xce, 0x2f, 0x85, 0xca, 0x74, 0x6d, 0x49, 0xb8, 0xce, 0x80, 0x44, 0xe0, 0xda, 0x5b, 0xcf, 0x2f, 0x79, 0x74, 0xfe, 0xb4, 0x2c, 0x99, 0x20, 0x6e, 0x09, 0x04, 0xfb, 0x6d, 0x57, 0x5b, 0x95, 0x0c, 0x45, 0xda, 0x4f, 0x7f, 0x63, 0xcc, 0x85, 0x5a, 0x67, 0x50, 0x68, 0x71, 0xb4, 0x67, 0xb1, 0x2e, 0xc1, 0x1c, 0xdc, 0xff, 0x2a, 0x7c, 0x10, 0x5e, - /* (2^152)P */ 0xa6, 0xde, 0xf3, 0xd4, 0x22, 0x30, 0x24, 0x9e, 0x0b, 0x30, 0x54, 0x59, 0x7e, 0xa2, 0xeb, 0x89, 0x54, 0x65, 0x3e, 0x40, 0xd1, 0xde, 0xe6, 0xee, 0x4d, 0xbf, 0x5e, 0x40, 0x1d, 0xee, 0x4f, 0x68, 0xd9, 0xa7, 0x2f, 0xb3, 0x64, 0xb3, 0xf5, 0xc8, 0xd3, 0xaa, 0x70, 0x70, 0x3d, 0xef, 0xd3, 0x95, 0x54, 0xdb, 0x3e, 0x94, 0x95, 0x92, 0x1f, 0x45, - /* (2^153)P */ 0x22, 0x80, 0x1d, 0x9d, 0x96, 0xa5, 0x78, 0x6f, 0xe0, 0x1e, 0x1b, 0x66, 0x42, 0xc8, 0xae, 0x9e, 0x46, 0x45, 0x08, 0x41, 0xdf, 0x80, 0xae, 0x6f, 0xdb, 0x15, 0x5a, 0x21, 0x31, 0x7a, 0xd0, 0xf2, 0x54, 0x15, 0x88, 0xd3, 0x0f, 0x7f, 0x14, 0x5a, 0x14, 0x97, 0xab, 0xf4, 0x58, 0x6a, 0x9f, 0xea, 0x74, 0xe5, 0x6b, 0x90, 0x59, 0x2b, 0x48, 0xd9, - /* (2^154)P */ 0x12, 0x24, 0x04, 0xf5, 0x50, 0xc2, 0x8c, 0xb0, 0x7c, 0x46, 0x98, 0xd5, 0x24, 0xad, 0xf6, 0x72, 0xdc, 0x82, 0x1a, 0x60, 0xc1, 0xeb, 0x48, 0xef, 0x7f, 0x6e, 0xe6, 0xcc, 0xdb, 0x7b, 0xae, 0xbe, 0x5e, 0x1e, 0x5c, 0xe6, 0x0a, 0x70, 0xdf, 0xa4, 0xa3, 0x85, 0x1b, 0x1b, 0x7f, 0x72, 0xb9, 0x96, 0x6f, 0xdc, 0x03, 0x76, 0x66, 0xfb, 0xa0, 0x33, - /* (2^155)P */ 0x37, 0x40, 0xbb, 0xbc, 0x68, 0x58, 0x86, 0xca, 0xbb, 0xa5, 0x24, 0x76, 0x3d, 0x48, 0xd1, 0xad, 0xb4, 0xa8, 0xcf, 0xc3, 0xb6, 0xa8, 0xba, 0x1a, 0x3a, 0xbe, 0x33, 0x75, 0x04, 0x5c, 0x13, 0x8c, 0x0d, 0x70, 0x8d, 0xa6, 0x4e, 0x2a, 0xeb, 0x17, 0x3c, 0x22, 0xdd, 0x3e, 0x96, 0x40, 0x11, 0x9e, 0x4e, 0xae, 0x3d, 0xf8, 0x91, 0xd7, 0x50, 0xc8, - /* (2^156)P */ 0xd8, 0xca, 0xde, 0x19, 0xcf, 0x00, 0xe4, 0x73, 0x18, 0x7f, 0x9b, 0x9f, 0xf4, 0x5b, 0x49, 0x49, 0x99, 0xdc, 0xa4, 0x46, 0x21, 0xb5, 0xd7, 0x3e, 0xb7, 0x47, 0x1b, 0xa9, 0x9f, 0x4c, 0x69, 0x7d, 0xec, 0x33, 0xd6, 0x1c, 0x51, 0x7f, 0x47, 0x74, 0x7a, 0x6c, 0xf3, 0xd2, 0x2e, 0xbf, 0xdf, 0x6c, 0x9e, 0x77, 0x3b, 0x34, 0xf6, 0x73, 0x80, 0xed, - /* (2^157)P */ 0x16, 0xfb, 0x16, 0xc3, 0xc2, 0x83, 0xe4, 0xf4, 0x03, 0x7f, 0x52, 0xb0, 0x67, 0x51, 0x7b, 0x24, 0x5a, 0x51, 0xd3, 0xb6, 0x4e, 0x59, 0x76, 0xcd, 0x08, 0x7b, 0x1d, 0x7a, 0x9c, 0x65, 0xae, 0xce, 0xaa, 0xd2, 0x1c, 0x85, 0x66, 0x68, 0x06, 0x15, 0xa8, 0x06, 0xe6, 0x16, 0x37, 0xf4, 0x49, 0x9e, 0x0f, 0x50, 0x37, 0xb1, 0xb2, 0x93, 0x70, 0x43, - /* (2^158)P */ 0x18, 0x3a, 0x16, 0xe5, 0x8d, 0xc8, 0x35, 0xd6, 0x7b, 0x09, 0xec, 0x61, 0x5f, 0x5c, 0x2a, 0x19, 0x96, 0x2e, 0xc3, 0xfd, 0xab, 0xe6, 0x23, 0xae, 0xab, 0xc5, 0xcb, 0xb9, 0x7b, 0x2d, 0x34, 0x51, 0xb9, 0x41, 0x9e, 0x7d, 0xca, 0xda, 0x25, 0x45, 0x14, 0xb0, 0xc7, 0x4d, 0x26, 0x2b, 0xfe, 0x43, 0xb0, 0x21, 0x5e, 0xfa, 0xdc, 0x7c, 0xf9, 0x5a, - /* (2^159)P */ 0x94, 0xad, 0x42, 0x17, 0xf5, 0xcd, 0x1c, 0x0d, 0xf6, 0x41, 0xd2, 0x55, 0xbb, 0x50, 0xf1, 0xc6, 0xbc, 0xa6, 0xc5, 0x3a, 0xfd, 0x9b, 0x75, 0x3e, 0xf6, 0x1a, 0xa7, 0xb2, 0x6e, 0x64, 0x12, 0xdc, 0x3c, 0xe5, 0xf6, 0xfc, 0x3b, 0xfa, 0x43, 0x81, 0xd4, 0xa5, 0xee, 0xf5, 0x9c, 0x47, 0x2f, 0xd0, 0x9c, 0xde, 0xa1, 0x48, 0x91, 0x9a, 0x34, 0xc1, - /* (2^160)P */ 0x37, 0x1b, 0xb3, 0x88, 0xc9, 0x98, 0x4e, 0xfb, 0x84, 0x4f, 0x2b, 0x0a, 0xb6, 0x8f, 0x35, 0x15, 0xcd, 0x61, 0x7a, 0x5f, 0x5c, 0xa0, 0xca, 0x23, 0xa0, 0x93, 0x1f, 0xcc, 0x3c, 0x39, 0x3a, 0x24, 0xa7, 0x49, 0xad, 0x8d, 0x59, 0xcc, 0x94, 0x5a, 0x16, 0xf5, 0x70, 0xe8, 0x52, 0x1e, 0xee, 0x20, 0x30, 0x17, 0x7e, 0xf0, 0x4c, 0x93, 0x06, 0x5a, - /* (2^161)P */ 0x81, 0xba, 0x3b, 0xd7, 0x3e, 0xb4, 0x32, 0x3a, 0x22, 0x39, 0x2a, 0xfc, 0x19, 0xd9, 0xd2, 0xf6, 0xc5, 0x79, 0x6c, 0x0e, 0xde, 0xda, 0x01, 0xff, 0x52, 0xfb, 0xb6, 0x95, 0x4e, 0x7a, 0x10, 0xb8, 0x06, 0x86, 0x3c, 0xcd, 0x56, 0xd6, 0x15, 0xbf, 0x6e, 0x3e, 0x4f, 0x35, 0x5e, 0xca, 0xbc, 0xa5, 0x95, 0xa2, 0xdf, 0x2d, 0x1d, 0xaf, 0x59, 0xf9, - /* (2^162)P */ 0x69, 0xe5, 0xe2, 0xfa, 0xc9, 0x7f, 0xdd, 0x09, 0xf5, 0x6b, 0x4e, 0x2e, 0xbe, 0xb4, 0xbf, 0x3e, 0xb2, 0xf2, 0x81, 0x30, 0xe1, 0x07, 0xa8, 0x0d, 0x2b, 0xd2, 0x5a, 0x55, 0xbe, 0x4b, 0x86, 0x5d, 0xb0, 0x5e, 0x7c, 0x8f, 0xc1, 0x3c, 0x81, 0x4c, 0xf7, 0x6d, 0x7d, 0xe6, 0x4f, 0x8a, 0x85, 0xc2, 0x2f, 0x28, 0xef, 0x8c, 0x69, 0xc2, 0xc2, 0x1a, - /* (2^163)P */ 0xd9, 0xe4, 0x0e, 0x1e, 0xc2, 0xf7, 0x2f, 0x9f, 0xa1, 0x40, 0xfe, 0x46, 0x16, 0xaf, 0x2e, 0xd1, 0xec, 0x15, 0x9b, 0x61, 0x92, 0xce, 0xfc, 0x10, 0x43, 0x1d, 0x00, 0xf6, 0xbe, 0x20, 0x80, 0x80, 0x6f, 0x3c, 0x16, 0x94, 0x59, 0xba, 0x03, 0x53, 0x6e, 0xb6, 0xdd, 0x25, 0x7b, 0x86, 0xbf, 0x96, 0xf4, 0x2f, 0xa1, 0x96, 0x8d, 0xf9, 0xb3, 0x29, - /* (2^164)P */ 0x3b, 0x04, 0x60, 0x6e, 0xce, 0xab, 0xd2, 0x63, 0x18, 0x53, 0x88, 0x16, 0x4a, 0x6a, 0xab, 0x72, 0x03, 0x68, 0xa5, 0xd4, 0x0d, 0xb2, 0x82, 0x81, 0x1f, 0x2b, 0x5c, 0x75, 0xe8, 0xd2, 0x1d, 0x7f, 0xe7, 0x1b, 0x35, 0x02, 0xde, 0xec, 0xbd, 0xcb, 0xc7, 0x01, 0xd3, 0x95, 0x61, 0xfe, 0xb2, 0x7a, 0x66, 0x09, 0x4c, 0x6d, 0xfd, 0x39, 0xf7, 0x52, - /* (2^165)P */ 0x42, 0xc1, 0x5f, 0xf8, 0x35, 0x52, 0xc1, 0xfe, 0xc5, 0x11, 0x80, 0x1c, 0x11, 0x46, 0x31, 0x11, 0xbe, 0xd0, 0xc4, 0xb6, 0x07, 0x13, 0x38, 0xa0, 0x8d, 0x65, 0xf0, 0x56, 0x9e, 0x16, 0xbf, 0x9d, 0xcd, 0x51, 0x34, 0xf9, 0x08, 0x48, 0x7b, 0x76, 0x0c, 0x7b, 0x30, 0x07, 0xa8, 0x76, 0xaf, 0xa3, 0x29, 0x38, 0xb0, 0x58, 0xde, 0x72, 0x4b, 0x45, - /* (2^166)P */ 0xd4, 0x16, 0xa7, 0xc0, 0xb4, 0x9f, 0xdf, 0x1a, 0x37, 0xc8, 0x35, 0xed, 0xc5, 0x85, 0x74, 0x64, 0x09, 0x22, 0xef, 0xe9, 0x0c, 0xaf, 0x12, 0x4c, 0x9e, 0xf8, 0x47, 0x56, 0xe0, 0x7f, 0x4e, 0x24, 0x6b, 0x0c, 0xe7, 0xad, 0xc6, 0x47, 0x1d, 0xa4, 0x0d, 0x86, 0x89, 0x65, 0xe8, 0x5f, 0x71, 0xc7, 0xe9, 0xcd, 0xec, 0x6c, 0x62, 0xc7, 0xe3, 0xb3, - /* (2^167)P */ 0xb5, 0xea, 0x86, 0xe3, 0x15, 0x18, 0x3f, 0x6d, 0x7b, 0x05, 0x95, 0x15, 0x53, 0x26, 0x1c, 0xeb, 0xbe, 0x7e, 0x16, 0x42, 0x4b, 0xa2, 0x3d, 0xdd, 0x0e, 0xff, 0xba, 0x67, 0xb5, 0xae, 0x7a, 0x17, 0xde, 0x23, 0xad, 0x14, 0xcc, 0xd7, 0xaf, 0x57, 0x01, 0xe0, 0xdd, 0x48, 0xdd, 0xd7, 0xe3, 0xdf, 0xe9, 0x2d, 0xda, 0x67, 0xa4, 0x9f, 0x29, 0x04, - /* (2^168)P */ 0x16, 0x53, 0xe6, 0x9c, 0x4e, 0xe5, 0x1e, 0x70, 0x81, 0x25, 0x02, 0x9b, 0x47, 0x6d, 0xd2, 0x08, 0x73, 0xbe, 0x0a, 0xf1, 0x7b, 0xeb, 0x24, 0xeb, 0x38, 0x23, 0x5c, 0xb6, 0x3e, 0xce, 0x1e, 0xe3, 0xbc, 0x82, 0x35, 0x1f, 0xaf, 0x3a, 0x3a, 0xe5, 0x4e, 0xc1, 0xca, 0xbf, 0x47, 0xb4, 0xbb, 0xbc, 0x5f, 0xea, 0xc6, 0xca, 0xf3, 0xa0, 0xa2, 0x73, - /* (2^169)P */ 0xef, 0xa4, 0x7a, 0x4e, 0xe4, 0xc7, 0xb6, 0x43, 0x2e, 0xa5, 0xe4, 0xa5, 0xba, 0x1e, 0xa5, 0xfe, 0x9e, 0xce, 0xa9, 0x80, 0x04, 0xcb, 0x4f, 0xd8, 0x74, 0x05, 0x48, 0xfa, 0x99, 0x11, 0x5d, 0x97, 0x3b, 0x07, 0x0d, 0xdd, 0xe6, 0xb1, 0x74, 0x87, 0x1a, 0xd3, 0x26, 0xb7, 0x8f, 0xe1, 0x63, 0x3d, 0xec, 0x53, 0x93, 0xb0, 0x81, 0x78, 0x34, 0xa4, - /* (2^170)P */ 0xe1, 0xe7, 0xd4, 0x58, 0x9d, 0x0e, 0x8b, 0x65, 0x66, 0x37, 0x16, 0x48, 0x6f, 0xaa, 0x42, 0x37, 0x77, 0xad, 0xb1, 0x56, 0x48, 0xdf, 0x65, 0x36, 0x30, 0xb8, 0x00, 0x12, 0xd8, 0x32, 0x28, 0x7f, 0xc1, 0x71, 0xeb, 0x93, 0x0f, 0x48, 0x04, 0xe1, 0x5a, 0x6a, 0x96, 0xc1, 0xca, 0x89, 0x6d, 0x1b, 0x82, 0x4c, 0x18, 0x6d, 0x55, 0x4b, 0xea, 0xfd, - /* (2^171)P */ 0x62, 0x1a, 0x53, 0xb4, 0xb1, 0xbe, 0x6f, 0x15, 0x18, 0x88, 0xd4, 0x66, 0x61, 0xc7, 0x12, 0x69, 0x02, 0xbd, 0x03, 0x23, 0x2b, 0xef, 0xf9, 0x54, 0xa4, 0x85, 0xa8, 0xe3, 0xb7, 0xbd, 0xa9, 0xa3, 0xf3, 0x2a, 0xdd, 0xf1, 0xd4, 0x03, 0x0f, 0xa9, 0xa1, 0xd8, 0xa3, 0xcd, 0xb2, 0x71, 0x90, 0x4b, 0x35, 0x62, 0xf2, 0x2f, 0xce, 0x67, 0x1f, 0xaa, - /* (2^172)P */ 0x9e, 0x1e, 0xcd, 0x43, 0x7e, 0x87, 0x37, 0x94, 0x3a, 0x97, 0x4c, 0x7e, 0xee, 0xc9, 0x37, 0x85, 0xf1, 0xd9, 0x4f, 0xbf, 0xf9, 0x6f, 0x39, 0x9a, 0x39, 0x87, 0x2e, 0x25, 0x84, 0x42, 0xc3, 0x80, 0xcb, 0x07, 0x22, 0xae, 0x30, 0xd5, 0x50, 0xa1, 0x23, 0xcc, 0x31, 0x81, 0x9d, 0xf1, 0x30, 0xd9, 0x2b, 0x73, 0x41, 0x16, 0x50, 0xab, 0x2d, 0xa2, - /* (2^173)P */ 0xa4, 0x69, 0x4f, 0xa1, 0x4e, 0xb9, 0xbf, 0x14, 0xe8, 0x2b, 0x04, 0x93, 0xb7, 0x6e, 0x9f, 0x7d, 0x73, 0x0a, 0xc5, 0x14, 0xb8, 0xde, 0x8c, 0xc1, 0xfe, 0xc0, 0xa7, 0xa4, 0xcc, 0x42, 0x42, 0x81, 0x15, 0x65, 0x8a, 0x80, 0xb9, 0xde, 0x1f, 0x60, 0x33, 0x0e, 0xcb, 0xfc, 0xe0, 0xdb, 0x83, 0xa1, 0xe5, 0xd0, 0x16, 0x86, 0x2c, 0xe2, 0x87, 0xed, - /* (2^174)P */ 0x7a, 0xc0, 0xeb, 0x6b, 0xf6, 0x0d, 0x4c, 0x6d, 0x1e, 0xdb, 0xab, 0xe7, 0x19, 0x45, 0xc6, 0xe3, 0xb2, 0x06, 0xbb, 0xbc, 0x70, 0x99, 0x83, 0x33, 0xeb, 0x28, 0xc8, 0x77, 0xf6, 0x4d, 0x01, 0xb7, 0x59, 0xa0, 0xd2, 0xb3, 0x2a, 0x72, 0x30, 0xe7, 0x11, 0x39, 0xb6, 0x41, 0x29, 0x65, 0x5a, 0x14, 0xb9, 0x86, 0x08, 0xe0, 0x7d, 0x32, 0x8c, 0xf0, - /* (2^175)P */ 0x5c, 0x11, 0x30, 0x9e, 0x05, 0x27, 0xf5, 0x45, 0x0f, 0xb3, 0xc9, 0x75, 0xc3, 0xd7, 0xe1, 0x82, 0x3b, 0x8e, 0x87, 0x23, 0x00, 0x15, 0x19, 0x07, 0xd9, 0x21, 0x53, 0xc7, 0xf1, 0xa3, 0xbf, 0x70, 0x64, 0x15, 0x18, 0xca, 0x23, 0x9e, 0xd3, 0x08, 0xc3, 0x2a, 0x8b, 0xe5, 0x83, 0x04, 0x89, 0x14, 0xfd, 0x28, 0x25, 0x1c, 0xe3, 0x26, 0xa7, 0x22, - /* (2^176)P */ 0xdc, 0xd4, 0x75, 0x60, 0x99, 0x94, 0xea, 0x09, 0x8e, 0x8a, 0x3c, 0x1b, 0xf9, 0xbd, 0x33, 0x0d, 0x51, 0x3d, 0x12, 0x6f, 0x4e, 0x72, 0xe0, 0x17, 0x20, 0xe9, 0x75, 0xe6, 0x3a, 0xb2, 0x13, 0x83, 0x4e, 0x7a, 0x08, 0x9e, 0xd1, 0x04, 0x5f, 0x6b, 0x42, 0x0b, 0x76, 0x2a, 0x2d, 0x77, 0x53, 0x6c, 0x65, 0x6d, 0x8e, 0x25, 0x3c, 0xb6, 0x8b, 0x69, - /* (2^177)P */ 0xb9, 0x49, 0x28, 0xd0, 0xdc, 0x6c, 0x8f, 0x4c, 0xc9, 0x14, 0x8a, 0x38, 0xa3, 0xcb, 0xc4, 0x9d, 0x53, 0xcf, 0xe9, 0xe3, 0xcf, 0xe0, 0xb1, 0xf2, 0x1b, 0x4c, 0x7f, 0x83, 0x2a, 0x7a, 0xe9, 0x8b, 0x3b, 0x86, 0x61, 0x30, 0xe9, 0x99, 0xbd, 0xba, 0x19, 0x6e, 0x65, 0x2a, 0x12, 0x3e, 0x9c, 0xa8, 0xaf, 0xc3, 0xcf, 0xf8, 0x1f, 0x77, 0x86, 0xea, - /* (2^178)P */ 0x30, 0xde, 0xe7, 0xff, 0x54, 0xf7, 0xa2, 0x59, 0xf6, 0x0b, 0xfb, 0x7a, 0xf2, 0x39, 0xf0, 0xdb, 0x39, 0xbc, 0xf0, 0xfa, 0x60, 0xeb, 0x6b, 0x4f, 0x47, 0x17, 0xc8, 0x00, 0x65, 0x6d, 0x25, 0x1c, 0xd0, 0x48, 0x56, 0x53, 0x45, 0x11, 0x30, 0x02, 0x49, 0x20, 0x27, 0xac, 0xf2, 0x4c, 0xac, 0x64, 0x3d, 0x52, 0xb8, 0x89, 0xe0, 0x93, 0x16, 0x0f, - /* (2^179)P */ 0x84, 0x09, 0xba, 0x40, 0xb2, 0x2f, 0xa3, 0xa8, 0xc2, 0xba, 0x46, 0x33, 0x05, 0x9d, 0x62, 0xad, 0xa1, 0x3c, 0x33, 0xef, 0x0d, 0xeb, 0xf0, 0x77, 0x11, 0x5a, 0xb0, 0x21, 0x9c, 0xdf, 0x55, 0x24, 0x25, 0x35, 0x51, 0x61, 0x92, 0xf0, 0xb1, 0xce, 0xf5, 0xd4, 0x7b, 0x6c, 0x21, 0x9d, 0x56, 0x52, 0xf8, 0xa1, 0x4c, 0xe9, 0x27, 0x55, 0xac, 0x91, - /* (2^180)P */ 0x03, 0x3e, 0x30, 0xd2, 0x0a, 0xfa, 0x7d, 0x82, 0x3d, 0x1f, 0x8b, 0xcb, 0xb6, 0x04, 0x5c, 0xcc, 0x8b, 0xda, 0xe2, 0x68, 0x74, 0x08, 0x8c, 0x44, 0x83, 0x57, 0x6d, 0x6f, 0x80, 0xb0, 0x7e, 0xa9, 0x82, 0x91, 0x7b, 0x4c, 0x37, 0x97, 0xd1, 0x63, 0xd1, 0xbd, 0x45, 0xe6, 0x8a, 0x86, 0xd6, 0x89, 0x54, 0xfd, 0xd2, 0xb1, 0xd7, 0x54, 0xad, 0xaf, - /* (2^181)P */ 0x8b, 0x33, 0x62, 0x49, 0x9f, 0x63, 0xf9, 0x87, 0x42, 0x58, 0xbf, 0xb3, 0xe6, 0x68, 0x02, 0x60, 0x5c, 0x76, 0x62, 0xf7, 0x61, 0xd7, 0x36, 0x31, 0xf7, 0x9c, 0xb5, 0xe5, 0x13, 0x6c, 0xea, 0x78, 0xae, 0xcf, 0xde, 0xbf, 0xb6, 0xeb, 0x4f, 0xc8, 0x2a, 0xb4, 0x9a, 0x9f, 0xf3, 0xd1, 0x6a, 0xec, 0x0c, 0xbd, 0x85, 0x98, 0x40, 0x06, 0x1c, 0x2a, - /* (2^182)P */ 0x74, 0x3b, 0xe7, 0x81, 0xd5, 0xae, 0x54, 0x56, 0x03, 0xe8, 0x97, 0x16, 0x76, 0xcf, 0x24, 0x96, 0x96, 0x5b, 0xcc, 0x09, 0xab, 0x23, 0x6f, 0x54, 0xae, 0x8f, 0xe4, 0x12, 0xcb, 0xfd, 0xbc, 0xac, 0x93, 0x45, 0x3d, 0x68, 0x08, 0x22, 0x59, 0xc6, 0xf0, 0x47, 0x19, 0x8c, 0x79, 0x93, 0x1e, 0x0e, 0x30, 0xb0, 0x94, 0xfb, 0x17, 0x1d, 0x5a, 0x12, - /* (2^183)P */ 0x85, 0xff, 0x40, 0x18, 0x85, 0xff, 0x44, 0x37, 0x69, 0x23, 0x4d, 0x34, 0xe1, 0xeb, 0xa3, 0x1b, 0x55, 0x40, 0xc1, 0x64, 0xf4, 0xd4, 0x13, 0x0a, 0x9f, 0xb9, 0x19, 0xfc, 0x88, 0x7d, 0xc0, 0x72, 0xcf, 0x69, 0x2f, 0xd2, 0x0c, 0x82, 0x0f, 0xda, 0x08, 0xba, 0x0f, 0xaa, 0x3b, 0xe9, 0xe5, 0x83, 0x7a, 0x06, 0xe8, 0x1b, 0x38, 0x43, 0xc3, 0x54, - /* (2^184)P */ 0x14, 0xaa, 0xb3, 0x6e, 0xe6, 0x28, 0xee, 0xc5, 0x22, 0x6c, 0x7c, 0xf9, 0xa8, 0x71, 0xcc, 0xfe, 0x68, 0x7e, 0xd3, 0xb8, 0x37, 0x96, 0xca, 0x0b, 0xd9, 0xb6, 0x06, 0xa9, 0xf6, 0x71, 0xe8, 0x31, 0xf7, 0xd8, 0xf1, 0x5d, 0xab, 0xb9, 0xf0, 0x5c, 0x98, 0xcf, 0x22, 0xa2, 0x2a, 0xf6, 0xd0, 0x59, 0xf0, 0x9d, 0xd9, 0x6a, 0x4f, 0x59, 0x57, 0xad, - /* (2^185)P */ 0xd7, 0x2b, 0x3d, 0x38, 0x4c, 0x2e, 0x23, 0x4d, 0x49, 0xa2, 0x62, 0x62, 0xf9, 0x0f, 0xde, 0x08, 0xf3, 0x86, 0x71, 0xb6, 0xc7, 0xf9, 0x85, 0x9c, 0x33, 0xa1, 0xcf, 0x16, 0xaa, 0x60, 0xb9, 0xb7, 0xea, 0xed, 0x01, 0x1c, 0x59, 0xdb, 0x3f, 0x3f, 0x97, 0x2e, 0xf0, 0x09, 0x9f, 0x10, 0x85, 0x5f, 0x53, 0x39, 0xf3, 0x13, 0x40, 0x56, 0x95, 0xf9, - /* (2^186)P */ 0xb4, 0xe3, 0xda, 0xc6, 0x1f, 0x78, 0x8e, 0xac, 0xd4, 0x20, 0x1d, 0xa0, 0xbf, 0x4c, 0x09, 0x16, 0xa7, 0x30, 0xb5, 0x8d, 0x9e, 0xa1, 0x5f, 0x6d, 0x52, 0xf4, 0x71, 0xb6, 0x32, 0x2d, 0x21, 0x51, 0xc6, 0xfc, 0x2f, 0x08, 0xf4, 0x13, 0x6c, 0x55, 0xba, 0x72, 0x81, 0x24, 0x49, 0x0e, 0x4f, 0x06, 0x36, 0x39, 0x6a, 0xc5, 0x81, 0xfc, 0xeb, 0xb2, - /* (2^187)P */ 0x7d, 0x8d, 0xc8, 0x6c, 0xea, 0xb4, 0xb9, 0xe8, 0x40, 0xc9, 0x69, 0xc9, 0x30, 0x05, 0xfd, 0x34, 0x46, 0xfd, 0x94, 0x05, 0x16, 0xf5, 0x4b, 0x13, 0x3d, 0x24, 0x1a, 0xd6, 0x64, 0x2b, 0x9c, 0xe2, 0xa5, 0xd9, 0x98, 0xe0, 0xe8, 0xf4, 0xbc, 0x2c, 0xbd, 0xa2, 0x56, 0xe3, 0x9e, 0x14, 0xdb, 0xbf, 0x05, 0xbf, 0x9a, 0x13, 0x5d, 0xf7, 0x91, 0xa3, - /* (2^188)P */ 0x8b, 0xcb, 0x27, 0xf3, 0x15, 0x26, 0x05, 0x40, 0x0f, 0xa6, 0x15, 0x13, 0x71, 0x95, 0xa2, 0xc6, 0x38, 0x04, 0x67, 0xf8, 0x9a, 0x83, 0x06, 0xaa, 0x25, 0x36, 0x72, 0x01, 0x6f, 0x74, 0x5f, 0xe5, 0x6e, 0x44, 0x99, 0xce, 0x13, 0xbc, 0x82, 0xc2, 0x0d, 0xa4, 0x98, 0x50, 0x38, 0xf3, 0xa2, 0xc5, 0xe5, 0x24, 0x1f, 0x6f, 0x56, 0x3e, 0x07, 0xb2, - /* (2^189)P */ 0xbd, 0x0f, 0x32, 0x60, 0x07, 0xb1, 0xd7, 0x0b, 0x11, 0x07, 0x57, 0x02, 0x89, 0xe8, 0x8b, 0xe8, 0x5a, 0x1f, 0xee, 0x54, 0x6b, 0xff, 0xb3, 0x04, 0x07, 0x57, 0x13, 0x0b, 0x94, 0xa8, 0x4d, 0x81, 0xe2, 0x17, 0x16, 0x45, 0xd4, 0x4b, 0xf7, 0x7e, 0x64, 0x66, 0x20, 0xe8, 0x0b, 0x26, 0xfd, 0xa9, 0x8a, 0x47, 0x52, 0x89, 0x14, 0xd0, 0xd1, 0xa1, - /* (2^190)P */ 0xdc, 0x03, 0xe6, 0x20, 0x44, 0x47, 0x8f, 0x04, 0x16, 0x24, 0x22, 0xc1, 0x55, 0x5c, 0xbe, 0x43, 0xc3, 0x92, 0xc5, 0x54, 0x3d, 0x5d, 0xd1, 0x05, 0x9c, 0xc6, 0x7c, 0xbf, 0x23, 0x84, 0x1a, 0xba, 0x4f, 0x1f, 0xfc, 0xa1, 0xae, 0x1a, 0x64, 0x02, 0x51, 0xf1, 0xcb, 0x7a, 0x20, 0xce, 0xb2, 0x34, 0x3c, 0xca, 0xe0, 0xe4, 0xba, 0x22, 0xd4, 0x7b, - /* (2^191)P */ 0xca, 0xfd, 0xca, 0xd7, 0xde, 0x61, 0xae, 0xf0, 0x79, 0x0c, 0x20, 0xab, 0xbc, 0x6f, 0x4d, 0x61, 0xf0, 0xc7, 0x9c, 0x8d, 0x4b, 0x52, 0xf3, 0xb9, 0x48, 0x63, 0x0b, 0xb6, 0xd2, 0x25, 0x9a, 0x96, 0x72, 0xc1, 0x6b, 0x0c, 0xb5, 0xfb, 0x71, 0xaa, 0xad, 0x47, 0x5b, 0xe7, 0xc0, 0x0a, 0x55, 0xb2, 0xd4, 0x16, 0x2f, 0xb1, 0x01, 0xfd, 0xce, 0x27, - /* (2^192)P */ 0x64, 0x11, 0x4b, 0xab, 0x57, 0x09, 0xc6, 0x49, 0x4a, 0x37, 0xc3, 0x36, 0xc4, 0x7b, 0x81, 0x1f, 0x42, 0xed, 0xbb, 0xe0, 0xa0, 0x8d, 0x51, 0xe6, 0xca, 0x8b, 0xb9, 0xcd, 0x99, 0x2d, 0x91, 0x53, 0xa9, 0x47, 0xcb, 0x32, 0xc7, 0xa4, 0x92, 0xec, 0x46, 0x74, 0x44, 0x6d, 0x71, 0x9f, 0x6d, 0x0c, 0x69, 0xa4, 0xf8, 0xbe, 0x9f, 0x7f, 0xa0, 0xd7, - /* (2^193)P */ 0x5f, 0x33, 0xb6, 0x91, 0xc8, 0xa5, 0x3f, 0x5d, 0x7f, 0x38, 0x6e, 0x74, 0x20, 0x4a, 0xd6, 0x2b, 0x98, 0x2a, 0x41, 0x4b, 0x83, 0x64, 0x0b, 0x92, 0x7a, 0x06, 0x1e, 0xc6, 0x2c, 0xf6, 0xe4, 0x91, 0xe5, 0xb1, 0x2e, 0x6e, 0x4e, 0xa8, 0xc8, 0x14, 0x32, 0x57, 0x44, 0x1c, 0xe4, 0xb9, 0x7f, 0x54, 0x51, 0x08, 0x81, 0xaa, 0x4e, 0xce, 0xa1, 0x5d, - /* (2^194)P */ 0x5c, 0xd5, 0x9b, 0x5e, 0x7c, 0xb5, 0xb1, 0x52, 0x73, 0x00, 0x41, 0x56, 0x79, 0x08, 0x7e, 0x07, 0x28, 0x06, 0xa6, 0xfb, 0x7f, 0x69, 0xbd, 0x7a, 0x3c, 0xae, 0x9f, 0x39, 0xbb, 0x54, 0xa2, 0x79, 0xb9, 0x0e, 0x7f, 0xbb, 0xe0, 0xe6, 0xb7, 0x27, 0x64, 0x38, 0x45, 0xdb, 0x84, 0xe4, 0x61, 0x72, 0x3f, 0xe2, 0x24, 0xfe, 0x7a, 0x31, 0x9a, 0xc9, - /* (2^195)P */ 0xa1, 0xd2, 0xa4, 0xee, 0x24, 0x96, 0xe5, 0x5b, 0x79, 0x78, 0x3c, 0x7b, 0x82, 0x3b, 0x8b, 0x58, 0x0b, 0xa3, 0x63, 0x2d, 0xbc, 0x75, 0x46, 0xe8, 0x83, 0x1a, 0xc0, 0x2a, 0x92, 0x61, 0xa8, 0x75, 0x37, 0x3c, 0xbf, 0x0f, 0xef, 0x8f, 0x6c, 0x97, 0x75, 0x10, 0x05, 0x7a, 0xde, 0x23, 0xe8, 0x2a, 0x35, 0xeb, 0x41, 0x64, 0x7d, 0xcf, 0xe0, 0x52, - /* (2^196)P */ 0x4a, 0xd0, 0x49, 0x93, 0xae, 0xf3, 0x24, 0x8c, 0xe1, 0x09, 0x98, 0x45, 0xd8, 0xb9, 0xfe, 0x8e, 0x8c, 0xa8, 0x2c, 0xc9, 0x9f, 0xce, 0x01, 0xdc, 0x38, 0x11, 0xab, 0x85, 0xb9, 0xe8, 0x00, 0x51, 0xfd, 0x82, 0xe1, 0x9b, 0x4e, 0xfc, 0xb5, 0x2a, 0x0f, 0x8b, 0xda, 0x4e, 0x02, 0xca, 0xcc, 0xe3, 0x91, 0xc4, 0xe0, 0xcf, 0x7b, 0xd6, 0xe6, 0x6a, - /* (2^197)P */ 0xfe, 0x11, 0xd7, 0xaa, 0xe3, 0x0c, 0x52, 0x2e, 0x04, 0xe0, 0xe0, 0x61, 0xc8, 0x05, 0xd7, 0x31, 0x4c, 0xc3, 0x9b, 0x2d, 0xce, 0x59, 0xbe, 0x12, 0xb7, 0x30, 0x21, 0xfc, 0x81, 0xb8, 0x5e, 0x57, 0x73, 0xd0, 0xad, 0x8e, 0x9e, 0xe4, 0xeb, 0xcd, 0xcf, 0xd2, 0x0f, 0x01, 0x35, 0x16, 0xed, 0x7a, 0x43, 0x8e, 0x42, 0xdc, 0xea, 0x4c, 0xa8, 0x7c, - /* (2^198)P */ 0x37, 0x26, 0xcc, 0x76, 0x0b, 0xe5, 0x76, 0xdd, 0x3e, 0x19, 0x3c, 0xc4, 0x6c, 0x7f, 0xd0, 0x03, 0xc1, 0xb8, 0x59, 0x82, 0xca, 0x36, 0xc1, 0xe4, 0xc8, 0xb2, 0x83, 0x69, 0x9c, 0xc5, 0x9d, 0x12, 0x82, 0x1c, 0xea, 0xb2, 0x84, 0x9f, 0xf3, 0x52, 0x6b, 0xbb, 0xd8, 0x81, 0x56, 0x83, 0x04, 0x66, 0x05, 0x22, 0x49, 0x37, 0x93, 0xb1, 0xfd, 0xd5, - /* (2^199)P */ 0xaf, 0x96, 0xbf, 0x03, 0xbe, 0xe6, 0x5d, 0x78, 0x19, 0xba, 0x37, 0x46, 0x0a, 0x2b, 0x52, 0x7c, 0xd8, 0x51, 0x9e, 0x3d, 0x29, 0x42, 0xdb, 0x0e, 0x31, 0x20, 0x94, 0xf8, 0x43, 0x9a, 0x2d, 0x22, 0xd3, 0xe3, 0xa1, 0x79, 0x68, 0xfb, 0x2d, 0x7e, 0xd6, 0x79, 0xda, 0x0b, 0xc6, 0x5b, 0x76, 0x68, 0xf0, 0xfe, 0x72, 0x59, 0xbb, 0xa1, 0x9c, 0x74, - /* (2^200)P */ 0x0a, 0xd9, 0xec, 0xc5, 0xbd, 0xf0, 0xda, 0xcf, 0x82, 0xab, 0x46, 0xc5, 0x32, 0x13, 0xdc, 0x5b, 0xac, 0xc3, 0x53, 0x9a, 0x7f, 0xef, 0xa5, 0x40, 0x5a, 0x1f, 0xc1, 0x12, 0x91, 0x54, 0x83, 0x6a, 0xb0, 0x9a, 0x85, 0x4d, 0xbf, 0x36, 0x8e, 0xd3, 0xa2, 0x2b, 0xe5, 0xd6, 0xc6, 0xe1, 0x58, 0x5b, 0x82, 0x9b, 0xc8, 0xf2, 0x03, 0xba, 0xf5, 0x92, - /* (2^201)P */ 0xfb, 0x21, 0x7e, 0xde, 0xe7, 0xb4, 0xc0, 0x56, 0x86, 0x3a, 0x5b, 0x78, 0xf8, 0xf0, 0xf4, 0xe7, 0x5c, 0x00, 0xd2, 0xd7, 0xd6, 0xf8, 0x75, 0x5e, 0x0f, 0x3e, 0xd1, 0x4b, 0x77, 0xd8, 0xad, 0xb0, 0xc9, 0x8b, 0x59, 0x7d, 0x30, 0x76, 0x64, 0x7a, 0x76, 0xd9, 0x51, 0x69, 0xfc, 0xbd, 0x8e, 0xb5, 0x55, 0xe0, 0xd2, 0x07, 0x15, 0xa9, 0xf7, 0xa4, - /* (2^202)P */ 0xaa, 0x2d, 0x2f, 0x2b, 0x3c, 0x15, 0xdd, 0xcd, 0xe9, 0x28, 0x82, 0x4f, 0xa2, 0xaa, 0x31, 0x48, 0xcc, 0xfa, 0x07, 0x73, 0x8a, 0x34, 0x74, 0x0d, 0xab, 0x1a, 0xca, 0xd2, 0xbf, 0x3a, 0xdb, 0x1a, 0x5f, 0x50, 0x62, 0xf4, 0x6b, 0x83, 0x38, 0x43, 0x96, 0xee, 0x6b, 0x39, 0x1e, 0xf0, 0x17, 0x80, 0x1e, 0x9b, 0xed, 0x2b, 0x2f, 0xcc, 0x65, 0xf7, - /* (2^203)P */ 0x03, 0xb3, 0x23, 0x9c, 0x0d, 0xd1, 0xeb, 0x7e, 0x34, 0x17, 0x8a, 0x4c, 0xde, 0x54, 0x39, 0xc4, 0x11, 0x82, 0xd3, 0xa4, 0x00, 0x32, 0x95, 0x9c, 0xa6, 0x64, 0x76, 0x6e, 0xd6, 0x53, 0x27, 0xb4, 0x6a, 0x14, 0x8c, 0x54, 0xf6, 0x58, 0x9e, 0x22, 0x4a, 0x55, 0x18, 0x77, 0xd0, 0x08, 0x6b, 0x19, 0x8a, 0xb5, 0xe7, 0x19, 0xb8, 0x60, 0x92, 0xb1, - /* (2^204)P */ 0x66, 0xec, 0xf3, 0x12, 0xde, 0x67, 0x7f, 0xd4, 0x5b, 0xf6, 0x70, 0x64, 0x0a, 0xb5, 0xc2, 0xf9, 0xb3, 0x64, 0xab, 0x56, 0x46, 0xc7, 0x93, 0xc2, 0x8b, 0x2d, 0xd0, 0xd6, 0x39, 0x3b, 0x1f, 0xcd, 0xb3, 0xac, 0xcc, 0x2c, 0x27, 0x6a, 0xbc, 0xb3, 0x4b, 0xa8, 0x3c, 0x69, 0x20, 0xe2, 0x18, 0x35, 0x17, 0xe1, 0x8a, 0xd3, 0x11, 0x74, 0xaa, 0x4d, - /* (2^205)P */ 0x96, 0xc4, 0x16, 0x7e, 0xfd, 0xf5, 0xd0, 0x7d, 0x1f, 0x32, 0x1b, 0xdb, 0xa6, 0xfd, 0x51, 0x75, 0x4d, 0xd7, 0x00, 0xe5, 0x7f, 0x58, 0x5b, 0xeb, 0x4b, 0x6a, 0x78, 0xfe, 0xe5, 0xd6, 0x8f, 0x99, 0x17, 0xca, 0x96, 0x45, 0xf7, 0x52, 0xdf, 0x84, 0x06, 0x77, 0xb9, 0x05, 0x63, 0x5d, 0xe9, 0x91, 0xb1, 0x4b, 0x82, 0x5a, 0xdb, 0xd7, 0xca, 0x69, - /* (2^206)P */ 0x02, 0xd3, 0x38, 0x38, 0x87, 0xea, 0xbd, 0x9f, 0x11, 0xca, 0xf3, 0x21, 0xf1, 0x9b, 0x35, 0x97, 0x98, 0xff, 0x8e, 0x6d, 0x3d, 0xd6, 0xb2, 0xfa, 0x68, 0xcb, 0x7e, 0x62, 0x85, 0xbb, 0xc7, 0x5d, 0xee, 0x32, 0x30, 0x2e, 0x71, 0x96, 0x63, 0x43, 0x98, 0xc4, 0xa7, 0xde, 0x60, 0xb2, 0xd9, 0x43, 0x4a, 0xfa, 0x97, 0x2d, 0x5f, 0x21, 0xd4, 0xfe, - /* (2^207)P */ 0x3b, 0x20, 0x29, 0x07, 0x07, 0xb5, 0x78, 0xc3, 0xc7, 0xab, 0x56, 0xba, 0x40, 0xde, 0x1d, 0xcf, 0xc3, 0x00, 0x56, 0x21, 0x0c, 0xc8, 0x42, 0xd9, 0x0e, 0xcd, 0x02, 0x7c, 0x07, 0xb9, 0x11, 0xd7, 0x96, 0xaf, 0xff, 0xad, 0xc5, 0xba, 0x30, 0x6d, 0x82, 0x3a, 0xbf, 0xef, 0x7b, 0xf7, 0x0a, 0x74, 0xbd, 0x31, 0x0c, 0xe4, 0xec, 0x1a, 0xe5, 0xc5, - /* (2^208)P */ 0xcc, 0xf2, 0x28, 0x16, 0x12, 0xbf, 0xef, 0x85, 0xbc, 0xf7, 0xcb, 0x9f, 0xdb, 0xa8, 0xb2, 0x49, 0x53, 0x48, 0xa8, 0x24, 0xa8, 0x68, 0x8d, 0xbb, 0x21, 0x0a, 0x5a, 0xbd, 0xb2, 0x91, 0x61, 0x47, 0xc4, 0x43, 0x08, 0xa6, 0x19, 0xef, 0x8e, 0x88, 0x39, 0xc6, 0x33, 0x30, 0xf3, 0x0e, 0xc5, 0x92, 0x66, 0xd6, 0xfe, 0xc5, 0x12, 0xd9, 0x4c, 0x2d, - /* (2^209)P */ 0x30, 0x34, 0x07, 0xbf, 0x9c, 0x5a, 0x4e, 0x65, 0xf1, 0x39, 0x35, 0x38, 0xae, 0x7b, 0x55, 0xac, 0x6a, 0x92, 0x24, 0x7e, 0x50, 0xd3, 0xba, 0x78, 0x51, 0xfe, 0x4d, 0x32, 0x05, 0x11, 0xf5, 0x52, 0xf1, 0x31, 0x45, 0x39, 0x98, 0x7b, 0x28, 0x56, 0xc3, 0x5d, 0x4f, 0x07, 0x6f, 0x84, 0xb8, 0x1a, 0x58, 0x0b, 0xc4, 0x7c, 0xc4, 0x8d, 0x32, 0x8e, - /* (2^210)P */ 0x7e, 0xaf, 0x98, 0xce, 0xc5, 0x2b, 0x9d, 0xf6, 0xfa, 0x2c, 0xb6, 0x2a, 0x5a, 0x1d, 0xc0, 0x24, 0x8d, 0xa4, 0xce, 0xb1, 0x12, 0x01, 0xf9, 0x79, 0xc6, 0x79, 0x38, 0x0c, 0xd4, 0x07, 0xc9, 0xf7, 0x37, 0xa1, 0x0b, 0xfe, 0x72, 0xec, 0x5d, 0xd6, 0xb0, 0x1c, 0x70, 0xbe, 0x70, 0x01, 0x13, 0xe0, 0x86, 0x95, 0xc7, 0x2e, 0x12, 0x3b, 0xe6, 0xa6, - /* (2^211)P */ 0x24, 0x82, 0x67, 0xe0, 0x14, 0x7b, 0x56, 0x08, 0x38, 0x44, 0xdb, 0xa0, 0x3a, 0x05, 0x47, 0xb2, 0xc0, 0xac, 0xd1, 0xcc, 0x3f, 0x82, 0xb8, 0x8a, 0x88, 0xbc, 0xf5, 0x33, 0xa1, 0x35, 0x0f, 0xf6, 0xe2, 0xef, 0x6c, 0xf7, 0x37, 0x9e, 0xe8, 0x10, 0xca, 0xb0, 0x8e, 0x80, 0x86, 0x00, 0x23, 0xd0, 0x4a, 0x76, 0x9f, 0xf7, 0x2c, 0x52, 0x15, 0x0e, - /* (2^212)P */ 0x5e, 0x49, 0xe1, 0x2c, 0x9a, 0x01, 0x76, 0xa6, 0xb3, 0x07, 0x5b, 0xa4, 0x07, 0xef, 0x1d, 0xc3, 0x6a, 0xbb, 0x64, 0xbe, 0x71, 0x15, 0x6e, 0x32, 0x31, 0x46, 0x9a, 0x9e, 0x8f, 0x45, 0x73, 0xce, 0x0b, 0x94, 0x1a, 0x52, 0x07, 0xf4, 0x50, 0x30, 0x49, 0x53, 0x50, 0xfb, 0x71, 0x1f, 0x5a, 0x03, 0xa9, 0x76, 0xf2, 0x8f, 0x42, 0xff, 0xed, 0xed, - /* (2^213)P */ 0xed, 0x08, 0xdb, 0x91, 0x1c, 0xee, 0xa2, 0xb4, 0x47, 0xa2, 0xfa, 0xcb, 0x03, 0xd1, 0xff, 0x8c, 0xad, 0x64, 0x50, 0x61, 0xcd, 0xfc, 0x88, 0xa0, 0x31, 0x95, 0x30, 0xb9, 0x58, 0xdd, 0xd7, 0x43, 0xe4, 0x46, 0xc2, 0x16, 0xd9, 0x72, 0x4a, 0x56, 0x51, 0x70, 0x85, 0xf1, 0xa1, 0x80, 0x40, 0xd5, 0xba, 0x67, 0x81, 0xda, 0xcd, 0x03, 0xea, 0x51, - /* (2^214)P */ 0x42, 0x50, 0xf0, 0xef, 0x37, 0x61, 0x72, 0x85, 0xe1, 0xf1, 0xff, 0x6f, 0x3d, 0xe8, 0x7b, 0x21, 0x5c, 0xe5, 0x50, 0x03, 0xde, 0x00, 0xc1, 0xf7, 0x3a, 0x55, 0x12, 0x1c, 0x9e, 0x1e, 0xce, 0xd1, 0x2f, 0xaf, 0x05, 0x70, 0x5b, 0x47, 0xf2, 0x04, 0x7a, 0x89, 0xbc, 0x78, 0xa6, 0x65, 0x6c, 0xaa, 0x3c, 0xa2, 0x3c, 0x8b, 0x5c, 0xa9, 0x22, 0x48, - /* (2^215)P */ 0x7e, 0x8c, 0x8f, 0x2f, 0x60, 0xe3, 0x5a, 0x94, 0xd4, 0xce, 0xdd, 0x9d, 0x83, 0x3b, 0x77, 0x78, 0x43, 0x1d, 0xfd, 0x8f, 0xc8, 0xe8, 0x02, 0x90, 0xab, 0xf6, 0xc9, 0xfc, 0xf1, 0x63, 0xaa, 0x5f, 0x42, 0xf1, 0x78, 0x34, 0x64, 0x16, 0x75, 0x9c, 0x7d, 0xd0, 0xe4, 0x74, 0x5a, 0xa8, 0xfb, 0xcb, 0xac, 0x20, 0xa3, 0xc2, 0xa6, 0x20, 0xf8, 0x1b, - /* (2^216)P */ 0x00, 0x4f, 0x1e, 0x56, 0xb5, 0x34, 0xb2, 0x87, 0x31, 0xe5, 0xee, 0x8d, 0xf1, 0x41, 0x67, 0xb7, 0x67, 0x3a, 0x54, 0x86, 0x5c, 0xf0, 0x0b, 0x37, 0x2f, 0x1b, 0x92, 0x5d, 0x58, 0x93, 0xdc, 0xd8, 0x58, 0xcc, 0x9e, 0x67, 0xd0, 0x97, 0x3a, 0xaf, 0x49, 0x39, 0x2d, 0x3b, 0xd8, 0x98, 0xfb, 0x76, 0x6b, 0xe7, 0xaf, 0xc3, 0x45, 0x44, 0x53, 0x94, - /* (2^217)P */ 0x30, 0xbd, 0x90, 0x75, 0xd3, 0xbd, 0x3b, 0x58, 0x27, 0x14, 0x9f, 0x6b, 0xd4, 0x31, 0x99, 0xcd, 0xde, 0x3a, 0x21, 0x1e, 0xb4, 0x02, 0xe4, 0x33, 0x04, 0x02, 0xb0, 0x50, 0x66, 0x68, 0x90, 0xdd, 0x7b, 0x69, 0x31, 0xd9, 0xcf, 0x68, 0x73, 0xf1, 0x60, 0xdd, 0xc8, 0x1d, 0x5d, 0xe3, 0xd6, 0x5b, 0x2a, 0xa4, 0xea, 0xc4, 0x3f, 0x08, 0xcd, 0x9c, - /* (2^218)P */ 0x6b, 0x1a, 0xbf, 0x55, 0xc1, 0x1b, 0x0c, 0x05, 0x09, 0xdf, 0xf5, 0x5e, 0xa3, 0x77, 0x95, 0xe9, 0xdf, 0x19, 0xdd, 0xc7, 0x94, 0xcb, 0x06, 0x73, 0xd0, 0x88, 0x02, 0x33, 0x94, 0xca, 0x7a, 0x2f, 0x8e, 0x3d, 0x72, 0x61, 0x2d, 0x4d, 0xa6, 0x61, 0x1f, 0x32, 0x5e, 0x87, 0x53, 0x36, 0x11, 0x15, 0x20, 0xb3, 0x5a, 0x57, 0x51, 0x93, 0x20, 0xd8, - /* (2^219)P */ 0xb7, 0x56, 0xf4, 0xab, 0x7d, 0x0c, 0xfb, 0x99, 0x1a, 0x30, 0x29, 0xb0, 0x75, 0x2a, 0xf8, 0x53, 0x71, 0x23, 0xbd, 0xa7, 0xd8, 0x0a, 0xe2, 0x27, 0x65, 0xe9, 0x74, 0x26, 0x98, 0x4a, 0x69, 0x19, 0xb2, 0x4d, 0x0a, 0x17, 0x98, 0xb2, 0xa9, 0x57, 0x4e, 0xf6, 0x86, 0xc8, 0x01, 0xa4, 0xc6, 0x98, 0xad, 0x5a, 0x90, 0x2c, 0x05, 0x46, 0x64, 0xb7, - /* (2^220)P */ 0x7b, 0x91, 0xdf, 0xfc, 0xf8, 0x1c, 0x8c, 0x15, 0x9e, 0xf7, 0xd5, 0xa8, 0xe8, 0xe7, 0xe3, 0xa3, 0xb0, 0x04, 0x74, 0xfa, 0x78, 0xfb, 0x26, 0xbf, 0x67, 0x42, 0xf9, 0x8c, 0x9b, 0xb4, 0x69, 0x5b, 0x02, 0x13, 0x6d, 0x09, 0x6c, 0xd6, 0x99, 0x61, 0x7b, 0x89, 0x4a, 0x67, 0x75, 0xa3, 0x98, 0x13, 0x23, 0x1d, 0x18, 0x24, 0x0e, 0xef, 0x41, 0x79, - /* (2^221)P */ 0x86, 0x33, 0xab, 0x08, 0xcb, 0xbf, 0x1e, 0x76, 0x3c, 0x0b, 0xbd, 0x30, 0xdb, 0xe9, 0xa3, 0x35, 0x87, 0x1b, 0xe9, 0x07, 0x00, 0x66, 0x7f, 0x3b, 0x35, 0x0c, 0x8a, 0x3f, 0x61, 0xbc, 0xe0, 0xae, 0xf6, 0xcc, 0x54, 0xe1, 0x72, 0x36, 0x2d, 0xee, 0x93, 0x24, 0xf8, 0xd7, 0xc5, 0xf9, 0xcb, 0xb0, 0xe5, 0x88, 0x0d, 0x23, 0x4b, 0x76, 0x15, 0xa2, - /* (2^222)P */ 0x37, 0xdb, 0x83, 0xd5, 0x6d, 0x06, 0x24, 0x37, 0x1b, 0x15, 0x85, 0x15, 0xe2, 0xc0, 0x4e, 0x02, 0xa9, 0x6d, 0x0a, 0x3a, 0x94, 0x4a, 0x6f, 0x49, 0x00, 0x01, 0x72, 0xbb, 0x60, 0x14, 0x35, 0xae, 0xb4, 0xc6, 0x01, 0x0a, 0x00, 0x9e, 0xc3, 0x58, 0xc5, 0xd1, 0x5e, 0x30, 0x73, 0x96, 0x24, 0x85, 0x9d, 0xf0, 0xf9, 0xec, 0x09, 0xd3, 0xe7, 0x70, - /* (2^223)P */ 0xf3, 0xbd, 0x96, 0x87, 0xe9, 0x71, 0xbd, 0xd6, 0xa2, 0x45, 0xeb, 0x0a, 0xcd, 0x2c, 0xf1, 0x72, 0xa6, 0x31, 0xa9, 0x6f, 0x09, 0xa1, 0x5e, 0xdd, 0xc8, 0x8d, 0x0d, 0xbc, 0x5a, 0x8d, 0xb1, 0x2c, 0x9a, 0xcc, 0x37, 0x74, 0xc2, 0xa9, 0x4e, 0xd6, 0xc0, 0x3c, 0xa0, 0x23, 0xb0, 0xa0, 0x77, 0x14, 0x80, 0x45, 0x71, 0x6a, 0x2d, 0x41, 0xc3, 0x82, - /* (2^224)P */ 0x37, 0x44, 0xec, 0x8a, 0x3e, 0xc1, 0x0c, 0xa9, 0x12, 0x9c, 0x08, 0x88, 0xcb, 0xd9, 0xf8, 0xba, 0x00, 0xd6, 0xc3, 0xdf, 0xef, 0x7a, 0x44, 0x7e, 0x25, 0x69, 0xc9, 0xc1, 0x46, 0xe5, 0x20, 0x9e, 0xcc, 0x0b, 0x05, 0x3e, 0xf4, 0x78, 0x43, 0x0c, 0xa6, 0x2f, 0xc1, 0xfa, 0x70, 0xb2, 0x3c, 0x31, 0x7a, 0x63, 0x58, 0xab, 0x17, 0xcf, 0x4c, 0x4f, - /* (2^225)P */ 0x2b, 0x08, 0x31, 0x59, 0x75, 0x8b, 0xec, 0x0a, 0xa9, 0x79, 0x70, 0xdd, 0xf1, 0x11, 0xc3, 0x11, 0x1f, 0xab, 0x37, 0xaa, 0x26, 0xea, 0x53, 0xc4, 0x79, 0xa7, 0x91, 0x00, 0xaa, 0x08, 0x42, 0xeb, 0x8b, 0x8b, 0xe8, 0xc3, 0x2f, 0xb8, 0x78, 0x90, 0x38, 0x0e, 0x8a, 0x42, 0x0c, 0x0f, 0xbf, 0x3e, 0xf8, 0xd8, 0x07, 0xcf, 0x6a, 0x34, 0xc9, 0xfa, - /* (2^226)P */ 0x11, 0xe0, 0x76, 0x4d, 0x23, 0xc5, 0xa6, 0xcc, 0x9f, 0x9a, 0x2a, 0xde, 0x3a, 0xb5, 0x92, 0x39, 0x19, 0x8a, 0xf1, 0x8d, 0xf9, 0x4d, 0xc9, 0xb4, 0x39, 0x9f, 0x57, 0xd8, 0x72, 0xab, 0x1d, 0x61, 0x6a, 0xb2, 0xff, 0x52, 0xba, 0x54, 0x0e, 0xfb, 0x83, 0x30, 0x8a, 0xf7, 0x3b, 0xf4, 0xd8, 0xae, 0x1a, 0x94, 0x3a, 0xec, 0x63, 0xfe, 0x6e, 0x7c, - /* (2^227)P */ 0xdc, 0x70, 0x8e, 0x55, 0x44, 0xbf, 0xd2, 0x6a, 0xa0, 0x14, 0x61, 0x89, 0xd5, 0x55, 0x45, 0x3c, 0xf6, 0x40, 0x0d, 0x83, 0x85, 0x44, 0xb4, 0x62, 0x56, 0xfe, 0x60, 0xd7, 0x07, 0x1d, 0x47, 0x30, 0x3b, 0x73, 0xa4, 0xb5, 0xb7, 0xea, 0xac, 0xda, 0xf1, 0x17, 0xaa, 0x60, 0xdf, 0xe9, 0x84, 0xda, 0x31, 0x32, 0x61, 0xbf, 0xd0, 0x7e, 0x8a, 0x02, - /* (2^228)P */ 0xb9, 0x51, 0xb3, 0x89, 0x21, 0x5d, 0xa2, 0xfe, 0x79, 0x2a, 0xb3, 0x2a, 0x3b, 0xe6, 0x6f, 0x2b, 0x22, 0x03, 0xea, 0x7b, 0x1f, 0xaf, 0x85, 0xc3, 0x38, 0x55, 0x5b, 0x8e, 0xb4, 0xaa, 0x77, 0xfe, 0x03, 0x6e, 0xda, 0x91, 0x24, 0x0c, 0x48, 0x39, 0x27, 0x43, 0x16, 0xd2, 0x0a, 0x0d, 0x43, 0xa3, 0x0e, 0xca, 0x45, 0xd1, 0x7f, 0xf5, 0xd3, 0x16, - /* (2^229)P */ 0x3d, 0x32, 0x9b, 0x38, 0xf8, 0x06, 0x93, 0x78, 0x5b, 0x50, 0x2b, 0x06, 0xd8, 0x66, 0xfe, 0xab, 0x9b, 0x58, 0xc7, 0xd1, 0x4d, 0xd5, 0xf8, 0x3b, 0x10, 0x7e, 0x85, 0xde, 0x58, 0x4e, 0xdf, 0x53, 0xd9, 0x58, 0xe0, 0x15, 0x81, 0x9f, 0x1a, 0x78, 0xfc, 0x9f, 0x10, 0xc2, 0x23, 0xd6, 0x78, 0xd1, 0x9d, 0xd2, 0xd5, 0x1c, 0x53, 0xe2, 0xc9, 0x76, - /* (2^230)P */ 0x98, 0x1e, 0x38, 0x7b, 0x71, 0x18, 0x4b, 0x15, 0xaf, 0xa1, 0xa6, 0x98, 0xcb, 0x26, 0xa3, 0xc8, 0x07, 0x46, 0xda, 0x3b, 0x70, 0x65, 0xec, 0x7a, 0x2b, 0x34, 0x94, 0xa8, 0xb6, 0x14, 0xf8, 0x1a, 0xce, 0xf7, 0xc8, 0x60, 0xf3, 0x88, 0xf4, 0x33, 0x60, 0x7b, 0xd1, 0x02, 0xe7, 0xda, 0x00, 0x4a, 0xea, 0xd2, 0xfd, 0x88, 0xd2, 0x99, 0x28, 0xf3, - /* (2^231)P */ 0x28, 0x24, 0x1d, 0x26, 0xc2, 0xeb, 0x8b, 0x3b, 0xb4, 0x6b, 0xbe, 0x6b, 0x77, 0xff, 0xf3, 0x21, 0x3b, 0x26, 0x6a, 0x8c, 0x8e, 0x2a, 0x44, 0xa8, 0x01, 0x2b, 0x71, 0xea, 0x64, 0x30, 0xfd, 0xfd, 0x95, 0xcb, 0x39, 0x38, 0x48, 0xfa, 0x96, 0x97, 0x8c, 0x2f, 0x33, 0xca, 0x03, 0xe6, 0xd7, 0x94, 0x55, 0x6c, 0xc3, 0xb3, 0xa8, 0xf7, 0xae, 0x8c, - /* (2^232)P */ 0xea, 0x62, 0x8a, 0xb4, 0xeb, 0x74, 0xf7, 0xb8, 0xae, 0xc5, 0x20, 0x71, 0x06, 0xd6, 0x7c, 0x62, 0x9b, 0x69, 0x74, 0xef, 0xa7, 0x6d, 0xd6, 0x8c, 0x37, 0xb9, 0xbf, 0xcf, 0xeb, 0xe4, 0x2f, 0x04, 0x02, 0x21, 0x7d, 0x75, 0x6b, 0x92, 0x48, 0xf8, 0x70, 0xad, 0x69, 0xe2, 0xea, 0x0e, 0x88, 0x67, 0x72, 0xcc, 0x2d, 0x10, 0xce, 0x2d, 0xcf, 0x65, - /* (2^233)P */ 0x49, 0xf3, 0x57, 0x64, 0xe5, 0x5c, 0xc5, 0x65, 0x49, 0x97, 0xc4, 0x8a, 0xcc, 0xa9, 0xca, 0x94, 0x7b, 0x86, 0x88, 0xb6, 0x51, 0x27, 0x69, 0xa5, 0x0f, 0x8b, 0x06, 0x59, 0xa0, 0x94, 0xef, 0x63, 0x1a, 0x01, 0x9e, 0x4f, 0xd2, 0x5a, 0x93, 0xc0, 0x7c, 0xe6, 0x61, 0x77, 0xb6, 0xf5, 0x40, 0xd9, 0x98, 0x43, 0x5b, 0x56, 0x68, 0xe9, 0x37, 0x8f, - /* (2^234)P */ 0xee, 0x87, 0xd2, 0x05, 0x1b, 0x39, 0x89, 0x10, 0x07, 0x6d, 0xe8, 0xfd, 0x8b, 0x4d, 0xb2, 0xa7, 0x7b, 0x1e, 0xa0, 0x6c, 0x0d, 0x3d, 0x3d, 0x49, 0xba, 0x61, 0x36, 0x1f, 0xc2, 0x84, 0x4a, 0xcc, 0x87, 0xa9, 0x1b, 0x23, 0x04, 0xe2, 0x3e, 0x97, 0xe1, 0xdb, 0xd5, 0x5a, 0xe8, 0x41, 0x6b, 0xe5, 0x5a, 0xa1, 0x99, 0xe5, 0x7b, 0xa7, 0xe0, 0x3b, - /* (2^235)P */ 0xea, 0xa3, 0x6a, 0xdd, 0x77, 0x7f, 0x77, 0x41, 0xc5, 0x6a, 0xe4, 0xaf, 0x11, 0x5f, 0x88, 0xa5, 0x10, 0xee, 0xd0, 0x8c, 0x0c, 0xb4, 0xa5, 0x2a, 0xd0, 0xd8, 0x1d, 0x47, 0x06, 0xc0, 0xd5, 0xce, 0x51, 0x54, 0x9b, 0x2b, 0xe6, 0x2f, 0xe7, 0xe7, 0x31, 0x5f, 0x5c, 0x23, 0x81, 0x3e, 0x03, 0x93, 0xaa, 0x2d, 0x71, 0x84, 0xa0, 0x89, 0x32, 0xa6, - /* (2^236)P */ 0x55, 0xa3, 0x13, 0x92, 0x4e, 0x93, 0x7d, 0xec, 0xca, 0x57, 0xfb, 0x37, 0xae, 0xd2, 0x18, 0x2e, 0x54, 0x05, 0x6c, 0xd1, 0x28, 0xca, 0x90, 0x40, 0x82, 0x2e, 0x79, 0xc6, 0x5a, 0xc7, 0xdd, 0x84, 0x93, 0xdf, 0x15, 0xb8, 0x1f, 0xb1, 0xf9, 0xaf, 0x2c, 0xe5, 0x32, 0xcd, 0xc2, 0x99, 0x6d, 0xac, 0x85, 0x5c, 0x63, 0xd3, 0xe2, 0xff, 0x24, 0xda, - /* (2^237)P */ 0x2d, 0x8d, 0xfd, 0x65, 0xcc, 0xe5, 0x02, 0xa0, 0xe5, 0xb9, 0xec, 0x59, 0x09, 0x50, 0x27, 0xb7, 0x3d, 0x2a, 0x79, 0xb2, 0x76, 0x5d, 0x64, 0x95, 0xf8, 0xc5, 0xaf, 0x8a, 0x62, 0x11, 0x5c, 0x56, 0x1c, 0x05, 0x64, 0x9e, 0x5e, 0xbd, 0x54, 0x04, 0xe6, 0x9e, 0xab, 0xe6, 0x22, 0x7e, 0x42, 0x54, 0xb5, 0xa5, 0xd0, 0x8d, 0x28, 0x6b, 0x0f, 0x0b, - /* (2^238)P */ 0x2d, 0xb2, 0x8c, 0x59, 0x10, 0x37, 0x84, 0x3b, 0x9b, 0x65, 0x1b, 0x0f, 0x10, 0xf9, 0xea, 0x60, 0x1b, 0x02, 0xf5, 0xee, 0x8b, 0xe6, 0x32, 0x7d, 0x10, 0x7f, 0x5f, 0x8c, 0x72, 0x09, 0x4e, 0x1f, 0x29, 0xff, 0x65, 0xcb, 0x3e, 0x3a, 0xd2, 0x96, 0x50, 0x1e, 0xea, 0x64, 0x99, 0xb5, 0x4c, 0x7a, 0x69, 0xb8, 0x95, 0xae, 0x48, 0xc0, 0x7c, 0xb1, - /* (2^239)P */ 0xcd, 0x7c, 0x4f, 0x3e, 0xea, 0xf3, 0x90, 0xcb, 0x12, 0x76, 0xd1, 0x17, 0xdc, 0x0d, 0x13, 0x0f, 0xfd, 0x4d, 0xb5, 0x1f, 0xe4, 0xdd, 0xf2, 0x4d, 0x58, 0xea, 0xa5, 0x66, 0x92, 0xcf, 0xe5, 0x54, 0xea, 0x9b, 0x35, 0x83, 0x1a, 0x44, 0x8e, 0x62, 0x73, 0x45, 0x98, 0xa3, 0x89, 0x95, 0x52, 0x93, 0x1a, 0x8d, 0x63, 0x0f, 0xc2, 0x57, 0x3c, 0xb1, - /* (2^240)P */ 0x72, 0xb4, 0xdf, 0x51, 0xb7, 0xf6, 0x52, 0xa2, 0x14, 0x56, 0xe5, 0x0a, 0x2e, 0x75, 0x81, 0x02, 0xee, 0x93, 0x48, 0x0a, 0x92, 0x4e, 0x0c, 0x0f, 0xdf, 0x09, 0x89, 0x99, 0xf6, 0xf9, 0x22, 0xa2, 0x32, 0xf8, 0xb0, 0x76, 0x0c, 0xb2, 0x4d, 0x6e, 0xbe, 0x83, 0x35, 0x61, 0x44, 0xd2, 0x58, 0xc7, 0xdd, 0x14, 0xcf, 0xc3, 0x4b, 0x7c, 0x07, 0xee, - /* (2^241)P */ 0x8b, 0x03, 0xee, 0xcb, 0xa7, 0x2e, 0x28, 0xbd, 0x97, 0xd1, 0x4c, 0x2b, 0xd1, 0x92, 0x67, 0x5b, 0x5a, 0x12, 0xbf, 0x29, 0x17, 0xfc, 0x50, 0x09, 0x74, 0x76, 0xa2, 0xd4, 0x82, 0xfd, 0x2c, 0x0c, 0x90, 0xf7, 0xe7, 0xe5, 0x9a, 0x2c, 0x16, 0x40, 0xb9, 0x6c, 0xd9, 0xe0, 0x22, 0x9e, 0xf8, 0xdd, 0x73, 0xe4, 0x7b, 0x9e, 0xbe, 0x4f, 0x66, 0x22, - /* (2^242)P */ 0xa4, 0x10, 0xbe, 0xb8, 0x83, 0x3a, 0x77, 0x8e, 0xea, 0x0a, 0xc4, 0x97, 0x3e, 0xb6, 0x6c, 0x81, 0xd7, 0x65, 0xd9, 0xf7, 0xae, 0xe6, 0xbe, 0xab, 0x59, 0x81, 0x29, 0x4b, 0xff, 0xe1, 0x0f, 0xc3, 0x2b, 0xad, 0x4b, 0xef, 0xc4, 0x50, 0x9f, 0x88, 0x31, 0xf2, 0xde, 0x80, 0xd6, 0xf4, 0x20, 0x9c, 0x77, 0x9b, 0xbe, 0xbe, 0x08, 0xf5, 0xf0, 0x95, - /* (2^243)P */ 0x0e, 0x7c, 0x7b, 0x7c, 0xb3, 0xd8, 0x83, 0xfc, 0x8c, 0x75, 0x51, 0x74, 0x1b, 0xe1, 0x6d, 0x11, 0x05, 0x46, 0x24, 0x0d, 0xa4, 0x2b, 0x32, 0xfd, 0x2c, 0x4e, 0x21, 0xdf, 0x39, 0x6b, 0x96, 0xfc, 0xff, 0x92, 0xfc, 0x35, 0x0d, 0x9a, 0x4b, 0xc0, 0x70, 0x46, 0x32, 0x7d, 0xc0, 0xc4, 0x04, 0xe0, 0x2d, 0x83, 0xa7, 0x00, 0xc7, 0xcb, 0xb4, 0x8f, - /* (2^244)P */ 0xa9, 0x5a, 0x7f, 0x0e, 0xdd, 0x2c, 0x85, 0xaa, 0x4d, 0xac, 0xde, 0xb3, 0xb6, 0xaf, 0xe6, 0xd1, 0x06, 0x7b, 0x2c, 0xa4, 0x01, 0x19, 0x22, 0x7d, 0x78, 0xf0, 0x3a, 0xea, 0x89, 0xfe, 0x21, 0x61, 0x6d, 0xb8, 0xfe, 0xa5, 0x2a, 0xab, 0x0d, 0x7b, 0x51, 0x39, 0xb6, 0xde, 0xbc, 0xf0, 0xc5, 0x48, 0xd7, 0x09, 0x82, 0x6e, 0x66, 0x75, 0xc5, 0xcd, - /* (2^245)P */ 0xee, 0xdf, 0x2b, 0x6c, 0xa8, 0xde, 0x61, 0xe1, 0x27, 0xfa, 0x2a, 0x0f, 0x68, 0xe7, 0x7a, 0x9b, 0x13, 0xe9, 0x56, 0xd2, 0x1c, 0x3d, 0x2f, 0x3c, 0x7a, 0xf6, 0x6f, 0x45, 0xee, 0xe8, 0xf4, 0xa0, 0xa6, 0xe8, 0xa5, 0x27, 0xee, 0xf2, 0x85, 0xa9, 0xd5, 0x0e, 0xa9, 0x26, 0x60, 0xfe, 0xee, 0xc7, 0x59, 0x99, 0x5e, 0xa3, 0xdf, 0x23, 0x36, 0xd5, - /* (2^246)P */ 0x15, 0x66, 0x6f, 0xd5, 0x78, 0xa4, 0x0a, 0xf7, 0xb1, 0xe8, 0x75, 0x6b, 0x48, 0x7d, 0xa6, 0x4d, 0x3d, 0x36, 0x9b, 0xc7, 0xcc, 0x68, 0x9a, 0xfe, 0x2f, 0x39, 0x2a, 0x51, 0x31, 0x39, 0x7d, 0x73, 0x6f, 0xc8, 0x74, 0x72, 0x6f, 0x6e, 0xda, 0x5f, 0xad, 0x48, 0xc8, 0x40, 0xe1, 0x06, 0x01, 0x36, 0xa1, 0x88, 0xc8, 0x99, 0x9c, 0xd1, 0x11, 0x8f, - /* (2^247)P */ 0xab, 0xc5, 0xcb, 0xcf, 0xbd, 0x73, 0x21, 0xd0, 0x82, 0xb1, 0x2e, 0x2d, 0xd4, 0x36, 0x1b, 0xed, 0xa9, 0x8a, 0x26, 0x79, 0xc4, 0x17, 0xae, 0xe5, 0x09, 0x0a, 0x0c, 0xa4, 0x21, 0xa0, 0x6e, 0xdd, 0x62, 0x8e, 0x44, 0x62, 0xcc, 0x50, 0xff, 0x93, 0xb3, 0x9a, 0x72, 0x8c, 0x3f, 0xa1, 0xa6, 0x4d, 0x87, 0xd5, 0x1c, 0x5a, 0xc0, 0x0b, 0x1a, 0xd6, - /* (2^248)P */ 0x67, 0x36, 0x6a, 0x1f, 0x96, 0xe5, 0x80, 0x20, 0xa9, 0xe8, 0x0b, 0x0e, 0x21, 0x29, 0x3f, 0xc8, 0x0a, 0x6d, 0x27, 0x47, 0xca, 0xd9, 0x05, 0x55, 0xbf, 0x11, 0xcf, 0x31, 0x7a, 0x37, 0xc7, 0x90, 0xa9, 0xf4, 0x07, 0x5e, 0xd5, 0xc3, 0x92, 0xaa, 0x95, 0xc8, 0x23, 0x2a, 0x53, 0x45, 0xe3, 0x3a, 0x24, 0xe9, 0x67, 0x97, 0x3a, 0x82, 0xf9, 0xa6, - /* (2^249)P */ 0x92, 0x9e, 0x6d, 0x82, 0x67, 0xe9, 0xf9, 0x17, 0x96, 0x2c, 0xa7, 0xd3, 0x89, 0xf9, 0xdb, 0xd8, 0x20, 0xc6, 0x2e, 0xec, 0x4a, 0x76, 0x64, 0xbf, 0x27, 0x40, 0xe2, 0xb4, 0xdf, 0x1f, 0xa0, 0xef, 0x07, 0x80, 0xfb, 0x8e, 0x12, 0xf8, 0xb8, 0xe1, 0xc6, 0xdf, 0x7c, 0x69, 0x35, 0x5a, 0xe1, 0x8e, 0x5d, 0x69, 0x84, 0x56, 0xb6, 0x31, 0x1c, 0x0b, - /* (2^250)P */ 0xd6, 0x94, 0x5c, 0xef, 0xbb, 0x46, 0x45, 0x44, 0x5b, 0xa1, 0xae, 0x03, 0x65, 0xdd, 0xb5, 0x66, 0x88, 0x35, 0x29, 0x95, 0x16, 0x54, 0xa6, 0xf5, 0xc9, 0x78, 0x34, 0xe6, 0x0f, 0xc4, 0x2b, 0x5b, 0x79, 0x51, 0x68, 0x48, 0x3a, 0x26, 0x87, 0x05, 0x70, 0xaf, 0x8b, 0xa6, 0xc7, 0x2e, 0xb3, 0xa9, 0x10, 0x01, 0xb0, 0xb9, 0x31, 0xfd, 0xdc, 0x80, - /* (2^251)P */ 0x25, 0xf2, 0xad, 0xd6, 0x75, 0xa3, 0x04, 0x05, 0x64, 0x8a, 0x97, 0x60, 0x27, 0x2a, 0xe5, 0x6d, 0xb0, 0x73, 0xf4, 0x07, 0x2a, 0x9d, 0xe9, 0x46, 0xb4, 0x1c, 0x51, 0xf8, 0x63, 0x98, 0x7e, 0xe5, 0x13, 0x51, 0xed, 0x98, 0x65, 0x98, 0x4f, 0x8f, 0xe7, 0x7e, 0x72, 0xd7, 0x64, 0x11, 0x2f, 0xcd, 0x12, 0xf8, 0xc4, 0x63, 0x52, 0x0f, 0x7f, 0xc4, - /* (2^252)P */ 0x5c, 0xd9, 0x85, 0x63, 0xc7, 0x8a, 0x65, 0x9a, 0x25, 0x83, 0x31, 0x73, 0x49, 0xf0, 0x93, 0x96, 0x70, 0x67, 0x6d, 0xb1, 0xff, 0x95, 0x54, 0xe4, 0xf8, 0x15, 0x6c, 0x5f, 0xbd, 0xf6, 0x0f, 0x38, 0x7b, 0x68, 0x7d, 0xd9, 0x3d, 0xf0, 0xa9, 0xa0, 0xe4, 0xd1, 0xb6, 0x34, 0x6d, 0x14, 0x16, 0xc2, 0x4c, 0x30, 0x0e, 0x67, 0xd3, 0xbe, 0x2e, 0xc0, - /* (2^253)P */ 0x06, 0x6b, 0x52, 0xc8, 0x14, 0xcd, 0xae, 0x03, 0x93, 0xea, 0xc1, 0xf2, 0xf6, 0x8b, 0xc5, 0xb6, 0xdc, 0x82, 0x42, 0x29, 0x94, 0xe0, 0x25, 0x6c, 0x3f, 0x9f, 0x5d, 0xe4, 0x96, 0xf6, 0x8e, 0x3f, 0xf9, 0x72, 0xc4, 0x77, 0x60, 0x8b, 0xa4, 0xf9, 0xa8, 0xc3, 0x0a, 0x81, 0xb1, 0x97, 0x70, 0x18, 0xab, 0xea, 0x37, 0x8a, 0x08, 0xc7, 0xe2, 0x95, - /* (2^254)P */ 0x94, 0x49, 0xd9, 0x5f, 0x76, 0x72, 0x82, 0xad, 0x2d, 0x50, 0x1a, 0x7a, 0x5b, 0xe6, 0x95, 0x1e, 0x95, 0x65, 0x87, 0x1c, 0x52, 0xd7, 0x44, 0xe6, 0x9b, 0x56, 0xcd, 0x6f, 0x05, 0xff, 0x67, 0xc5, 0xdb, 0xa2, 0xac, 0xe4, 0xa2, 0x28, 0x63, 0x5f, 0xfb, 0x0c, 0x3b, 0xf1, 0x87, 0xc3, 0x36, 0x78, 0x3f, 0x77, 0xfa, 0x50, 0x85, 0xf9, 0xd7, 0x82, - /* (2^255)P */ 0x64, 0xc0, 0xe0, 0xd8, 0x2d, 0xed, 0xcb, 0x6a, 0xfd, 0xcd, 0xbc, 0x7e, 0x9f, 0xc8, 0x85, 0xe9, 0xc1, 0x7c, 0x0f, 0xe5, 0x18, 0xea, 0xd4, 0x51, 0xad, 0x59, 0x13, 0x75, 0xd9, 0x3d, 0xd4, 0x8a, 0xb2, 0xbe, 0x78, 0x52, 0x2b, 0x52, 0x94, 0x37, 0x41, 0xd6, 0xb4, 0xb6, 0x45, 0x20, 0x76, 0xe0, 0x1f, 0x31, 0xdb, 0xb1, 0xa1, 0x43, 0xf0, 0x18, - /* (2^256)P */ 0x74, 0xa9, 0xa4, 0xa9, 0xdd, 0x6e, 0x3e, 0x68, 0xe5, 0xc3, 0x2e, 0x92, 0x17, 0xa4, 0xcb, 0x80, 0xb1, 0xf0, 0x06, 0x93, 0xef, 0xe6, 0x00, 0xe6, 0x3b, 0xb1, 0x32, 0x65, 0x7b, 0x83, 0xb6, 0x8a, 0x49, 0x1b, 0x14, 0x89, 0xee, 0xba, 0xf5, 0x6a, 0x8d, 0x36, 0xef, 0xb0, 0xd8, 0xb2, 0x16, 0x99, 0x17, 0x35, 0x02, 0x16, 0x55, 0x58, 0xdd, 0x82, - /* (2^257)P */ 0x36, 0x95, 0xe8, 0xf4, 0x36, 0x42, 0xbb, 0xc5, 0x3e, 0xfa, 0x30, 0x84, 0x9e, 0x59, 0xfd, 0xd2, 0x95, 0x42, 0xf8, 0x64, 0xd9, 0xb9, 0x0e, 0x9f, 0xfa, 0xd0, 0x7b, 0x20, 0x31, 0x77, 0x48, 0x29, 0x4d, 0xd0, 0x32, 0x57, 0x56, 0x30, 0xa6, 0x17, 0x53, 0x04, 0xbf, 0x08, 0x28, 0xec, 0xb8, 0x46, 0xc1, 0x03, 0x89, 0xdc, 0xed, 0xa0, 0x35, 0x53, - /* (2^258)P */ 0xc5, 0x7f, 0x9e, 0xd8, 0xc5, 0xba, 0x5f, 0x68, 0xc8, 0x23, 0x75, 0xea, 0x0d, 0xd9, 0x5a, 0xfd, 0x61, 0x1a, 0xa3, 0x2e, 0x45, 0x63, 0x14, 0x55, 0x86, 0x21, 0x29, 0xbe, 0xef, 0x5e, 0x50, 0xe5, 0x18, 0x59, 0xe7, 0xe3, 0xce, 0x4d, 0x8c, 0x15, 0x8f, 0x89, 0x66, 0x44, 0x52, 0x3d, 0xfa, 0xc7, 0x9a, 0x59, 0x90, 0x8e, 0xc0, 0x06, 0x3f, 0xc9, - /* (2^259)P */ 0x8e, 0x04, 0xd9, 0x16, 0x50, 0x1d, 0x8c, 0x9f, 0xd5, 0xe3, 0xce, 0xfd, 0x47, 0x04, 0x27, 0x4d, 0xc2, 0xfa, 0x71, 0xd9, 0x0b, 0xb8, 0x65, 0xf4, 0x11, 0xf3, 0x08, 0xee, 0x81, 0xc8, 0x67, 0x99, 0x0b, 0x8d, 0x77, 0xa3, 0x4f, 0xb5, 0x9b, 0xdb, 0x26, 0xf1, 0x97, 0xeb, 0x04, 0x54, 0xeb, 0x80, 0x08, 0x1d, 0x1d, 0xf6, 0x3d, 0x1f, 0x5a, 0xb8, - /* (2^260)P */ 0xb7, 0x9c, 0x9d, 0xee, 0xb9, 0x5c, 0xad, 0x0d, 0x9e, 0xfd, 0x60, 0x3c, 0x27, 0x4e, 0xa2, 0x95, 0xfb, 0x64, 0x7e, 0x79, 0x64, 0x87, 0x10, 0xb4, 0x73, 0xe0, 0x9d, 0x46, 0x4d, 0x3d, 0xee, 0x83, 0xe4, 0x16, 0x88, 0x97, 0xe6, 0x4d, 0xba, 0x70, 0xb6, 0x96, 0x7b, 0xff, 0x4b, 0xc8, 0xcf, 0x72, 0x83, 0x3e, 0x5b, 0x24, 0x2e, 0x57, 0xf1, 0x82, - /* (2^261)P */ 0x30, 0x71, 0x40, 0x51, 0x4f, 0x44, 0xbb, 0xc7, 0xf0, 0x54, 0x6e, 0x9d, 0xeb, 0x15, 0xad, 0xf8, 0x61, 0x43, 0x5a, 0xef, 0xc0, 0xb1, 0x57, 0xae, 0x03, 0x40, 0xe8, 0x68, 0x6f, 0x03, 0x20, 0x4f, 0x8a, 0x51, 0x2a, 0x9e, 0xd2, 0x45, 0xaf, 0xb4, 0xf5, 0xd4, 0x95, 0x7f, 0x3d, 0x3d, 0xb7, 0xb6, 0x28, 0xc5, 0x08, 0x8b, 0x44, 0xd6, 0x3f, 0xe7, - /* (2^262)P */ 0xa9, 0x52, 0x04, 0x67, 0xcb, 0x20, 0x63, 0xf8, 0x18, 0x01, 0x44, 0x21, 0x6a, 0x8a, 0x83, 0x48, 0xd4, 0xaf, 0x23, 0x0f, 0x35, 0x8d, 0xe5, 0x5a, 0xc4, 0x7c, 0x55, 0x46, 0x19, 0x5f, 0x35, 0xe0, 0x5d, 0x97, 0x4c, 0x2d, 0x04, 0xed, 0x59, 0xd4, 0xb0, 0xb2, 0xc6, 0xe3, 0x51, 0xe1, 0x38, 0xc6, 0x30, 0x49, 0x8f, 0xae, 0x61, 0x64, 0xce, 0xa8, - /* (2^263)P */ 0x9b, 0x64, 0x83, 0x3c, 0xd3, 0xdf, 0xb9, 0x27, 0xe7, 0x5b, 0x7f, 0xeb, 0xf3, 0x26, 0xcf, 0xb1, 0x8f, 0xaf, 0x26, 0xc8, 0x48, 0xce, 0xa1, 0xac, 0x7d, 0x10, 0x34, 0x28, 0xe1, 0x1f, 0x69, 0x03, 0x64, 0x77, 0x61, 0xdd, 0x4a, 0x9b, 0x18, 0x47, 0xf8, 0xca, 0x63, 0xc9, 0x03, 0x2d, 0x20, 0x2a, 0x69, 0x6e, 0x42, 0xd0, 0xe7, 0xaa, 0xb5, 0xf3, - /* (2^264)P */ 0xea, 0x31, 0x0c, 0x57, 0x0f, 0x3e, 0xe3, 0x35, 0xd8, 0x30, 0xa5, 0x6f, 0xdd, 0x95, 0x43, 0xc6, 0x66, 0x07, 0x4f, 0x34, 0xc3, 0x7e, 0x04, 0x10, 0x2d, 0xc4, 0x1c, 0x94, 0x52, 0x2e, 0x5b, 0x9a, 0x65, 0x2f, 0x91, 0xaa, 0x4f, 0x3c, 0xdc, 0x23, 0x18, 0xe1, 0x4f, 0x85, 0xcd, 0xf4, 0x8c, 0x51, 0xf7, 0xab, 0x4f, 0xdc, 0x15, 0x5c, 0x9e, 0xc5, - /* (2^265)P */ 0x54, 0x57, 0x23, 0x17, 0xe7, 0x82, 0x2f, 0x04, 0x7d, 0xfe, 0xe7, 0x1f, 0xa2, 0x57, 0x79, 0xe9, 0x58, 0x9b, 0xbe, 0xc6, 0x16, 0x4a, 0x17, 0x50, 0x90, 0x4a, 0x34, 0x70, 0x87, 0x37, 0x01, 0x26, 0xd8, 0xa3, 0x5f, 0x07, 0x7c, 0xd0, 0x7d, 0x05, 0x8a, 0x93, 0x51, 0x2f, 0x99, 0xea, 0xcf, 0x00, 0xd8, 0xc7, 0xe6, 0x9b, 0x8c, 0x62, 0x45, 0x87, - /* (2^266)P */ 0xc3, 0xfd, 0x29, 0x66, 0xe7, 0x30, 0x29, 0x77, 0xe0, 0x0d, 0x63, 0x5b, 0xe6, 0x90, 0x1a, 0x1e, 0x99, 0xc2, 0xa7, 0xab, 0xff, 0xa7, 0xbd, 0x79, 0x01, 0x97, 0xfd, 0x27, 0x1b, 0x43, 0x2b, 0xe6, 0xfe, 0x5e, 0xf1, 0xb9, 0x35, 0x38, 0x08, 0x25, 0x55, 0x90, 0x68, 0x2e, 0xc3, 0x67, 0x39, 0x9f, 0x2b, 0x2c, 0x70, 0x48, 0x8c, 0x47, 0xee, 0x56, - /* (2^267)P */ 0xf7, 0x32, 0x70, 0xb5, 0xe6, 0x42, 0xfd, 0x0a, 0x39, 0x9b, 0x07, 0xfe, 0x0e, 0xf4, 0x47, 0xba, 0x6a, 0x3f, 0xf5, 0x2c, 0x15, 0xf3, 0x60, 0x3f, 0xb1, 0x83, 0x7b, 0x2e, 0x34, 0x58, 0x1a, 0x6e, 0x4a, 0x49, 0x05, 0x45, 0xca, 0xdb, 0x00, 0x01, 0x0c, 0x42, 0x5e, 0x60, 0x40, 0x5f, 0xd9, 0xc7, 0x3a, 0x9e, 0x1c, 0x8d, 0xab, 0x11, 0x55, 0x65, - /* (2^268)P */ 0x87, 0x40, 0xb7, 0x0d, 0xaa, 0x34, 0x89, 0x90, 0x75, 0x6d, 0xa2, 0xfe, 0x3b, 0x6d, 0x5c, 0x39, 0x98, 0x10, 0x9e, 0x15, 0xc5, 0x35, 0xa2, 0x27, 0x23, 0x0a, 0x2d, 0x60, 0xe2, 0xa8, 0x7f, 0x3e, 0x77, 0x8f, 0xcc, 0x44, 0xcc, 0x30, 0x28, 0xe2, 0xf0, 0x04, 0x8c, 0xee, 0xe4, 0x5f, 0x68, 0x8c, 0xdf, 0x70, 0xbf, 0x31, 0xee, 0x2a, 0xfc, 0xce, - /* (2^269)P */ 0x92, 0xf2, 0xa0, 0xd9, 0x58, 0x3b, 0x7c, 0x1a, 0x99, 0x46, 0x59, 0x54, 0x60, 0x06, 0x8d, 0x5e, 0xf0, 0x22, 0xa1, 0xed, 0x92, 0x8a, 0x4d, 0x76, 0x95, 0x05, 0x0b, 0xff, 0xfc, 0x9a, 0xd1, 0xcc, 0x05, 0xb9, 0x5e, 0x99, 0xe8, 0x2a, 0x76, 0x7b, 0xfd, 0xa6, 0xe2, 0xd1, 0x1a, 0xd6, 0x76, 0x9f, 0x2f, 0x0e, 0xd1, 0xa8, 0x77, 0x5a, 0x40, 0x5a, - /* (2^270)P */ 0xff, 0xf9, 0x3f, 0xa9, 0xa6, 0x6c, 0x6d, 0x03, 0x8b, 0xa7, 0x10, 0x5d, 0x3f, 0xec, 0x3e, 0x1c, 0x0b, 0x6b, 0xa2, 0x6a, 0x22, 0xa9, 0x28, 0xd0, 0x66, 0xc9, 0xc2, 0x3d, 0x47, 0x20, 0x7d, 0xa6, 0x1d, 0xd8, 0x25, 0xb5, 0xf2, 0xf9, 0x70, 0x19, 0x6b, 0xf8, 0x43, 0x36, 0xc5, 0x1f, 0xe4, 0x5a, 0x4c, 0x13, 0xe4, 0x6d, 0x08, 0x0b, 0x1d, 0xb1, - /* (2^271)P */ 0x3f, 0x20, 0x9b, 0xfb, 0xec, 0x7d, 0x31, 0xc5, 0xfc, 0x88, 0x0b, 0x30, 0xed, 0x36, 0xc0, 0x63, 0xb1, 0x7d, 0x10, 0xda, 0xb6, 0x2e, 0xad, 0xf3, 0xec, 0x94, 0xe7, 0xec, 0xb5, 0x9c, 0xfe, 0xf5, 0x35, 0xf0, 0xa2, 0x2d, 0x7f, 0xca, 0x6b, 0x67, 0x1a, 0xf6, 0xb3, 0xda, 0x09, 0x2a, 0xaa, 0xdf, 0xb1, 0xca, 0x9b, 0xfb, 0xeb, 0xb3, 0xcd, 0xc0, - /* (2^272)P */ 0xcd, 0x4d, 0x89, 0x00, 0xa4, 0x3b, 0x48, 0xf0, 0x76, 0x91, 0x35, 0xa5, 0xf8, 0xc9, 0xb6, 0x46, 0xbc, 0xf6, 0x9a, 0x45, 0x47, 0x17, 0x96, 0x80, 0x5b, 0x3a, 0x28, 0x33, 0xf9, 0x5a, 0xef, 0x43, 0x07, 0xfe, 0x3b, 0xf4, 0x8e, 0x19, 0xce, 0xd2, 0x94, 0x4b, 0x6d, 0x8e, 0x67, 0x20, 0xc7, 0x4f, 0x2f, 0x59, 0x8e, 0xe1, 0xa1, 0xa9, 0xf9, 0x0e, - /* (2^273)P */ 0xdc, 0x7b, 0xb5, 0x50, 0x2e, 0xe9, 0x7e, 0x8b, 0x78, 0xa1, 0x38, 0x96, 0x22, 0xc3, 0x61, 0x67, 0x6d, 0xc8, 0x58, 0xed, 0x41, 0x1d, 0x5d, 0x86, 0x98, 0x7f, 0x2f, 0x1b, 0x8d, 0x3e, 0xaa, 0xc1, 0xd2, 0x0a, 0xf3, 0xbf, 0x95, 0x04, 0xf3, 0x10, 0x3c, 0x2b, 0x7f, 0x90, 0x46, 0x04, 0xaa, 0x6a, 0xa9, 0x35, 0x76, 0xac, 0x49, 0xb5, 0x00, 0x45, - /* (2^274)P */ 0xb1, 0x93, 0x79, 0x84, 0x4a, 0x2a, 0x30, 0x78, 0x16, 0xaa, 0xc5, 0x74, 0x06, 0xce, 0xa5, 0xa7, 0x32, 0x86, 0xe0, 0xf9, 0x10, 0xd2, 0x58, 0x76, 0xfb, 0x66, 0x49, 0x76, 0x3a, 0x90, 0xba, 0xb5, 0xcc, 0x99, 0xcd, 0x09, 0xc1, 0x9a, 0x74, 0x23, 0xdf, 0x0c, 0xfe, 0x99, 0x52, 0x80, 0xa3, 0x7c, 0x1c, 0x71, 0x5f, 0x2c, 0x49, 0x57, 0xf4, 0xf9, - /* (2^275)P */ 0x6d, 0xbf, 0x52, 0xe6, 0x25, 0x98, 0xed, 0xcf, 0xe3, 0xbc, 0x08, 0xa2, 0x1a, 0x90, 0xae, 0xa0, 0xbf, 0x07, 0x15, 0xad, 0x0a, 0x9f, 0x3e, 0x47, 0x44, 0xc2, 0x10, 0x46, 0xa6, 0x7a, 0x9e, 0x2f, 0x57, 0xbc, 0xe2, 0xf0, 0x1d, 0xd6, 0x9a, 0x06, 0xed, 0xfc, 0x54, 0x95, 0x92, 0x15, 0xa2, 0xf7, 0x8d, 0x6b, 0xef, 0xb2, 0x05, 0xed, 0x5c, 0x63, - /* (2^276)P */ 0xbc, 0x0b, 0x27, 0x3a, 0x3a, 0xf8, 0xe1, 0x48, 0x02, 0x7e, 0x27, 0xe6, 0x81, 0x62, 0x07, 0x73, 0x74, 0xe5, 0x52, 0xd7, 0xf8, 0x26, 0xca, 0x93, 0x4d, 0x3e, 0x9b, 0x55, 0x09, 0x8e, 0xe3, 0xd7, 0xa6, 0xe3, 0xb6, 0x2a, 0xa9, 0xb3, 0xb0, 0xa0, 0x8c, 0x01, 0xbb, 0x07, 0x90, 0x78, 0x6d, 0x6d, 0xe9, 0xf0, 0x7a, 0x90, 0xbd, 0xdc, 0x0c, 0x36, - /* (2^277)P */ 0x7f, 0x20, 0x12, 0x0f, 0x40, 0x00, 0x53, 0xd8, 0x0c, 0x27, 0x47, 0x47, 0x22, 0x80, 0xfb, 0x62, 0xe4, 0xa7, 0xf7, 0xbd, 0x42, 0xa5, 0xc3, 0x2b, 0xb2, 0x7f, 0x50, 0xcc, 0xe2, 0xfb, 0xd5, 0xc0, 0x63, 0xdd, 0x24, 0x5f, 0x7c, 0x08, 0x91, 0xbf, 0x6e, 0x47, 0x44, 0xd4, 0x6a, 0xc0, 0xc3, 0x09, 0x39, 0x27, 0xdd, 0xc7, 0xca, 0x06, 0x29, 0x55, - /* (2^278)P */ 0x76, 0x28, 0x58, 0xb0, 0xd2, 0xf3, 0x0f, 0x04, 0xe9, 0xc9, 0xab, 0x66, 0x5b, 0x75, 0x51, 0xdc, 0xe5, 0x8f, 0xe8, 0x1f, 0xdb, 0x03, 0x0f, 0xb0, 0x7d, 0xf9, 0x20, 0x64, 0x89, 0xe9, 0xdc, 0xe6, 0x24, 0xc3, 0xd5, 0xd2, 0x41, 0xa6, 0xe4, 0xe3, 0xc4, 0x79, 0x7c, 0x0f, 0xa1, 0x61, 0x2f, 0xda, 0xa4, 0xc9, 0xfd, 0xad, 0x5c, 0x65, 0x6a, 0xf3, - /* (2^279)P */ 0xd5, 0xab, 0x72, 0x7a, 0x3b, 0x59, 0xea, 0xcf, 0xd5, 0x17, 0xd2, 0xb2, 0x5f, 0x2d, 0xab, 0xad, 0x9e, 0x88, 0x64, 0x55, 0x96, 0x6e, 0xf3, 0x44, 0xa9, 0x11, 0xf5, 0xf8, 0x3a, 0xf1, 0xcd, 0x79, 0x4c, 0x99, 0x6d, 0x23, 0x6a, 0xa0, 0xc2, 0x1a, 0x19, 0x45, 0xb5, 0xd8, 0x95, 0x2f, 0x49, 0xe9, 0x46, 0x39, 0x26, 0x60, 0x04, 0x15, 0x8b, 0xcc, - /* (2^280)P */ 0x66, 0x0c, 0xf0, 0x54, 0x41, 0x02, 0x91, 0xab, 0xe5, 0x85, 0x8a, 0x44, 0xa6, 0x34, 0x96, 0x32, 0xc0, 0xdf, 0x6c, 0x41, 0x39, 0xd4, 0xc6, 0xe1, 0xe3, 0x81, 0xb0, 0x4c, 0x34, 0x4f, 0xe5, 0xf4, 0x35, 0x46, 0x1f, 0xeb, 0x75, 0xfd, 0x43, 0x37, 0x50, 0x99, 0xab, 0xad, 0xb7, 0x8c, 0xa1, 0x57, 0xcb, 0xe6, 0xce, 0x16, 0x2e, 0x85, 0xcc, 0xf9, - /* (2^281)P */ 0x63, 0xd1, 0x3f, 0x9e, 0xa2, 0x17, 0x2e, 0x1d, 0x3e, 0xce, 0x48, 0x2d, 0xbb, 0x8f, 0x69, 0xc9, 0xa6, 0x3d, 0x4e, 0xfe, 0x09, 0x56, 0xb3, 0x02, 0x5f, 0x99, 0x97, 0x0c, 0x54, 0xda, 0x32, 0x97, 0x9b, 0xf4, 0x95, 0xf1, 0xad, 0xe3, 0x2b, 0x04, 0xa7, 0x9b, 0x3f, 0xbb, 0xe7, 0x87, 0x2e, 0x1f, 0x8b, 0x4b, 0x7a, 0xa4, 0x43, 0x0c, 0x0f, 0x35, - /* (2^282)P */ 0x05, 0xdc, 0xe0, 0x2c, 0xa1, 0xc1, 0xd0, 0xf1, 0x1f, 0x4e, 0xc0, 0x6c, 0x35, 0x7b, 0xca, 0x8f, 0x8b, 0x02, 0xb1, 0xf7, 0xd6, 0x2e, 0xe7, 0x93, 0x80, 0x85, 0x18, 0x88, 0x19, 0xb9, 0xb4, 0x4a, 0xbc, 0xeb, 0x5a, 0x78, 0x38, 0xed, 0xc6, 0x27, 0x2a, 0x74, 0x76, 0xf0, 0x1b, 0x79, 0x92, 0x2f, 0xd2, 0x81, 0x98, 0xdf, 0xa9, 0x50, 0x19, 0xeb, - /* (2^283)P */ 0xb5, 0xe7, 0xb4, 0x11, 0x3a, 0x81, 0xb6, 0xb4, 0xf8, 0xa2, 0xb3, 0x6c, 0xfc, 0x9d, 0xe0, 0xc0, 0xe0, 0x59, 0x7f, 0x05, 0x37, 0xef, 0x2c, 0xa9, 0x3a, 0x24, 0xac, 0x7b, 0x25, 0xa0, 0x55, 0xd2, 0x44, 0x82, 0x82, 0x6e, 0x64, 0xa3, 0x58, 0xc8, 0x67, 0xae, 0x26, 0xa7, 0x0f, 0x42, 0x63, 0xe1, 0x93, 0x01, 0x52, 0x19, 0xaf, 0x49, 0x3e, 0x33, - /* (2^284)P */ 0x05, 0x85, 0xe6, 0x66, 0xaf, 0x5f, 0xdf, 0xbf, 0x9d, 0x24, 0x62, 0x60, 0x90, 0xe2, 0x4c, 0x7d, 0x4e, 0xc3, 0x74, 0x5d, 0x4f, 0x53, 0xf3, 0x63, 0x13, 0xf4, 0x74, 0x28, 0x6b, 0x7d, 0x57, 0x0c, 0x9d, 0x84, 0xa7, 0x1a, 0xff, 0xa0, 0x79, 0xdf, 0xfc, 0x65, 0x98, 0x8e, 0x22, 0x0d, 0x62, 0x7e, 0xf2, 0x34, 0x60, 0x83, 0x05, 0x14, 0xb1, 0xc1, - /* (2^285)P */ 0x64, 0x22, 0xcc, 0xdf, 0x5c, 0xbc, 0x88, 0x68, 0x4c, 0xd9, 0xbc, 0x0e, 0xc9, 0x8b, 0xb4, 0x23, 0x52, 0xad, 0xb0, 0xb3, 0xf1, 0x17, 0xd8, 0x15, 0x04, 0x6b, 0x99, 0xf0, 0xc4, 0x7d, 0x48, 0x22, 0x4a, 0xf8, 0x6f, 0xaa, 0x88, 0x0d, 0xc5, 0x5e, 0xa9, 0x1c, 0x61, 0x3d, 0x95, 0xa9, 0x7b, 0x6a, 0x79, 0x33, 0x0a, 0x2b, 0x99, 0xe3, 0x4e, 0x48, - /* (2^286)P */ 0x6b, 0x9b, 0x6a, 0x2a, 0xf1, 0x60, 0x31, 0xb4, 0x73, 0xd1, 0x87, 0x45, 0x9c, 0x15, 0x58, 0x4b, 0x91, 0x6d, 0x94, 0x1c, 0x41, 0x11, 0x4a, 0x83, 0xec, 0xaf, 0x65, 0xbc, 0x34, 0xaa, 0x26, 0xe2, 0xaf, 0xed, 0x46, 0x05, 0x4e, 0xdb, 0xc6, 0x4e, 0x10, 0x28, 0x4e, 0x72, 0xe5, 0x31, 0xa3, 0x20, 0xd7, 0xb1, 0x96, 0x64, 0xf6, 0xce, 0x08, 0x08, - /* (2^287)P */ 0x16, 0xa9, 0x5c, 0x9f, 0x9a, 0xb4, 0xb8, 0xc8, 0x32, 0x78, 0xc0, 0x3a, 0xd9, 0x5f, 0x94, 0xac, 0x3a, 0x42, 0x1f, 0x43, 0xd6, 0x80, 0x47, 0x2c, 0xdc, 0x76, 0x27, 0xfa, 0x50, 0xe5, 0xa1, 0xe4, 0xc3, 0xcb, 0x61, 0x31, 0xe1, 0x2e, 0xde, 0x81, 0x3b, 0x77, 0x1c, 0x39, 0x3c, 0xdb, 0xda, 0x87, 0x4b, 0x84, 0x12, 0xeb, 0xdd, 0x54, 0xbf, 0xe7, - /* (2^288)P */ 0xbf, 0xcb, 0x73, 0x21, 0x3d, 0x7e, 0x13, 0x8c, 0xa6, 0x34, 0x21, 0x2b, 0xa5, 0xe4, 0x9f, 0x8e, 0x9c, 0x01, 0x9c, 0x43, 0xd9, 0xc7, 0xb9, 0xf1, 0xbe, 0x7f, 0x45, 0x51, 0x97, 0xa1, 0x8e, 0x01, 0xf8, 0xbd, 0xd2, 0xbf, 0x81, 0x3a, 0x8b, 0xab, 0xe4, 0x89, 0xb7, 0xbd, 0xf2, 0xcd, 0xa9, 0x8a, 0x8a, 0xde, 0xfb, 0x8a, 0x55, 0x12, 0x7b, 0x17, - /* (2^289)P */ 0x1b, 0x95, 0x58, 0x4d, 0xe6, 0x51, 0x31, 0x52, 0x1c, 0xd8, 0x15, 0x84, 0xb1, 0x0d, 0x36, 0x25, 0x88, 0x91, 0x46, 0x71, 0x42, 0x56, 0xe2, 0x90, 0x08, 0x9e, 0x77, 0x1b, 0xee, 0x22, 0x3f, 0xec, 0xee, 0x8c, 0x7b, 0x2e, 0x79, 0xc4, 0x6c, 0x07, 0xa1, 0x7e, 0x52, 0xf5, 0x26, 0x5c, 0x84, 0x2a, 0x50, 0x6e, 0x82, 0xb3, 0x76, 0xda, 0x35, 0x16, - /* (2^290)P */ 0x0a, 0x6f, 0x99, 0x87, 0xc0, 0x7d, 0x8a, 0xb2, 0xca, 0xae, 0xe8, 0x65, 0x98, 0x0f, 0xb3, 0x44, 0xe1, 0xdc, 0x52, 0x79, 0x75, 0xec, 0x8f, 0x95, 0x87, 0x45, 0xd1, 0x32, 0x18, 0x55, 0x15, 0xce, 0x64, 0x9b, 0x08, 0x4f, 0x2c, 0xea, 0xba, 0x1c, 0x57, 0x06, 0x63, 0xc8, 0xb1, 0xfd, 0xc5, 0x67, 0xe7, 0x1f, 0x87, 0x9e, 0xde, 0x72, 0x7d, 0xec, - /* (2^291)P */ 0x36, 0x8b, 0x4d, 0x2c, 0xc2, 0x46, 0xe8, 0x96, 0xac, 0x0b, 0x8c, 0xc5, 0x09, 0x10, 0xfc, 0xf2, 0xda, 0xea, 0x22, 0xb2, 0xd3, 0x89, 0xeb, 0xb2, 0x85, 0x0f, 0xff, 0x59, 0x50, 0x2c, 0x99, 0x5a, 0x1f, 0xec, 0x2a, 0x6f, 0xec, 0xcf, 0xe9, 0xce, 0x12, 0x6b, 0x19, 0xd8, 0xde, 0x9b, 0xce, 0x0e, 0x6a, 0xaa, 0xe1, 0x32, 0xea, 0x4c, 0xfe, 0x92, - /* (2^292)P */ 0x5f, 0x17, 0x70, 0x53, 0x26, 0x03, 0x0b, 0xab, 0xd1, 0xc1, 0x42, 0x0b, 0xab, 0x2b, 0x3d, 0x31, 0xa4, 0xd5, 0x2b, 0x5e, 0x00, 0xd5, 0x9a, 0x22, 0x34, 0xe0, 0x53, 0x3f, 0x59, 0x7f, 0x2c, 0x6d, 0x72, 0x9a, 0xa4, 0xbe, 0x3d, 0x42, 0x05, 0x1b, 0xf2, 0x7f, 0x88, 0x56, 0xd1, 0x7c, 0x7d, 0x6b, 0x9f, 0x43, 0xfe, 0x65, 0x19, 0xae, 0x9c, 0x4c, - /* (2^293)P */ 0xf3, 0x7c, 0x20, 0xa9, 0xfc, 0xf2, 0xf2, 0x3b, 0x3c, 0x57, 0x41, 0x94, 0xe5, 0xcc, 0x6a, 0x37, 0x5d, 0x09, 0xf2, 0xab, 0xc2, 0xca, 0x60, 0x38, 0x6b, 0x7a, 0xe1, 0x78, 0x2b, 0xc1, 0x1d, 0xe8, 0xfd, 0xbc, 0x3d, 0x5c, 0xa2, 0xdb, 0x49, 0x20, 0x79, 0xe6, 0x1b, 0x9b, 0x65, 0xd9, 0x6d, 0xec, 0x57, 0x1d, 0xd2, 0xe9, 0x90, 0xeb, 0x43, 0x7b, - /* (2^294)P */ 0x2a, 0x8b, 0x2e, 0x19, 0x18, 0x10, 0xb8, 0x83, 0xe7, 0x7d, 0x2d, 0x9a, 0x3a, 0xe5, 0xd1, 0xe4, 0x7c, 0x38, 0xe5, 0x59, 0x2a, 0x6e, 0xd9, 0x01, 0x29, 0x3d, 0x23, 0xf7, 0x52, 0xba, 0x61, 0x04, 0x9a, 0xde, 0xc4, 0x31, 0x50, 0xeb, 0x1b, 0xaa, 0xde, 0x39, 0x58, 0xd8, 0x1b, 0x1e, 0xfc, 0x57, 0x9a, 0x28, 0x43, 0x9e, 0x97, 0x5e, 0xaa, 0xa3, - /* (2^295)P */ 0x97, 0x0a, 0x74, 0xc4, 0x39, 0x99, 0x6b, 0x40, 0xc7, 0x3e, 0x8c, 0xa7, 0xb1, 0x4e, 0x9a, 0x59, 0x6e, 0x1c, 0xfe, 0xfc, 0x2a, 0x5e, 0x73, 0x2b, 0x8c, 0xa9, 0x71, 0xf5, 0xda, 0x6b, 0x15, 0xab, 0xf7, 0xbe, 0x2a, 0x44, 0x5f, 0xba, 0xae, 0x67, 0x93, 0xc5, 0x86, 0xc1, 0xb8, 0xdf, 0xdc, 0xcb, 0xd7, 0xff, 0xb1, 0x71, 0x7c, 0x6f, 0x88, 0xf8, - /* (2^296)P */ 0x3f, 0x89, 0xb1, 0xbf, 0x24, 0x16, 0xac, 0x56, 0xfe, 0xdf, 0x94, 0x71, 0xbf, 0xd6, 0x57, 0x0c, 0xb4, 0x77, 0x37, 0xaa, 0x2a, 0x70, 0x76, 0x49, 0xaf, 0x0c, 0x97, 0x8e, 0x78, 0x2a, 0x67, 0xc9, 0x3b, 0x3d, 0x5b, 0x01, 0x2f, 0xda, 0xd5, 0xa8, 0xde, 0x02, 0xa9, 0xac, 0x76, 0x00, 0x0b, 0x46, 0xc6, 0x2d, 0xdc, 0x08, 0xf4, 0x10, 0x2c, 0xbe, - /* (2^297)P */ 0xcb, 0x07, 0xf9, 0x91, 0xc6, 0xd5, 0x3e, 0x54, 0x63, 0xae, 0xfc, 0x10, 0xbe, 0x3a, 0x20, 0x73, 0x4e, 0x65, 0x0e, 0x2d, 0x86, 0x77, 0x83, 0x9d, 0xe2, 0x0a, 0xe9, 0xac, 0x22, 0x52, 0x76, 0xd4, 0x6e, 0xfa, 0xe0, 0x09, 0xef, 0x78, 0x82, 0x9f, 0x26, 0xf9, 0x06, 0xb5, 0xe7, 0x05, 0x0e, 0xf2, 0x46, 0x72, 0x93, 0xd3, 0x24, 0xbd, 0x87, 0x60, - /* (2^298)P */ 0x14, 0x55, 0x84, 0x7b, 0x6c, 0x60, 0x80, 0x73, 0x8c, 0xbe, 0x2d, 0xd6, 0x69, 0xd6, 0x17, 0x26, 0x44, 0x9f, 0x88, 0xa2, 0x39, 0x7c, 0x89, 0xbc, 0x6d, 0x9e, 0x46, 0xb6, 0x68, 0x66, 0xea, 0xdc, 0x31, 0xd6, 0x21, 0x51, 0x9f, 0x28, 0x28, 0xaf, 0x9e, 0x47, 0x2c, 0x4c, 0x8f, 0xf3, 0xaf, 0x1f, 0xe4, 0xab, 0xac, 0xe9, 0x0c, 0x91, 0x3a, 0x61, - /* (2^299)P */ 0xb0, 0x37, 0x55, 0x4b, 0xe9, 0xc3, 0xb1, 0xce, 0x42, 0xe6, 0xc5, 0x11, 0x7f, 0x2c, 0x11, 0xfc, 0x4e, 0x71, 0x17, 0x00, 0x74, 0x7f, 0xbf, 0x07, 0x4d, 0xfd, 0x40, 0xb2, 0x87, 0xb0, 0xef, 0x1f, 0x35, 0x2c, 0x2d, 0xd7, 0xe1, 0xe4, 0xad, 0x0e, 0x7f, 0x63, 0x66, 0x62, 0x23, 0x41, 0xf6, 0xc1, 0x14, 0xa6, 0xd7, 0xa9, 0x11, 0x56, 0x9d, 0x1b, - /* (2^300)P */ 0x02, 0x82, 0x42, 0x18, 0x4f, 0x1b, 0xc9, 0x5d, 0x78, 0x5f, 0xee, 0xed, 0x01, 0x49, 0x8f, 0xf2, 0xa0, 0xe2, 0x6e, 0xbb, 0x6b, 0x04, 0x8d, 0xb2, 0x41, 0xae, 0xc8, 0x1b, 0x59, 0x34, 0xb8, 0x2a, 0xdb, 0x1f, 0xd2, 0x52, 0xdf, 0x3f, 0x35, 0x00, 0x8b, 0x61, 0xbc, 0x97, 0xa0, 0xc4, 0x77, 0xd1, 0xe4, 0x2c, 0x59, 0x68, 0xff, 0x30, 0xf2, 0xe2, - /* (2^301)P */ 0x79, 0x08, 0xb1, 0xdb, 0x55, 0xae, 0xd0, 0xed, 0xda, 0xa0, 0xec, 0x6c, 0xae, 0x68, 0xf2, 0x0b, 0x61, 0xb3, 0xf5, 0x21, 0x69, 0x87, 0x0b, 0x03, 0xea, 0x8a, 0x15, 0xd9, 0x7e, 0xca, 0xf7, 0xcd, 0xf3, 0x33, 0xb3, 0x4c, 0x5b, 0x23, 0x4e, 0x6f, 0x90, 0xad, 0x91, 0x4b, 0x4f, 0x46, 0x37, 0xe5, 0xe8, 0xb7, 0xeb, 0xd5, 0xca, 0x34, 0x4e, 0x23, - /* (2^302)P */ 0x09, 0x02, 0xdd, 0xfd, 0x70, 0xac, 0x56, 0x80, 0x36, 0x5e, 0x49, 0xd0, 0x3f, 0xc2, 0xe0, 0xba, 0x46, 0x7f, 0x5c, 0xf7, 0xc5, 0xbd, 0xd5, 0x55, 0x7d, 0x3f, 0xd5, 0x7d, 0x06, 0xdf, 0x27, 0x20, 0x4f, 0xe9, 0x30, 0xec, 0x1b, 0xa0, 0x0c, 0xd4, 0x2c, 0xe1, 0x2b, 0x65, 0x73, 0xea, 0x75, 0x35, 0xe8, 0xe6, 0x56, 0xd6, 0x07, 0x15, 0x99, 0xdf, - /* (2^303)P */ 0x4e, 0x10, 0xb7, 0xd0, 0x63, 0x8c, 0xcf, 0x16, 0x00, 0x7c, 0x58, 0xdf, 0x86, 0xdc, 0x4e, 0xca, 0x9c, 0x40, 0x5a, 0x42, 0xfd, 0xec, 0x98, 0xa4, 0x42, 0x53, 0xae, 0x16, 0x9d, 0xfd, 0x75, 0x5a, 0x12, 0x56, 0x1e, 0xc6, 0x57, 0xcc, 0x79, 0x27, 0x96, 0x00, 0xcf, 0x80, 0x4f, 0x8a, 0x36, 0x5c, 0xbb, 0xe9, 0x12, 0xdb, 0xb6, 0x2b, 0xad, 0x96, - /* (2^304)P */ 0x92, 0x32, 0x1f, 0xfd, 0xc6, 0x02, 0x94, 0x08, 0x1b, 0x60, 0x6a, 0x9f, 0x8b, 0xd6, 0xc8, 0xad, 0xd5, 0x1b, 0x27, 0x4e, 0xa4, 0x4d, 0x4a, 0x00, 0x10, 0x5f, 0x86, 0x11, 0xf5, 0xe3, 0x14, 0x32, 0x43, 0xee, 0xb9, 0xc7, 0xab, 0xf4, 0x6f, 0xe5, 0x66, 0x0c, 0x06, 0x0d, 0x96, 0x79, 0x28, 0xaf, 0x45, 0x2b, 0x56, 0xbe, 0xe4, 0x4a, 0x52, 0xd6, - /* (2^305)P */ 0x15, 0x16, 0x69, 0xef, 0x60, 0xca, 0x82, 0x25, 0x0f, 0xc6, 0x30, 0xa0, 0x0a, 0xd1, 0x83, 0x29, 0xcd, 0xb6, 0x89, 0x6c, 0xf5, 0xb2, 0x08, 0x38, 0xe6, 0xca, 0x6b, 0x19, 0x93, 0xc6, 0x5f, 0x75, 0x8e, 0x60, 0x34, 0x23, 0xc4, 0x13, 0x17, 0x69, 0x55, 0xcc, 0x72, 0x9c, 0x2b, 0x6c, 0x80, 0xf4, 0x4b, 0x8b, 0xb6, 0x97, 0x65, 0x07, 0xb6, 0xfb, - /* (2^306)P */ 0x01, 0x99, 0x74, 0x28, 0xa6, 0x67, 0xa3, 0xe5, 0x25, 0xfb, 0xdf, 0x82, 0x93, 0xe7, 0x35, 0x74, 0xce, 0xe3, 0x15, 0x1c, 0x1d, 0x79, 0x52, 0x84, 0x08, 0x04, 0x2f, 0x5c, 0xb8, 0xcd, 0x7f, 0x89, 0xb0, 0x39, 0x93, 0x63, 0xc9, 0x5d, 0x06, 0x01, 0x59, 0xf7, 0x7e, 0xf1, 0x4c, 0x3d, 0x12, 0x8d, 0x69, 0x1d, 0xb7, 0x21, 0x5e, 0x88, 0x82, 0xa2, - /* (2^307)P */ 0x8e, 0x69, 0xaf, 0x9a, 0x41, 0x0d, 0x9d, 0xcf, 0x8e, 0x8d, 0x5c, 0x51, 0x6e, 0xde, 0x0e, 0x48, 0x23, 0x89, 0xe5, 0x37, 0x80, 0xd6, 0x9d, 0x72, 0x32, 0x26, 0x38, 0x2d, 0x63, 0xa0, 0xfa, 0xd3, 0x40, 0xc0, 0x8c, 0x68, 0x6f, 0x2b, 0x1e, 0x9a, 0x39, 0x51, 0x78, 0x74, 0x9a, 0x7b, 0x4a, 0x8f, 0x0c, 0xa0, 0x88, 0x60, 0xa5, 0x21, 0xcd, 0xc7, - /* (2^308)P */ 0x3a, 0x7f, 0x73, 0x14, 0xbf, 0x89, 0x6a, 0x4c, 0x09, 0x5d, 0xf2, 0x93, 0x20, 0x2d, 0xc4, 0x29, 0x86, 0x06, 0x95, 0xab, 0x22, 0x76, 0x4c, 0x54, 0xe1, 0x7e, 0x80, 0x6d, 0xab, 0x29, 0x61, 0x87, 0x77, 0xf6, 0xc0, 0x3e, 0xda, 0xab, 0x65, 0x7e, 0x39, 0x12, 0xa1, 0x6b, 0x42, 0xf7, 0xc5, 0x97, 0x77, 0xec, 0x6f, 0x22, 0xbe, 0x44, 0xc7, 0x03, - /* (2^309)P */ 0xa5, 0x23, 0x90, 0x41, 0xa3, 0xc5, 0x3e, 0xe0, 0xa5, 0x32, 0x49, 0x1f, 0x39, 0x78, 0xb1, 0xd8, 0x24, 0xea, 0xd4, 0x87, 0x53, 0x42, 0x51, 0xf4, 0xd9, 0x46, 0x25, 0x2f, 0x62, 0xa9, 0x90, 0x9a, 0x4a, 0x25, 0x8a, 0xd2, 0x10, 0xe7, 0x3c, 0xbc, 0x58, 0x8d, 0x16, 0x14, 0x96, 0xa4, 0x6f, 0xf8, 0x12, 0x69, 0x91, 0x73, 0xe2, 0xfa, 0xf4, 0x57, - /* (2^310)P */ 0x51, 0x45, 0x3f, 0x96, 0xdc, 0x97, 0x38, 0xa6, 0x01, 0x63, 0x09, 0xea, 0xc2, 0x13, 0x30, 0xb0, 0x00, 0xb8, 0x0a, 0xce, 0xd1, 0x8f, 0x3e, 0x69, 0x62, 0x46, 0x33, 0x9c, 0xbf, 0x4b, 0xcb, 0x0c, 0x90, 0x1c, 0x45, 0xcf, 0x37, 0x5b, 0xf7, 0x4b, 0x5e, 0x95, 0xc3, 0x28, 0x9f, 0x08, 0x83, 0x53, 0x74, 0xab, 0x0c, 0xb4, 0xc0, 0xa1, 0xbc, 0x89, - /* (2^311)P */ 0x06, 0xb1, 0x51, 0x15, 0x65, 0x60, 0x21, 0x17, 0x7a, 0x20, 0x65, 0xee, 0x12, 0x35, 0x4d, 0x46, 0xf4, 0xf8, 0xd0, 0xb1, 0xca, 0x09, 0x30, 0x08, 0x89, 0x23, 0x3b, 0xe7, 0xab, 0x8b, 0x77, 0xa6, 0xad, 0x25, 0xdd, 0xea, 0x3c, 0x7d, 0xa5, 0x24, 0xb3, 0xe8, 0xfa, 0xfb, 0xc9, 0xf2, 0x71, 0xe9, 0xfa, 0xf2, 0xdc, 0x54, 0xdd, 0x55, 0x2e, 0x2f, - /* (2^312)P */ 0x7f, 0x96, 0x96, 0xfb, 0x52, 0x86, 0xcf, 0xea, 0x62, 0x18, 0xf1, 0x53, 0x1f, 0x61, 0x2a, 0x9f, 0x8c, 0x51, 0xca, 0x2c, 0xde, 0x6d, 0xce, 0xab, 0x58, 0x32, 0x0b, 0x33, 0x9b, 0x99, 0xb4, 0x5c, 0x88, 0x2a, 0x76, 0xcc, 0x3e, 0x54, 0x1e, 0x9d, 0xa2, 0x89, 0xe4, 0x19, 0xba, 0x80, 0xc8, 0x39, 0x32, 0x7f, 0x0f, 0xc7, 0x84, 0xbb, 0x43, 0x56, - /* (2^313)P */ 0x9b, 0x07, 0xb4, 0x42, 0xa9, 0xa0, 0x78, 0x4f, 0x28, 0x70, 0x2b, 0x7e, 0x61, 0xe0, 0xdd, 0x02, 0x98, 0xfc, 0xed, 0x31, 0x80, 0xf1, 0x15, 0x52, 0x89, 0x23, 0xcd, 0x5d, 0x2b, 0xc5, 0x19, 0x32, 0xfb, 0x70, 0x50, 0x7a, 0x97, 0x6b, 0x42, 0xdb, 0xca, 0xdb, 0xc4, 0x59, 0x99, 0xe0, 0x12, 0x1f, 0x17, 0xba, 0x8b, 0xf0, 0xc4, 0x38, 0x5d, 0x27, - /* (2^314)P */ 0x29, 0x1d, 0xdc, 0x2b, 0xf6, 0x5b, 0x04, 0x61, 0x36, 0x76, 0xa0, 0x56, 0x36, 0x6e, 0xd7, 0x24, 0x4d, 0xe7, 0xef, 0x44, 0xd2, 0xd5, 0x07, 0xcd, 0xc4, 0x9d, 0x80, 0x48, 0xc3, 0x38, 0xcf, 0xd8, 0xa3, 0xdd, 0xb2, 0x5e, 0xb5, 0x70, 0x15, 0xbb, 0x36, 0x85, 0x8a, 0xd7, 0xfb, 0x56, 0x94, 0x73, 0x9c, 0x81, 0xbe, 0xb1, 0x44, 0x28, 0xf1, 0x37, - /* (2^315)P */ 0xbf, 0xcf, 0x5c, 0xd2, 0xe2, 0xea, 0xc2, 0xcd, 0x70, 0x7a, 0x9d, 0xcb, 0x81, 0xc1, 0xe9, 0xf1, 0x56, 0x71, 0x52, 0xf7, 0x1b, 0x87, 0xc6, 0xd8, 0xcc, 0xb2, 0x69, 0xf3, 0xb0, 0xbd, 0xba, 0x83, 0x12, 0x26, 0xc4, 0xce, 0x72, 0xde, 0x3b, 0x21, 0x28, 0x9e, 0x5a, 0x94, 0xf5, 0x04, 0xa3, 0xc8, 0x0f, 0x5e, 0xbc, 0x71, 0xf9, 0x0d, 0xce, 0xf5, - /* (2^316)P */ 0x93, 0x97, 0x00, 0x85, 0xf4, 0xb4, 0x40, 0xec, 0xd9, 0x2b, 0x6c, 0xd6, 0x63, 0x9e, 0x93, 0x0a, 0x5a, 0xf4, 0xa7, 0x9a, 0xe3, 0x3c, 0xf0, 0x55, 0xd1, 0x96, 0x6c, 0xf5, 0x2a, 0xce, 0xd7, 0x95, 0x72, 0xbf, 0xc5, 0x0c, 0xce, 0x79, 0xa2, 0x0a, 0x78, 0xe0, 0x72, 0xd0, 0x66, 0x28, 0x05, 0x75, 0xd3, 0x23, 0x09, 0x91, 0xed, 0x7e, 0xc4, 0xbc, - /* (2^317)P */ 0x77, 0xc2, 0x9a, 0xf7, 0xa6, 0xe6, 0x18, 0xb4, 0xe7, 0xf6, 0xda, 0xec, 0x44, 0x6d, 0xfb, 0x08, 0xee, 0x65, 0xa8, 0x92, 0x85, 0x1f, 0xba, 0x38, 0x93, 0x20, 0x5c, 0x4d, 0xd2, 0x18, 0x0f, 0x24, 0xbe, 0x1a, 0x96, 0x44, 0x7d, 0xeb, 0xb3, 0xda, 0x95, 0xf4, 0xaf, 0x6c, 0x06, 0x0f, 0x47, 0x37, 0xc8, 0x77, 0x63, 0xe1, 0x29, 0xef, 0xff, 0xa5, - /* (2^318)P */ 0x16, 0x12, 0xd9, 0x47, 0x90, 0x22, 0x9b, 0x05, 0xf2, 0xa5, 0x9a, 0xae, 0x83, 0x98, 0xb5, 0xac, 0xab, 0x29, 0xaa, 0xdc, 0x5f, 0xde, 0xcd, 0xf7, 0x42, 0xad, 0x3b, 0x96, 0xd6, 0x3e, 0x6e, 0x52, 0x47, 0xb1, 0xab, 0x51, 0xde, 0x49, 0x7c, 0x87, 0x8d, 0x86, 0xe2, 0x70, 0x13, 0x21, 0x51, 0x1c, 0x0c, 0x25, 0xc1, 0xb0, 0xe6, 0x19, 0xcf, 0x12, - /* (2^319)P */ 0xf0, 0xbc, 0x97, 0x8f, 0x4b, 0x2f, 0xd1, 0x1f, 0x8c, 0x57, 0xed, 0x3c, 0xf4, 0x26, 0x19, 0xbb, 0x60, 0xca, 0x24, 0xc5, 0xd9, 0x97, 0xe2, 0x5f, 0x76, 0x49, 0x39, 0x7e, 0x2d, 0x12, 0x21, 0x98, 0xda, 0xe6, 0xdb, 0xd2, 0xd8, 0x9f, 0x18, 0xd8, 0x83, 0x6c, 0xba, 0x89, 0x8d, 0x29, 0xfa, 0x46, 0x33, 0x8c, 0x28, 0xdf, 0x6a, 0xb3, 0x69, 0x28, - /* (2^320)P */ 0x86, 0x17, 0xbc, 0xd6, 0x7c, 0xba, 0x1e, 0x83, 0xbb, 0x84, 0xb5, 0x8c, 0xad, 0xdf, 0xa1, 0x24, 0x81, 0x70, 0x40, 0x0f, 0xad, 0xad, 0x3b, 0x23, 0xd0, 0x93, 0xa0, 0x49, 0x5c, 0x4b, 0x51, 0xbe, 0x20, 0x49, 0x4e, 0xda, 0x2d, 0xd3, 0xad, 0x1b, 0x74, 0x08, 0x41, 0xf0, 0xef, 0x19, 0xe9, 0x45, 0x5d, 0x02, 0xae, 0x26, 0x25, 0xd9, 0xd1, 0xc2, - /* (2^321)P */ 0x48, 0x81, 0x3e, 0xb2, 0x83, 0xf8, 0x4d, 0xb3, 0xd0, 0x4c, 0x75, 0xb3, 0xa0, 0x52, 0x26, 0xf2, 0xaf, 0x5d, 0x36, 0x70, 0x72, 0xd6, 0xb7, 0x88, 0x08, 0x69, 0xbd, 0x15, 0x25, 0xb1, 0x45, 0x1b, 0xb7, 0x0b, 0x5f, 0x71, 0x5d, 0x83, 0x49, 0xb9, 0x84, 0x3b, 0x7c, 0xc1, 0x50, 0x93, 0x05, 0x53, 0xe0, 0x61, 0xea, 0xc1, 0xef, 0xdb, 0x82, 0x97, - /* (2^322)P */ 0x00, 0xd5, 0xc3, 0x3a, 0x4d, 0x8a, 0x23, 0x7a, 0xef, 0xff, 0x37, 0xef, 0xf3, 0xbc, 0xa9, 0xb6, 0xae, 0xd7, 0x3a, 0x7b, 0xfd, 0x3e, 0x8e, 0x9b, 0xab, 0x44, 0x54, 0x60, 0x28, 0x6c, 0xbf, 0x15, 0x24, 0x4a, 0x56, 0x60, 0x7f, 0xa9, 0x7a, 0x28, 0x59, 0x2c, 0x8a, 0xd1, 0x7d, 0x6b, 0x00, 0xfd, 0xa5, 0xad, 0xbc, 0x19, 0x3f, 0xcb, 0x73, 0xe0, - /* (2^323)P */ 0xcf, 0x9e, 0x66, 0x06, 0x4d, 0x2b, 0xf5, 0x9c, 0xc2, 0x9d, 0x9e, 0xed, 0x5a, 0x5c, 0x2d, 0x00, 0xbf, 0x29, 0x90, 0x88, 0xe4, 0x5d, 0xfd, 0xe2, 0xf0, 0x38, 0xec, 0x4d, 0x26, 0xea, 0x54, 0xf0, 0x3c, 0x84, 0x10, 0x6a, 0xf9, 0x66, 0x9c, 0xe7, 0x21, 0xfd, 0x0f, 0xc7, 0x13, 0x50, 0x81, 0xb6, 0x50, 0xf9, 0x04, 0x7f, 0xa4, 0x37, 0x85, 0x14, - /* (2^324)P */ 0xdb, 0x87, 0x49, 0xc7, 0xa8, 0x39, 0x0c, 0x32, 0x98, 0x0c, 0xb9, 0x1a, 0x1b, 0x4d, 0xe0, 0x8a, 0x9a, 0x8e, 0x8f, 0xab, 0x5a, 0x17, 0x3d, 0x04, 0x21, 0xce, 0x3e, 0x2c, 0xf9, 0xa3, 0x97, 0xe4, 0x77, 0x95, 0x0e, 0xb6, 0xa5, 0x15, 0xad, 0x3a, 0x1e, 0x46, 0x53, 0x17, 0x09, 0x83, 0x71, 0x4e, 0x86, 0x38, 0xd5, 0x23, 0x44, 0x16, 0x8d, 0xc8, - /* (2^325)P */ 0x05, 0x5e, 0x99, 0x08, 0xbb, 0xc3, 0xc0, 0xb7, 0x6c, 0x12, 0xf2, 0xf3, 0xf4, 0x7c, 0x6a, 0x4d, 0x9e, 0xeb, 0x3d, 0xb9, 0x63, 0x94, 0xce, 0x81, 0xd8, 0x11, 0xcb, 0x55, 0x69, 0x4a, 0x20, 0x0b, 0x4c, 0x2e, 0x14, 0xb8, 0xd4, 0x6a, 0x7c, 0xf0, 0xed, 0xfc, 0x8f, 0xef, 0xa0, 0xeb, 0x6c, 0x01, 0xe2, 0xdc, 0x10, 0x22, 0xa2, 0x01, 0x85, 0x64, - /* (2^326)P */ 0x58, 0xe1, 0x9c, 0x27, 0x55, 0xc6, 0x25, 0xa6, 0x7d, 0x67, 0x88, 0x65, 0x99, 0x6c, 0xcb, 0xdb, 0x27, 0x4f, 0x44, 0x29, 0xf5, 0x4a, 0x23, 0x10, 0xbc, 0x03, 0x3f, 0x36, 0x1e, 0xef, 0xb0, 0xba, 0x75, 0xe8, 0x74, 0x5f, 0x69, 0x3e, 0x26, 0x40, 0xb4, 0x2f, 0xdc, 0x43, 0xbf, 0xa1, 0x8b, 0xbd, 0xca, 0x6e, 0xc1, 0x6e, 0x21, 0x79, 0xa0, 0xd0, - /* (2^327)P */ 0x78, 0x93, 0x4a, 0x2d, 0x22, 0x6e, 0x6e, 0x7d, 0x74, 0xd2, 0x66, 0x58, 0xce, 0x7b, 0x1d, 0x97, 0xb1, 0xf2, 0xda, 0x1c, 0x79, 0xfb, 0xba, 0xd1, 0xc0, 0xc5, 0x6e, 0xc9, 0x11, 0x89, 0xd2, 0x41, 0x8d, 0x70, 0xb9, 0xcc, 0xea, 0x6a, 0xb3, 0x45, 0xb6, 0x05, 0x2e, 0xf2, 0x17, 0xf1, 0x27, 0xb8, 0xed, 0x06, 0x1f, 0xdb, 0x9d, 0x1f, 0x69, 0x28, - /* (2^328)P */ 0x93, 0x12, 0xa8, 0x11, 0xe1, 0x92, 0x30, 0x8d, 0xac, 0xe1, 0x1c, 0x60, 0x7c, 0xed, 0x2d, 0x2e, 0xd3, 0x03, 0x5c, 0x9c, 0xc5, 0xbd, 0x64, 0x4a, 0x8c, 0xba, 0x76, 0xfe, 0xc6, 0xc1, 0xea, 0xc2, 0x4f, 0xbe, 0x70, 0x3d, 0x64, 0xcf, 0x8e, 0x18, 0xcb, 0xcd, 0x57, 0xa7, 0xf7, 0x36, 0xa9, 0x6b, 0x3e, 0xb8, 0x69, 0xee, 0x47, 0xa2, 0x7e, 0xb2, - /* (2^329)P */ 0x96, 0xaf, 0x3a, 0xf5, 0xed, 0xcd, 0xaf, 0xf7, 0x82, 0xaf, 0x59, 0x62, 0x0b, 0x36, 0x85, 0xf9, 0xaf, 0xd6, 0x38, 0xff, 0x87, 0x2e, 0x1d, 0x6c, 0x8b, 0xaf, 0x3b, 0xdf, 0x28, 0xa2, 0xd6, 0x4d, 0x80, 0x92, 0xc3, 0x0f, 0x34, 0xa8, 0xae, 0x69, 0x5d, 0x7b, 0x9d, 0xbc, 0xf5, 0xfd, 0x1d, 0xb1, 0x96, 0x55, 0x86, 0xe1, 0x5c, 0xb6, 0xac, 0xb9, - /* (2^330)P */ 0x50, 0x9e, 0x37, 0x28, 0x7d, 0xa8, 0x33, 0x63, 0xda, 0x3f, 0x20, 0x98, 0x0e, 0x09, 0xa8, 0x77, 0x3b, 0x7a, 0xfc, 0x16, 0x85, 0x44, 0x64, 0x77, 0x65, 0x68, 0x92, 0x41, 0xc6, 0x1f, 0xdf, 0x27, 0xf9, 0xec, 0xa0, 0x61, 0x22, 0xea, 0x19, 0xe7, 0x75, 0x8b, 0x4e, 0xe5, 0x0f, 0xb7, 0xf7, 0xd2, 0x53, 0xf4, 0xdd, 0x4a, 0xaa, 0x78, 0x40, 0xb7, - /* (2^331)P */ 0xd4, 0x89, 0xe3, 0x79, 0xba, 0xb6, 0xc3, 0xda, 0xe6, 0x78, 0x65, 0x7d, 0x6e, 0x22, 0x62, 0xb1, 0x3d, 0xea, 0x90, 0x84, 0x30, 0x5e, 0xd4, 0x39, 0x84, 0x78, 0xd9, 0x75, 0xd6, 0xce, 0x2a, 0x11, 0x29, 0x69, 0xa4, 0x5e, 0xaa, 0x2a, 0x98, 0x5a, 0xe5, 0x91, 0x8f, 0xb2, 0xfb, 0xda, 0x97, 0xe8, 0x83, 0x6f, 0x04, 0xb9, 0x5d, 0xaf, 0xe1, 0x9b, - /* (2^332)P */ 0x8b, 0xe4, 0xe1, 0x48, 0x9c, 0xc4, 0x83, 0x89, 0xdf, 0x65, 0xd3, 0x35, 0x55, 0x13, 0xf4, 0x1f, 0x36, 0x92, 0x33, 0x38, 0xcb, 0xed, 0x15, 0xe6, 0x60, 0x2d, 0x25, 0xf5, 0x36, 0x60, 0x3a, 0x37, 0x9b, 0x71, 0x9d, 0x42, 0xb0, 0x14, 0xc8, 0xba, 0x62, 0xa3, 0x49, 0xb0, 0x88, 0xc1, 0x72, 0x73, 0xdd, 0x62, 0x40, 0xa9, 0x62, 0x88, 0x99, 0xca, - /* (2^333)P */ 0x47, 0x7b, 0xea, 0xda, 0x46, 0x2f, 0x45, 0xc6, 0xe3, 0xb4, 0x4d, 0x8d, 0xac, 0x0b, 0x54, 0x22, 0x06, 0x31, 0x16, 0x66, 0x3e, 0xe4, 0x38, 0x12, 0xcd, 0xf3, 0xe7, 0x99, 0x37, 0xd9, 0x62, 0x24, 0x4b, 0x05, 0xf2, 0x58, 0xe6, 0x29, 0x4b, 0x0d, 0xf6, 0xc1, 0xba, 0xa0, 0x1e, 0x0f, 0xcb, 0x1f, 0xc6, 0x2b, 0x19, 0xfc, 0x82, 0x01, 0xd0, 0x86, - /* (2^334)P */ 0xa2, 0xae, 0x77, 0x20, 0xfb, 0xa8, 0x18, 0xb4, 0x61, 0xef, 0xe8, 0x52, 0x79, 0xbb, 0x86, 0x90, 0x5d, 0x2e, 0x76, 0xed, 0x66, 0x60, 0x5d, 0x00, 0xb5, 0xa4, 0x00, 0x40, 0x89, 0xec, 0xd1, 0xd2, 0x0d, 0x26, 0xb9, 0x30, 0xb2, 0xd2, 0xb8, 0xe8, 0x0e, 0x56, 0xf9, 0x67, 0x94, 0x2e, 0x62, 0xe1, 0x79, 0x48, 0x2b, 0xa9, 0xfa, 0xea, 0xdb, 0x28, - /* (2^335)P */ 0x35, 0xf1, 0xb0, 0x43, 0xbd, 0x27, 0xef, 0x18, 0x44, 0xa2, 0x04, 0xb4, 0x69, 0xa1, 0x97, 0x1f, 0x8c, 0x04, 0x82, 0x9b, 0x00, 0x6d, 0xf8, 0xbf, 0x7d, 0xc1, 0x5b, 0xab, 0xe8, 0xb2, 0x34, 0xbd, 0xaf, 0x7f, 0xb2, 0x0d, 0xf3, 0xed, 0xfc, 0x5b, 0x50, 0xee, 0xe7, 0x4a, 0x20, 0xd9, 0xf5, 0xc6, 0x9a, 0x97, 0x6d, 0x07, 0x2f, 0xb9, 0x31, 0x02, - /* (2^336)P */ 0xf9, 0x54, 0x4a, 0xc5, 0x61, 0x7e, 0x1d, 0xa6, 0x0e, 0x1a, 0xa8, 0xd3, 0x8c, 0x36, 0x7d, 0xf1, 0x06, 0xb1, 0xac, 0x93, 0xcd, 0xe9, 0x8f, 0x61, 0x6c, 0x5d, 0x03, 0x23, 0xdf, 0x85, 0x53, 0x39, 0x63, 0x5e, 0xeb, 0xf3, 0xd3, 0xd3, 0x75, 0x97, 0x9b, 0x62, 0x9b, 0x01, 0xb3, 0x19, 0xd8, 0x2b, 0x36, 0xf2, 0x2c, 0x2c, 0x6f, 0x36, 0xc6, 0x3c, - /* (2^337)P */ 0x05, 0x74, 0x43, 0x10, 0xb6, 0xb0, 0xf8, 0xbf, 0x02, 0x46, 0x9a, 0xee, 0xc1, 0xaf, 0xc1, 0xe5, 0x5a, 0x2e, 0xbb, 0xe1, 0xdc, 0xc6, 0xce, 0x51, 0x29, 0x50, 0xbf, 0x1b, 0xde, 0xff, 0xba, 0x4d, 0x8d, 0x8b, 0x7e, 0xe7, 0xbd, 0x5b, 0x8f, 0xbe, 0xe3, 0x75, 0x71, 0xff, 0x37, 0x05, 0x5a, 0x10, 0xeb, 0x54, 0x7e, 0x44, 0x72, 0x2c, 0xd4, 0xfc, - /* (2^338)P */ 0x03, 0x12, 0x1c, 0xb2, 0x08, 0x90, 0xa1, 0x2d, 0x50, 0xa0, 0xad, 0x7f, 0x8d, 0xa6, 0x97, 0xc1, 0xbd, 0xdc, 0xc3, 0xa7, 0xad, 0x31, 0xdf, 0xb8, 0x03, 0x84, 0xc3, 0xb9, 0x29, 0x3d, 0x92, 0x2e, 0xc3, 0x90, 0x07, 0xe8, 0xa7, 0xc7, 0xbc, 0x61, 0xe9, 0x3e, 0xa0, 0x35, 0xda, 0x1d, 0xab, 0x48, 0xfe, 0x50, 0xc9, 0x25, 0x59, 0x23, 0x69, 0x3f, - /* (2^339)P */ 0x8e, 0x91, 0xab, 0x6b, 0x91, 0x4f, 0x89, 0x76, 0x67, 0xad, 0xb2, 0x65, 0x9d, 0xad, 0x02, 0x36, 0xdc, 0xac, 0x96, 0x93, 0x97, 0x21, 0x14, 0xd0, 0xe8, 0x11, 0x60, 0x1e, 0xeb, 0x96, 0x06, 0xf2, 0x53, 0xf2, 0x6d, 0xb7, 0x93, 0x6f, 0x26, 0x91, 0x23, 0xe3, 0x34, 0x04, 0x92, 0x91, 0x37, 0x08, 0x50, 0xd6, 0x28, 0x09, 0x27, 0xa1, 0x0c, 0x00, - /* (2^340)P */ 0x1f, 0xbb, 0x21, 0x26, 0x33, 0xcb, 0xa4, 0xd1, 0xee, 0x85, 0xf9, 0xd9, 0x3c, 0x90, 0xc3, 0xd1, 0x26, 0xa2, 0x25, 0x93, 0x43, 0x61, 0xed, 0x91, 0x6e, 0x54, 0x03, 0x2e, 0x42, 0x9d, 0xf7, 0xa6, 0x02, 0x0f, 0x2f, 0x9c, 0x7a, 0x8d, 0x12, 0xc2, 0x18, 0xfc, 0x41, 0xff, 0x85, 0x26, 0x1a, 0x44, 0x55, 0x0b, 0x89, 0xab, 0x6f, 0x62, 0x33, 0x8c, - /* (2^341)P */ 0xe0, 0x3c, 0x5d, 0x70, 0x64, 0x87, 0x81, 0x35, 0xf2, 0x37, 0xa6, 0x24, 0x3e, 0xe0, 0x62, 0xd5, 0x71, 0xe7, 0x93, 0xfb, 0xac, 0xc3, 0xe7, 0xc7, 0x04, 0xe2, 0x70, 0xd3, 0x29, 0x5b, 0x21, 0xbf, 0xf4, 0x26, 0x5d, 0xf3, 0x95, 0xb4, 0x2a, 0x6a, 0x07, 0x55, 0xa6, 0x4b, 0x3b, 0x15, 0xf2, 0x25, 0x8a, 0x95, 0x3f, 0x63, 0x2f, 0x7a, 0x23, 0x96, - /* (2^342)P */ 0x0d, 0x3d, 0xd9, 0x13, 0xa7, 0xb3, 0x5e, 0x67, 0xf7, 0x02, 0x23, 0xee, 0x84, 0xff, 0x99, 0xda, 0xb9, 0x53, 0xf8, 0xf0, 0x0e, 0x39, 0x2f, 0x3c, 0x64, 0x34, 0xe3, 0x09, 0xfd, 0x2b, 0x33, 0xc7, 0xfe, 0x62, 0x2b, 0x84, 0xdf, 0x2b, 0xd2, 0x7c, 0x26, 0x01, 0x70, 0x66, 0x5b, 0x85, 0xc2, 0xbe, 0x88, 0x37, 0xf1, 0x30, 0xac, 0xb8, 0x76, 0xa3, - /* (2^343)P */ 0x6e, 0x01, 0xf0, 0x55, 0x35, 0xe4, 0xbd, 0x43, 0x62, 0x9d, 0xd6, 0x11, 0xef, 0x6f, 0xb8, 0x8c, 0xaa, 0x98, 0x87, 0xc6, 0x6d, 0xc4, 0xcc, 0x74, 0x92, 0x53, 0x4a, 0xdf, 0xe4, 0x08, 0x89, 0x17, 0xd0, 0x0f, 0xf4, 0x00, 0x60, 0x78, 0x08, 0x44, 0xb5, 0xda, 0x18, 0xed, 0x98, 0xc8, 0x61, 0x3d, 0x39, 0xdb, 0xcf, 0x1d, 0x49, 0x40, 0x65, 0x75, - /* (2^344)P */ 0x8e, 0x10, 0xae, 0x5f, 0x06, 0xd2, 0x95, 0xfd, 0x20, 0x16, 0x49, 0x5b, 0x57, 0xbe, 0x22, 0x8b, 0x43, 0xfb, 0xe6, 0xcc, 0x26, 0xa5, 0x5d, 0xd3, 0x68, 0xc5, 0xf9, 0x5a, 0x86, 0x24, 0x87, 0x27, 0x05, 0xfd, 0xe2, 0xff, 0xb3, 0xa3, 0x7b, 0x37, 0x59, 0xc5, 0x4e, 0x14, 0x94, 0xf9, 0x3b, 0xcb, 0x7c, 0xed, 0xca, 0x1d, 0xb2, 0xac, 0x05, 0x4a, - /* (2^345)P */ 0xf4, 0xd1, 0x81, 0xeb, 0x89, 0xbf, 0xfe, 0x1e, 0x41, 0x92, 0x29, 0xee, 0xe1, 0x43, 0xf5, 0x86, 0x1d, 0x2f, 0xbb, 0x1e, 0x84, 0x5d, 0x7b, 0x8d, 0xd5, 0xda, 0xee, 0x1e, 0x8a, 0xd0, 0x27, 0xf2, 0x60, 0x51, 0x59, 0x82, 0xf4, 0x84, 0x2b, 0x5b, 0x14, 0x2d, 0x81, 0x82, 0x3e, 0x2b, 0xb4, 0x6d, 0x51, 0x4f, 0xc5, 0xcb, 0xbf, 0x74, 0xe3, 0xb4, - /* (2^346)P */ 0x19, 0x2f, 0x22, 0xb3, 0x04, 0x5f, 0x81, 0xca, 0x05, 0x60, 0xb9, 0xaa, 0xee, 0x0e, 0x2f, 0x48, 0x38, 0xf9, 0x91, 0xb4, 0x66, 0xe4, 0x57, 0x28, 0x54, 0x10, 0xe9, 0x61, 0x9d, 0xd4, 0x90, 0x75, 0xb1, 0x39, 0x23, 0xb6, 0xfc, 0x82, 0xe0, 0xfa, 0xbb, 0x5c, 0x6e, 0xc3, 0x44, 0x13, 0x00, 0x83, 0x55, 0x9e, 0x8e, 0x10, 0x61, 0x81, 0x91, 0x04, - /* (2^347)P */ 0x5f, 0x2a, 0xd7, 0x81, 0xd9, 0x9c, 0xbb, 0x79, 0xbc, 0x62, 0x56, 0x98, 0x03, 0x5a, 0x18, 0x85, 0x2a, 0x9c, 0xd0, 0xfb, 0xd2, 0xb1, 0xaf, 0xef, 0x0d, 0x24, 0xc5, 0xfa, 0x39, 0xbb, 0x6b, 0xed, 0xa4, 0xdf, 0xe4, 0x87, 0xcd, 0x41, 0xd3, 0x72, 0x32, 0xc6, 0x28, 0x21, 0xb1, 0xba, 0x8b, 0xa3, 0x91, 0x79, 0x76, 0x22, 0x25, 0x10, 0x61, 0xd1, - /* (2^348)P */ 0x73, 0xb5, 0x32, 0x97, 0xdd, 0xeb, 0xdd, 0x22, 0x22, 0xf1, 0x33, 0x3c, 0x77, 0x56, 0x7d, 0x6b, 0x48, 0x2b, 0x05, 0x81, 0x03, 0x03, 0x91, 0x9a, 0xe3, 0x5e, 0xd4, 0xee, 0x3f, 0xf8, 0xbb, 0x50, 0x21, 0x32, 0x4c, 0x4a, 0x58, 0x49, 0xde, 0x0c, 0xde, 0x30, 0x82, 0x3d, 0x92, 0xf0, 0x6c, 0xcc, 0x32, 0x3e, 0xd2, 0x78, 0x8a, 0x6e, 0x2c, 0xd0, - /* (2^349)P */ 0xf0, 0xf7, 0xa1, 0x0b, 0xc1, 0x74, 0x85, 0xa8, 0xe9, 0xdd, 0x48, 0xa1, 0xc0, 0x16, 0xd8, 0x2b, 0x61, 0x08, 0xc2, 0x2b, 0x30, 0x26, 0x79, 0xce, 0x9e, 0xfd, 0x39, 0xd7, 0x81, 0xa4, 0x63, 0x8c, 0xd5, 0x74, 0xa0, 0x88, 0xfa, 0x03, 0x30, 0xe9, 0x7f, 0x2b, 0xc6, 0x02, 0xc9, 0x5e, 0xe4, 0xd5, 0x4d, 0x92, 0xd0, 0xf6, 0xf2, 0x5b, 0x79, 0x08, - /* (2^350)P */ 0x34, 0x89, 0x81, 0x43, 0xd1, 0x94, 0x2c, 0x10, 0x54, 0x9b, 0xa0, 0xe5, 0x44, 0xe8, 0xc2, 0x2f, 0x3e, 0x0e, 0x74, 0xae, 0xba, 0xe2, 0xac, 0x85, 0x6b, 0xd3, 0x5c, 0x97, 0xf7, 0x90, 0xf1, 0x12, 0xc0, 0x03, 0xc8, 0x1f, 0x37, 0x72, 0x8c, 0x9b, 0x9c, 0x17, 0x96, 0x9d, 0xc7, 0xbf, 0xa3, 0x3f, 0x44, 0x3d, 0x87, 0x81, 0xbd, 0x81, 0xa6, 0x5f, - /* (2^351)P */ 0xe4, 0xff, 0x78, 0x62, 0x82, 0x5b, 0x76, 0x58, 0xf5, 0x5b, 0xa6, 0xc4, 0x53, 0x11, 0x3b, 0x7b, 0xaa, 0x67, 0xf8, 0xea, 0x3b, 0x5d, 0x9a, 0x2e, 0x04, 0xeb, 0x4a, 0x24, 0xfb, 0x56, 0xf0, 0xa8, 0xd4, 0x14, 0xed, 0x0f, 0xfd, 0xc5, 0x26, 0x17, 0x2a, 0xf0, 0xb9, 0x13, 0x8c, 0xbd, 0x65, 0x14, 0x24, 0x95, 0x27, 0x12, 0x63, 0x2a, 0x09, 0x18, - /* (2^352)P */ 0xe1, 0x5c, 0xe7, 0xe0, 0x00, 0x6a, 0x96, 0xf2, 0x49, 0x6a, 0x39, 0xa5, 0xe0, 0x17, 0x79, 0x4a, 0x63, 0x07, 0x62, 0x09, 0x61, 0x1b, 0x6e, 0xa9, 0xb5, 0x62, 0xb7, 0xde, 0xdf, 0x80, 0x4c, 0x5a, 0x99, 0x73, 0x59, 0x9d, 0xfb, 0xb1, 0x5e, 0xbe, 0xb8, 0xb7, 0x63, 0x93, 0xe8, 0xad, 0x5e, 0x1f, 0xae, 0x59, 0x1c, 0xcd, 0xb4, 0xc2, 0xb3, 0x8a, - /* (2^353)P */ 0x78, 0x53, 0xa1, 0x4c, 0x70, 0x9c, 0x63, 0x7e, 0xb3, 0x12, 0x40, 0x5f, 0xbb, 0x23, 0xa7, 0xf7, 0x77, 0x96, 0x5b, 0x4d, 0x91, 0x10, 0x52, 0x85, 0x9e, 0xa5, 0x38, 0x0b, 0xfd, 0x25, 0x01, 0x4b, 0xfa, 0x4d, 0xd3, 0x3f, 0x78, 0x74, 0x42, 0xff, 0x62, 0x2d, 0x27, 0xdc, 0x9d, 0xd1, 0x29, 0x76, 0x2e, 0x78, 0xb3, 0x35, 0xfa, 0x15, 0xd5, 0x38, - /* (2^354)P */ 0x8b, 0xc7, 0x43, 0xce, 0xf0, 0x5e, 0xf1, 0x0d, 0x02, 0x38, 0xe8, 0x82, 0xc9, 0x25, 0xad, 0x2d, 0x27, 0xa4, 0x54, 0x18, 0xb2, 0x30, 0x73, 0xa4, 0x41, 0x08, 0xe4, 0x86, 0xe6, 0x8c, 0xe9, 0x2a, 0x34, 0xb3, 0xd6, 0x61, 0x8f, 0x66, 0x26, 0x08, 0xb6, 0x06, 0x33, 0xaa, 0x12, 0xac, 0x72, 0xec, 0x2e, 0x52, 0xa3, 0x25, 0x3e, 0xd7, 0x62, 0xe8, - /* (2^355)P */ 0xc4, 0xbb, 0x89, 0xc8, 0x40, 0xcc, 0x84, 0xec, 0x4a, 0xd9, 0xc4, 0x55, 0x78, 0x00, 0xcf, 0xd8, 0xe9, 0x24, 0x59, 0xdc, 0x5e, 0xf0, 0x66, 0xa1, 0x83, 0xae, 0x97, 0x18, 0xc5, 0x54, 0x27, 0xa2, 0x21, 0x52, 0x03, 0x31, 0x5b, 0x11, 0x67, 0xf6, 0x12, 0x00, 0x87, 0x2f, 0xff, 0x59, 0x70, 0x8f, 0x6d, 0x71, 0xab, 0xab, 0x24, 0xb8, 0xba, 0x35, - /* (2^356)P */ 0x69, 0x43, 0xa7, 0x14, 0x06, 0x96, 0xe9, 0xc2, 0xe3, 0x2b, 0x45, 0x22, 0xc0, 0xd0, 0x2f, 0x34, 0xd1, 0x01, 0x99, 0xfc, 0x99, 0x38, 0xa1, 0x25, 0x2e, 0x59, 0x6c, 0x27, 0xc9, 0xeb, 0x7b, 0xdc, 0x4e, 0x26, 0x68, 0xba, 0xfa, 0xec, 0x02, 0x05, 0x64, 0x80, 0x30, 0x20, 0x5c, 0x26, 0x7f, 0xaf, 0x95, 0x17, 0x3d, 0x5c, 0x9e, 0x96, 0x96, 0xaf, - /* (2^357)P */ 0xa6, 0xba, 0x21, 0x29, 0x32, 0xe2, 0x98, 0xde, 0x9b, 0x6d, 0x0b, 0x44, 0x91, 0xa8, 0x3e, 0xd4, 0xb8, 0x04, 0x6c, 0xf6, 0x04, 0x39, 0xbd, 0x52, 0x05, 0x15, 0x27, 0x78, 0x8e, 0x55, 0xac, 0x79, 0xc5, 0xe6, 0x00, 0x7f, 0x90, 0xa2, 0xdd, 0x07, 0x13, 0xe0, 0x24, 0x70, 0x5c, 0x0f, 0x4d, 0xa9, 0xf9, 0xae, 0xcb, 0x34, 0x10, 0x9d, 0x89, 0x9d, - /* (2^358)P */ 0x12, 0xe0, 0xb3, 0x9f, 0xc4, 0x96, 0x1d, 0xcf, 0xed, 0x99, 0x64, 0x28, 0x8d, 0xc7, 0x31, 0x82, 0xee, 0x5e, 0x75, 0x48, 0xff, 0x3a, 0xf2, 0x09, 0x34, 0x03, 0x93, 0x52, 0x19, 0xb2, 0xc5, 0x81, 0x93, 0x45, 0x5e, 0x59, 0x21, 0x2b, 0xec, 0x89, 0xba, 0x36, 0x6e, 0xf9, 0x82, 0x75, 0x7e, 0x82, 0x3f, 0xaa, 0xe2, 0xe3, 0x3b, 0x94, 0xfd, 0x98, - /* (2^359)P */ 0x7c, 0xdb, 0x75, 0x31, 0x61, 0xfb, 0x15, 0x28, 0x94, 0xd7, 0xc3, 0x5a, 0xa9, 0xa1, 0x0a, 0x66, 0x0f, 0x2b, 0x13, 0x3e, 0x42, 0xb5, 0x28, 0x3a, 0xca, 0x83, 0xf3, 0x61, 0x22, 0xf4, 0x40, 0xc5, 0xdf, 0xe7, 0x31, 0x9f, 0x7e, 0x51, 0x75, 0x06, 0x9d, 0x51, 0xc8, 0xe7, 0x9f, 0xc3, 0x71, 0x4f, 0x3d, 0x5b, 0xfb, 0xe9, 0x8e, 0x08, 0x40, 0x8e, - /* (2^360)P */ 0xf7, 0x31, 0xad, 0x50, 0x5d, 0x25, 0x93, 0x73, 0x68, 0xf6, 0x7c, 0x89, 0x5a, 0x3d, 0x9f, 0x9b, 0x05, 0x82, 0xe7, 0x70, 0x4b, 0x19, 0xaa, 0xcf, 0xff, 0xde, 0x50, 0x8f, 0x2f, 0x69, 0xd3, 0xf0, 0x99, 0x51, 0x6b, 0x9d, 0xb6, 0x56, 0x6f, 0xf8, 0x4c, 0x74, 0x8b, 0x4c, 0x91, 0xf9, 0xa9, 0xb1, 0x3e, 0x07, 0xdf, 0x0b, 0x27, 0x8a, 0xb1, 0xed, - /* (2^361)P */ 0xfb, 0x67, 0xd9, 0x48, 0xd2, 0xe4, 0x44, 0x9b, 0x43, 0x15, 0x8a, 0xeb, 0x00, 0x53, 0xad, 0x25, 0xc7, 0x7e, 0x19, 0x30, 0x87, 0xb7, 0xd5, 0x5f, 0x04, 0xf8, 0xaa, 0xdd, 0x57, 0xae, 0x34, 0x75, 0xe2, 0x84, 0x4b, 0x54, 0x60, 0x37, 0x95, 0xe4, 0xd3, 0xec, 0xac, 0xef, 0x47, 0x31, 0xa3, 0xc8, 0x31, 0x22, 0xdb, 0x26, 0xe7, 0x6a, 0xb5, 0xad, - /* (2^362)P */ 0x44, 0x09, 0x5c, 0x95, 0xe4, 0x72, 0x3c, 0x1a, 0xd1, 0xac, 0x42, 0x51, 0x99, 0x6f, 0xfa, 0x1f, 0xf2, 0x22, 0xbe, 0xff, 0x7b, 0x66, 0xf5, 0x6c, 0xb3, 0x66, 0xc7, 0x4d, 0x78, 0x31, 0x83, 0x80, 0xf5, 0x41, 0xe9, 0x7f, 0xbe, 0xf7, 0x23, 0x49, 0x6b, 0x84, 0x4e, 0x7e, 0x47, 0x07, 0x6e, 0x74, 0xdf, 0xe5, 0x9d, 0x9e, 0x56, 0x2a, 0xc0, 0xbc, - /* (2^363)P */ 0xac, 0x10, 0x80, 0x8c, 0x7c, 0xfa, 0x83, 0xdf, 0xb3, 0xd0, 0xc4, 0xbe, 0xfb, 0x9f, 0xac, 0xc9, 0xc3, 0x40, 0x95, 0x0b, 0x09, 0x23, 0xda, 0x63, 0x67, 0xcf, 0xe7, 0x9f, 0x7d, 0x7b, 0x6b, 0xe2, 0xe6, 0x6d, 0xdb, 0x87, 0x9e, 0xa6, 0xff, 0x6d, 0xab, 0xbd, 0xfb, 0x54, 0x84, 0x68, 0xcf, 0x89, 0xf1, 0xd0, 0xe2, 0x85, 0x61, 0xdc, 0x22, 0xd1, - /* (2^364)P */ 0xa8, 0x48, 0xfb, 0x8c, 0x6a, 0x63, 0x01, 0x72, 0x43, 0x43, 0xeb, 0x21, 0xa3, 0x00, 0x8a, 0xc0, 0x87, 0x51, 0x9e, 0x86, 0x75, 0x16, 0x79, 0xf9, 0x6b, 0x11, 0x80, 0x62, 0xc2, 0x9d, 0xb8, 0x8c, 0x30, 0x8e, 0x8d, 0x03, 0x52, 0x7e, 0x31, 0x59, 0x38, 0xf9, 0x25, 0xc7, 0x0f, 0xc7, 0xa8, 0x2b, 0x5c, 0x80, 0xfa, 0x90, 0xa2, 0x63, 0xca, 0xe7, - /* (2^365)P */ 0xf1, 0x5d, 0xb5, 0xd9, 0x20, 0x10, 0x7d, 0x0f, 0xc5, 0x50, 0x46, 0x07, 0xff, 0x02, 0x75, 0x2b, 0x4a, 0xf3, 0x39, 0x91, 0x72, 0xb7, 0xd5, 0xcc, 0x38, 0xb8, 0xe7, 0x36, 0x26, 0x5e, 0x11, 0x97, 0x25, 0xfb, 0x49, 0x68, 0xdc, 0xb4, 0x46, 0x87, 0x5c, 0xc2, 0x7f, 0xaa, 0x7d, 0x36, 0x23, 0xa6, 0xc6, 0x53, 0xec, 0xbc, 0x57, 0x47, 0xc1, 0x2b, - /* (2^366)P */ 0x25, 0x5d, 0x7d, 0x95, 0xda, 0x0b, 0x8f, 0x78, 0x1e, 0x19, 0x09, 0xfa, 0x67, 0xe0, 0xa0, 0x17, 0x24, 0x76, 0x6c, 0x30, 0x1f, 0x62, 0x3d, 0xbe, 0x45, 0x70, 0xcc, 0xb6, 0x1e, 0x68, 0x06, 0x25, 0x68, 0x16, 0x1a, 0x33, 0x3f, 0x90, 0xc7, 0x78, 0x2d, 0x98, 0x3c, 0x2f, 0xb9, 0x2d, 0x94, 0x0b, 0xfb, 0x49, 0x56, 0x30, 0xd7, 0xc1, 0xe6, 0x48, - /* (2^367)P */ 0x7a, 0xd1, 0xe0, 0x8e, 0x67, 0xfc, 0x0b, 0x50, 0x1f, 0x84, 0x98, 0xfa, 0xaf, 0xae, 0x2e, 0x31, 0x27, 0xcf, 0x3f, 0xf2, 0x6e, 0x8d, 0x81, 0x8f, 0xd2, 0x5f, 0xde, 0xd3, 0x5e, 0xe9, 0xe7, 0x13, 0x48, 0x83, 0x5a, 0x4e, 0x84, 0xd1, 0x58, 0xcf, 0x6b, 0x84, 0xdf, 0x13, 0x1d, 0x91, 0x85, 0xe8, 0xcb, 0x29, 0x79, 0xd2, 0xca, 0xac, 0x6a, 0x93, - /* (2^368)P */ 0x53, 0x82, 0xce, 0x61, 0x96, 0x88, 0x6f, 0xe1, 0x4a, 0x4c, 0x1e, 0x30, 0x73, 0xe8, 0x74, 0xde, 0x40, 0x2b, 0xe0, 0xc4, 0xb5, 0xd8, 0x7c, 0x15, 0xe7, 0xe1, 0xb1, 0xe0, 0xd6, 0x88, 0xb1, 0x6a, 0x57, 0x19, 0x6a, 0x22, 0x66, 0x57, 0xf6, 0x8d, 0xfd, 0xc0, 0xf2, 0xa3, 0x03, 0x56, 0xfb, 0x2e, 0x75, 0x5e, 0xc7, 0x8e, 0x22, 0x96, 0x5c, 0x06, - /* (2^369)P */ 0x98, 0x7e, 0xbf, 0x3e, 0xbf, 0x24, 0x9d, 0x15, 0xd3, 0xf6, 0xd3, 0xd2, 0xf0, 0x11, 0xf2, 0xdb, 0x36, 0x23, 0x38, 0xf7, 0x1d, 0x71, 0x20, 0xd2, 0x54, 0x7f, 0x1e, 0x24, 0x8f, 0xe2, 0xaa, 0xf7, 0x3f, 0x6b, 0x41, 0x4e, 0xdc, 0x0e, 0xec, 0xe8, 0x35, 0x0a, 0x08, 0x6d, 0x89, 0x5b, 0x32, 0x91, 0x01, 0xb6, 0xe0, 0x2c, 0xc6, 0xa1, 0xbe, 0xb4, - /* (2^370)P */ 0x29, 0xf2, 0x1e, 0x1c, 0xdc, 0x68, 0x8a, 0x43, 0x87, 0x2c, 0x48, 0xb3, 0x9e, 0xed, 0xd2, 0x82, 0x46, 0xac, 0x2f, 0xef, 0x93, 0x34, 0x37, 0xca, 0x64, 0x8d, 0xc9, 0x06, 0x90, 0xbb, 0x78, 0x0a, 0x3c, 0x4c, 0xcf, 0x35, 0x7a, 0x0f, 0xf7, 0xa7, 0xf4, 0x2f, 0x45, 0x69, 0x3f, 0xa9, 0x5d, 0xce, 0x7b, 0x8a, 0x84, 0xc3, 0xae, 0xf4, 0xda, 0xd5, - /* (2^371)P */ 0xca, 0xba, 0x95, 0x43, 0x05, 0x7b, 0x06, 0xd9, 0x5c, 0x0a, 0x18, 0x5f, 0x6a, 0x6a, 0xce, 0xc0, 0x3d, 0x95, 0x51, 0x0e, 0x1a, 0xbe, 0x85, 0x7a, 0xf2, 0x69, 0xec, 0xc0, 0x8c, 0xca, 0xa3, 0x32, 0x0a, 0x76, 0x50, 0xc6, 0x76, 0x61, 0x00, 0x89, 0xbf, 0x6e, 0x0f, 0x48, 0x90, 0x31, 0x93, 0xec, 0x34, 0x70, 0xf0, 0xc3, 0x8d, 0xf0, 0x0f, 0xb5, - /* (2^372)P */ 0xbe, 0x23, 0xe2, 0x18, 0x99, 0xf1, 0xed, 0x8a, 0xf6, 0xc9, 0xac, 0xb8, 0x1e, 0x9a, 0x3c, 0x15, 0xae, 0xd7, 0x6d, 0xb3, 0x04, 0xee, 0x5b, 0x0d, 0x1e, 0x79, 0xb7, 0xf9, 0xf9, 0x8d, 0xad, 0xf9, 0x8f, 0x5a, 0x6a, 0x7b, 0xd7, 0x9b, 0xca, 0x62, 0xfe, 0x9c, 0xc0, 0x6f, 0x6d, 0x9d, 0x76, 0xa3, 0x69, 0xb9, 0x4c, 0xa1, 0xc4, 0x0c, 0x76, 0xaa, - /* (2^373)P */ 0x1c, 0x06, 0xfe, 0x3f, 0x45, 0x70, 0xcd, 0x97, 0xa9, 0xa2, 0xb1, 0xd3, 0xf2, 0xa5, 0x0c, 0x49, 0x2c, 0x75, 0x73, 0x1f, 0xcf, 0x00, 0xaf, 0xd5, 0x2e, 0xde, 0x0d, 0x8f, 0x8f, 0x7c, 0xc4, 0x58, 0xce, 0xd4, 0xf6, 0x24, 0x19, 0x2e, 0xd8, 0xc5, 0x1d, 0x1a, 0x3f, 0xb8, 0x4f, 0xbc, 0x7d, 0xbd, 0x68, 0xe3, 0x81, 0x98, 0x1b, 0xa8, 0xc9, 0xd9, - /* (2^374)P */ 0x39, 0x95, 0x78, 0x24, 0x6c, 0x38, 0xe4, 0xe7, 0xd0, 0x8d, 0xb9, 0x38, 0x71, 0x5e, 0xc1, 0x62, 0x80, 0xcc, 0xcb, 0x8c, 0x97, 0xca, 0xf8, 0xb9, 0xd9, 0x9c, 0xce, 0x72, 0x7b, 0x70, 0xee, 0x5f, 0xea, 0xa2, 0xdf, 0xa9, 0x14, 0x10, 0xf9, 0x6e, 0x59, 0x9f, 0x9c, 0xe0, 0x0c, 0xb2, 0x07, 0x97, 0xcd, 0xd2, 0x89, 0x16, 0xfd, 0x9c, 0xa8, 0xa5, - /* (2^375)P */ 0x5a, 0x61, 0xf1, 0x59, 0x7c, 0x38, 0xda, 0xe2, 0x85, 0x99, 0x68, 0xe9, 0xc9, 0xf7, 0x32, 0x7e, 0xc4, 0xca, 0xb7, 0x11, 0x08, 0x69, 0x2b, 0x66, 0x02, 0xf7, 0x2e, 0x18, 0xc3, 0x8e, 0xe1, 0xf9, 0xc5, 0x19, 0x9a, 0x0a, 0x9c, 0x07, 0xba, 0xc7, 0x9c, 0x03, 0x34, 0x89, 0x99, 0x67, 0x0b, 0x16, 0x4b, 0x07, 0x36, 0x16, 0x36, 0x2c, 0xe2, 0xa1, - /* (2^376)P */ 0x70, 0x10, 0x91, 0x27, 0xa8, 0x24, 0x8e, 0x29, 0x04, 0x6f, 0x79, 0x1f, 0xd3, 0xa5, 0x68, 0xd3, 0x0b, 0x7d, 0x56, 0x4d, 0x14, 0x57, 0x7b, 0x2e, 0x00, 0x9f, 0x9a, 0xfd, 0x6c, 0x63, 0x18, 0x81, 0xdb, 0x9d, 0xb7, 0xd7, 0xa4, 0x1e, 0xe8, 0x40, 0xf1, 0x4c, 0xa3, 0x01, 0xd5, 0x4b, 0x75, 0xea, 0xdd, 0x97, 0xfd, 0x5b, 0xb2, 0x66, 0x6a, 0x24, - /* (2^377)P */ 0x72, 0x11, 0xfe, 0x73, 0x1b, 0xd3, 0xea, 0x7f, 0x93, 0x15, 0x15, 0x05, 0xfe, 0x40, 0xe8, 0x28, 0xd8, 0x50, 0x47, 0x66, 0xfa, 0xb7, 0xb5, 0x04, 0xba, 0x35, 0x1e, 0x32, 0x9f, 0x5f, 0x32, 0xba, 0x3d, 0xd1, 0xed, 0x9a, 0x76, 0xca, 0xa3, 0x3e, 0x77, 0xd8, 0xd8, 0x7c, 0x5f, 0x68, 0x42, 0xb5, 0x86, 0x7f, 0x3b, 0xc9, 0xc1, 0x89, 0x64, 0xda, - /* (2^378)P */ 0xd5, 0xd4, 0x17, 0x31, 0xfc, 0x6a, 0xfd, 0xb8, 0xe8, 0xe5, 0x3e, 0x39, 0x06, 0xe4, 0xd1, 0x90, 0x2a, 0xca, 0xf6, 0x54, 0x6c, 0x1b, 0x2f, 0x49, 0x97, 0xb1, 0x2a, 0x82, 0x43, 0x3d, 0x1f, 0x8b, 0xe2, 0x47, 0xc5, 0x24, 0xa8, 0xd5, 0x53, 0x29, 0x7d, 0xc6, 0x87, 0xa6, 0x25, 0x3a, 0x64, 0xdd, 0x71, 0x08, 0x9e, 0xcd, 0xe9, 0x45, 0xc7, 0xba, - /* (2^379)P */ 0x37, 0x72, 0x6d, 0x13, 0x7a, 0x8d, 0x04, 0x31, 0xe6, 0xe3, 0x9e, 0x36, 0x71, 0x3e, 0xc0, 0x1e, 0xe3, 0x71, 0xd3, 0x49, 0x4e, 0x4a, 0x36, 0x42, 0x68, 0x68, 0x61, 0xc7, 0x3c, 0xdb, 0x81, 0x49, 0xf7, 0x91, 0x4d, 0xea, 0x4c, 0x4f, 0x98, 0xc6, 0x7e, 0x60, 0x84, 0x4b, 0x6a, 0x37, 0xbb, 0x52, 0xf7, 0xce, 0x02, 0xe4, 0xad, 0xd1, 0x3c, 0xa7, - /* (2^380)P */ 0x51, 0x06, 0x2d, 0xf8, 0x08, 0xe8, 0xf1, 0x0c, 0xe5, 0xa9, 0xac, 0x29, 0x73, 0x3b, 0xed, 0x98, 0x5f, 0x55, 0x08, 0x38, 0x51, 0x44, 0x36, 0x5d, 0xea, 0xc3, 0xb8, 0x0e, 0xa0, 0x4f, 0xd2, 0x79, 0xe9, 0x98, 0xc3, 0xf5, 0x00, 0xb9, 0x26, 0x27, 0x42, 0xa8, 0x07, 0xc1, 0x12, 0x31, 0xc1, 0xc3, 0x3c, 0x3b, 0x7a, 0x72, 0x97, 0xc2, 0x70, 0x3a, - /* (2^381)P */ 0xf4, 0xb2, 0xba, 0x32, 0xbc, 0xa9, 0x2f, 0x87, 0xc7, 0x3c, 0x45, 0xcd, 0xae, 0xe2, 0x13, 0x6d, 0x3a, 0xf2, 0xf5, 0x66, 0x97, 0x29, 0xaf, 0x53, 0x9f, 0xda, 0xea, 0x14, 0xdf, 0x04, 0x98, 0x19, 0x95, 0x9e, 0x2a, 0x00, 0x5c, 0x9d, 0x1d, 0xf0, 0x39, 0x23, 0xff, 0xfc, 0xca, 0x36, 0xb7, 0xde, 0xdf, 0x37, 0x78, 0x52, 0x21, 0xfa, 0x19, 0x10, - /* (2^382)P */ 0x50, 0x20, 0x73, 0x74, 0x62, 0x21, 0xf2, 0xf7, 0x9b, 0x66, 0x85, 0x34, 0x74, 0xd4, 0x9d, 0x60, 0xd7, 0xbc, 0xc8, 0x46, 0x3b, 0xb8, 0x80, 0x42, 0x15, 0x0a, 0x6c, 0x35, 0x1a, 0x69, 0xf0, 0x1d, 0x4b, 0x29, 0x54, 0x5a, 0x9a, 0x48, 0xec, 0x9f, 0x37, 0x74, 0x91, 0xd0, 0xd1, 0x9e, 0x00, 0xc2, 0x76, 0x56, 0xd6, 0xa0, 0x15, 0x14, 0x83, 0x59, - /* (2^383)P */ 0xc2, 0xf8, 0x22, 0x20, 0x23, 0x07, 0xbd, 0x1d, 0x6f, 0x1e, 0x8c, 0x56, 0x06, 0x6a, 0x4b, 0x9f, 0xe2, 0xa9, 0x92, 0x46, 0x4b, 0x46, 0x59, 0xd7, 0xe1, 0xda, 0x14, 0x98, 0x07, 0x65, 0x7e, 0x28, 0x20, 0xf2, 0x9d, 0x4f, 0x36, 0x5c, 0x92, 0xe0, 0x9d, 0xfe, 0x3e, 0xda, 0xe4, 0x47, 0x19, 0x3c, 0x00, 0x7f, 0x22, 0xf2, 0x9e, 0x51, 0xae, 0x4d, - /* (2^384)P */ 0xbe, 0x8c, 0x1b, 0x10, 0xb6, 0xad, 0xcc, 0xcc, 0xd8, 0x5e, 0x21, 0xa6, 0xfb, 0xf1, 0xf6, 0xbd, 0x0a, 0x24, 0x67, 0xb4, 0x57, 0x7a, 0xbc, 0xe8, 0xe9, 0xff, 0xee, 0x0a, 0x1f, 0xee, 0xbd, 0xc8, 0x44, 0xed, 0x2b, 0xbb, 0x55, 0x1f, 0xdd, 0x7c, 0xb3, 0xeb, 0x3f, 0x63, 0xa1, 0x28, 0x91, 0x21, 0xab, 0x71, 0xc6, 0x4c, 0xd0, 0xe9, 0xb0, 0x21, - /* (2^385)P */ 0xad, 0xc9, 0x77, 0x2b, 0xee, 0x89, 0xa4, 0x7b, 0xfd, 0xf9, 0xf6, 0x14, 0xe4, 0xed, 0x1a, 0x16, 0x9b, 0x78, 0x41, 0x43, 0xa8, 0x83, 0x72, 0x06, 0x2e, 0x7c, 0xdf, 0xeb, 0x7e, 0xdd, 0xd7, 0x8b, 0xea, 0x9a, 0x2b, 0x03, 0xba, 0x57, 0xf3, 0xf1, 0xd9, 0xe5, 0x09, 0xc5, 0x98, 0x61, 0x1c, 0x51, 0x6d, 0x5d, 0x6e, 0xfb, 0x5e, 0x95, 0x9f, 0xb5, - /* (2^386)P */ 0x23, 0xe2, 0x1e, 0x95, 0xa3, 0x5e, 0x42, 0x10, 0xc7, 0xc3, 0x70, 0xbf, 0x4b, 0x6b, 0x83, 0x36, 0x93, 0xb7, 0x68, 0x47, 0x88, 0x3a, 0x10, 0x88, 0x48, 0x7f, 0x8c, 0xae, 0x54, 0x10, 0x02, 0xa4, 0x52, 0x8f, 0x8d, 0xf7, 0x26, 0x4f, 0x50, 0xc3, 0x6a, 0xe2, 0x4e, 0x3b, 0x4c, 0xb9, 0x8a, 0x14, 0x15, 0x6d, 0x21, 0x29, 0xb3, 0x6e, 0x4e, 0xd0, - /* (2^387)P */ 0x4c, 0x8a, 0x18, 0x3f, 0xb7, 0x20, 0xfd, 0x3e, 0x54, 0xca, 0x68, 0x3c, 0xea, 0x6f, 0xf4, 0x6b, 0xa2, 0xbd, 0x01, 0xbd, 0xfe, 0x08, 0xa8, 0xd8, 0xc2, 0x20, 0x36, 0x05, 0xcd, 0xe9, 0xf3, 0x9e, 0xfa, 0x85, 0x66, 0x8f, 0x4b, 0x1d, 0x8c, 0x64, 0x4f, 0xb8, 0xc6, 0x0f, 0x5b, 0x57, 0xd8, 0x24, 0x19, 0x5a, 0x14, 0x4b, 0x92, 0xd3, 0x96, 0xbc, - /* (2^388)P */ 0xa9, 0x3f, 0xc9, 0x6c, 0xca, 0x64, 0x1e, 0x6f, 0xdf, 0x65, 0x7f, 0x9a, 0x47, 0x6b, 0x8a, 0x60, 0x31, 0xa6, 0x06, 0xac, 0x69, 0x30, 0xe6, 0xea, 0x63, 0x42, 0x26, 0x5f, 0xdb, 0xd0, 0xf2, 0x8e, 0x34, 0x0a, 0x3a, 0xeb, 0xf3, 0x79, 0xc8, 0xb7, 0x60, 0x56, 0x5c, 0x37, 0x95, 0x71, 0xf8, 0x7f, 0x49, 0x3e, 0x9e, 0x01, 0x26, 0x1e, 0x80, 0x9f, - /* (2^389)P */ 0xf8, 0x16, 0x9a, 0xaa, 0xb0, 0x28, 0xb5, 0x8e, 0xd0, 0x60, 0xe5, 0x26, 0xa9, 0x47, 0xc4, 0x5c, 0xa9, 0x39, 0xfe, 0x0a, 0xd8, 0x07, 0x2b, 0xb3, 0xce, 0xf1, 0xea, 0x1a, 0xf4, 0x7b, 0x98, 0x31, 0x3d, 0x13, 0x29, 0x80, 0xe8, 0x0d, 0xcf, 0x56, 0x39, 0x86, 0x50, 0x0c, 0xb3, 0x18, 0xf4, 0xc5, 0xca, 0xf2, 0x6f, 0xcd, 0x8d, 0xd5, 0x02, 0xb0, - /* (2^390)P */ 0xbf, 0x39, 0x3f, 0xac, 0x6d, 0x1a, 0x6a, 0xe4, 0x42, 0x24, 0xd6, 0x41, 0x9d, 0xb9, 0x5b, 0x46, 0x73, 0x93, 0x76, 0xaa, 0xb7, 0x37, 0x36, 0xa6, 0x09, 0xe5, 0x04, 0x3b, 0x66, 0xc4, 0x29, 0x3e, 0x41, 0xc2, 0xcb, 0xe5, 0x17, 0xd7, 0x34, 0x67, 0x1d, 0x2c, 0x12, 0xec, 0x24, 0x7a, 0x40, 0xa2, 0x45, 0x41, 0xf0, 0x75, 0xed, 0x43, 0x30, 0xc9, - /* (2^391)P */ 0x80, 0xf6, 0x47, 0x5b, 0xad, 0x54, 0x02, 0xbc, 0xdd, 0xa4, 0xb2, 0xd7, 0x42, 0x95, 0xf2, 0x0d, 0x1b, 0xef, 0x37, 0xa7, 0xb4, 0x34, 0x04, 0x08, 0x71, 0x1b, 0xd3, 0xdf, 0xa1, 0xf0, 0x2b, 0xfa, 0xc0, 0x1f, 0xf3, 0x44, 0xb5, 0xc6, 0x47, 0x3d, 0x65, 0x67, 0x45, 0x4d, 0x2f, 0xde, 0x52, 0x73, 0xfc, 0x30, 0x01, 0x6b, 0xc1, 0x03, 0xd8, 0xd7, - /* (2^392)P */ 0x1c, 0x67, 0x55, 0x3e, 0x01, 0x17, 0x0f, 0x3e, 0xe5, 0x34, 0x58, 0xfc, 0xcb, 0x71, 0x24, 0x74, 0x5d, 0x36, 0x1e, 0x89, 0x2a, 0x63, 0xf8, 0xf8, 0x9f, 0x50, 0x9f, 0x32, 0x92, 0x29, 0xd8, 0x1a, 0xec, 0x76, 0x57, 0x6c, 0x67, 0x12, 0x6a, 0x6e, 0xef, 0x97, 0x1f, 0xc3, 0x77, 0x60, 0x3c, 0x22, 0xcb, 0xc7, 0x04, 0x1a, 0x89, 0x2d, 0x10, 0xa6, - /* (2^393)P */ 0x12, 0xf5, 0xa9, 0x26, 0x16, 0xd9, 0x3c, 0x65, 0x5d, 0x83, 0xab, 0xd1, 0x70, 0x6b, 0x1c, 0xdb, 0xe7, 0x86, 0x0d, 0xfb, 0xe7, 0xf8, 0x2a, 0x58, 0x6e, 0x7a, 0x66, 0x13, 0x53, 0x3a, 0x6f, 0x8d, 0x43, 0x5f, 0x14, 0x23, 0x14, 0xff, 0x3d, 0x52, 0x7f, 0xee, 0xbd, 0x7a, 0x34, 0x8b, 0x35, 0x24, 0xc3, 0x7a, 0xdb, 0xcf, 0x22, 0x74, 0x9a, 0x8f, - /* (2^394)P */ 0xdb, 0x20, 0xfc, 0xe5, 0x39, 0x4e, 0x7d, 0x78, 0xee, 0x0b, 0xbf, 0x1d, 0x80, 0xd4, 0x05, 0x4f, 0xb9, 0xd7, 0x4e, 0x94, 0x88, 0x9a, 0x50, 0x78, 0x1a, 0x70, 0x8c, 0xcc, 0x25, 0xb6, 0x61, 0x09, 0xdc, 0x7b, 0xea, 0x3f, 0x7f, 0xea, 0x2a, 0x0d, 0x47, 0x1c, 0x8e, 0xa6, 0x5b, 0xd2, 0xa3, 0x61, 0x93, 0x3c, 0x68, 0x9f, 0x8b, 0xea, 0xb0, 0xcb, - /* (2^395)P */ 0xff, 0x54, 0x02, 0x19, 0xae, 0x8b, 0x4c, 0x2c, 0x3a, 0xe0, 0xe4, 0xac, 0x87, 0xf7, 0x51, 0x45, 0x41, 0x43, 0xdc, 0xaa, 0xcd, 0xcb, 0xdc, 0x40, 0xe3, 0x44, 0x3b, 0x1d, 0x9e, 0x3d, 0xb9, 0x82, 0xcc, 0x7a, 0xc5, 0x12, 0xf8, 0x1e, 0xdd, 0xdb, 0x8d, 0xb0, 0x2a, 0xe8, 0xe6, 0x6c, 0x94, 0x3b, 0xb7, 0x2d, 0xba, 0x79, 0x3b, 0xb5, 0x86, 0xfb, - /* (2^396)P */ 0x82, 0x88, 0x13, 0xdd, 0x6c, 0xcd, 0x85, 0x2b, 0x90, 0x86, 0xb7, 0xac, 0x16, 0xa6, 0x6e, 0x6a, 0x94, 0xd8, 0x1e, 0x4e, 0x41, 0x0f, 0xce, 0x81, 0x6a, 0xa8, 0x26, 0x56, 0x43, 0x52, 0x52, 0xe6, 0xff, 0x88, 0xcf, 0x47, 0x05, 0x1d, 0xff, 0xf3, 0xa0, 0x10, 0xb2, 0x97, 0x87, 0xeb, 0x47, 0xbb, 0xfa, 0x1f, 0xe8, 0x4c, 0xce, 0xc4, 0xcd, 0x93, - /* (2^397)P */ 0xf4, 0x11, 0xf5, 0x8d, 0x89, 0x29, 0x79, 0xb3, 0x59, 0x0b, 0x29, 0x7d, 0x9c, 0x12, 0x4a, 0x65, 0x72, 0x3a, 0xf9, 0xec, 0x37, 0x18, 0x86, 0xef, 0x44, 0x07, 0x25, 0x74, 0x76, 0x53, 0xed, 0x51, 0x01, 0xc6, 0x28, 0xc5, 0xc3, 0x4a, 0x0f, 0x99, 0xec, 0xc8, 0x40, 0x5a, 0x83, 0x30, 0x79, 0xa2, 0x3e, 0x63, 0x09, 0x2d, 0x6f, 0x23, 0x54, 0x1c, - /* (2^398)P */ 0x5c, 0x6f, 0x3b, 0x1c, 0x30, 0x77, 0x7e, 0x87, 0x66, 0x83, 0x2e, 0x7e, 0x85, 0x50, 0xfd, 0xa0, 0x7a, 0xc2, 0xf5, 0x0f, 0xc1, 0x64, 0xe7, 0x0b, 0xbd, 0x59, 0xa7, 0xe7, 0x65, 0x53, 0xc3, 0xf5, 0x55, 0x5b, 0xe1, 0x82, 0x30, 0x5a, 0x61, 0xcd, 0xa0, 0x89, 0x32, 0xdb, 0x87, 0xfc, 0x21, 0x8a, 0xab, 0x6d, 0x82, 0xa8, 0x42, 0x81, 0x4f, 0xf2, - /* (2^399)P */ 0xb3, 0xeb, 0x88, 0x18, 0xf6, 0x56, 0x96, 0xbf, 0xba, 0x5d, 0x71, 0xa1, 0x5a, 0xd1, 0x04, 0x7b, 0xd5, 0x46, 0x01, 0x74, 0xfe, 0x15, 0x25, 0xb7, 0xff, 0x0c, 0x24, 0x47, 0xac, 0xfd, 0xab, 0x47, 0x32, 0xe1, 0x6a, 0x4e, 0xca, 0xcf, 0x7f, 0xdd, 0xf8, 0xd2, 0x4b, 0x3b, 0xf5, 0x17, 0xba, 0xba, 0x8b, 0xa1, 0xec, 0x28, 0x3f, 0x97, 0xab, 0x2a, - /* (2^400)P */ 0x51, 0x38, 0xc9, 0x5e, 0xc6, 0xb3, 0x64, 0xf2, 0x24, 0x4d, 0x04, 0x7d, 0xc8, 0x39, 0x0c, 0x4a, 0xc9, 0x73, 0x74, 0x1b, 0x5c, 0xb2, 0xc5, 0x41, 0x62, 0xa0, 0x4c, 0x6d, 0x8d, 0x91, 0x9a, 0x7b, 0x88, 0xab, 0x9c, 0x7e, 0x23, 0xdb, 0x6f, 0xb5, 0x72, 0xd6, 0x47, 0x40, 0xef, 0x22, 0x58, 0x62, 0x19, 0x6c, 0x38, 0xba, 0x5b, 0x00, 0x30, 0x9f, - /* (2^401)P */ 0x65, 0xbb, 0x3b, 0x9b, 0xe9, 0xae, 0xbf, 0xbe, 0xe4, 0x13, 0x95, 0xf3, 0xe3, 0x77, 0xcb, 0xe4, 0x9a, 0x22, 0xb5, 0x4a, 0x08, 0x9d, 0xb3, 0x9e, 0x27, 0xe0, 0x15, 0x6c, 0x9f, 0x7e, 0x9a, 0x5e, 0x15, 0x45, 0x25, 0x8d, 0x01, 0x0a, 0xd2, 0x2b, 0xbd, 0x48, 0x06, 0x0d, 0x18, 0x97, 0x4b, 0xdc, 0xbc, 0xf0, 0xcd, 0xb2, 0x52, 0x3c, 0xac, 0xf5, - /* (2^402)P */ 0x3e, 0xed, 0x47, 0x6b, 0x5c, 0xf6, 0x76, 0xd0, 0xe9, 0x15, 0xa3, 0xcb, 0x36, 0x00, 0x21, 0xa3, 0x79, 0x20, 0xa5, 0x3e, 0x88, 0x03, 0xcb, 0x7e, 0x63, 0xbb, 0xed, 0xa9, 0x13, 0x35, 0x16, 0xaf, 0x2e, 0xb4, 0x70, 0x14, 0x93, 0xfb, 0xc4, 0x9b, 0xd8, 0xb1, 0xbe, 0x43, 0xd1, 0x85, 0xb8, 0x97, 0xef, 0xea, 0x88, 0xa1, 0x25, 0x52, 0x62, 0x75, - /* (2^403)P */ 0x8e, 0x4f, 0xaa, 0x23, 0x62, 0x7e, 0x2b, 0x37, 0x89, 0x00, 0x11, 0x30, 0xc5, 0x33, 0x4a, 0x89, 0x8a, 0xe2, 0xfc, 0x5c, 0x6a, 0x75, 0xe5, 0xf7, 0x02, 0x4a, 0x9b, 0xf7, 0xb5, 0x6a, 0x85, 0x31, 0xd3, 0x5a, 0xcf, 0xc3, 0xf8, 0xde, 0x2f, 0xcf, 0xb5, 0x24, 0xf4, 0xe3, 0xa1, 0xad, 0x42, 0xae, 0x09, 0xb9, 0x2e, 0x04, 0x2d, 0x01, 0x22, 0x3f, - /* (2^404)P */ 0x41, 0x16, 0xfb, 0x7d, 0x50, 0xfd, 0xb5, 0xba, 0x88, 0x24, 0xba, 0xfd, 0x3d, 0xb2, 0x90, 0x15, 0xb7, 0xfa, 0xa2, 0xe1, 0x4c, 0x7d, 0xb9, 0xc6, 0xff, 0x81, 0x57, 0xb6, 0xc2, 0x9e, 0xcb, 0xc4, 0x35, 0xbd, 0x01, 0xb7, 0xaa, 0xce, 0xd0, 0xe9, 0xb5, 0xd6, 0x72, 0xbf, 0xd2, 0xee, 0xc7, 0xac, 0x94, 0xff, 0x29, 0x57, 0x02, 0x49, 0x09, 0xad, - /* (2^405)P */ 0x27, 0xa5, 0x78, 0x1b, 0xbf, 0x6b, 0xaf, 0x0b, 0x8c, 0xd9, 0xa8, 0x37, 0xb0, 0x67, 0x18, 0xb6, 0xc7, 0x05, 0x8a, 0x67, 0x03, 0x30, 0x62, 0x6e, 0x56, 0x82, 0xa9, 0x54, 0x3e, 0x0c, 0x4e, 0x07, 0xe1, 0x5a, 0x38, 0xed, 0xfa, 0xc8, 0x55, 0x6b, 0x08, 0xa3, 0x6b, 0x64, 0x2a, 0x15, 0xd6, 0x39, 0x6f, 0x47, 0x99, 0x42, 0x3f, 0x33, 0x84, 0x8f, - /* (2^406)P */ 0xbc, 0x45, 0x29, 0x81, 0x0e, 0xa4, 0xc5, 0x72, 0x3a, 0x10, 0xe1, 0xc4, 0x1e, 0xda, 0xc3, 0xfe, 0xb0, 0xce, 0xd2, 0x13, 0x34, 0x67, 0x21, 0xc6, 0x7e, 0xf9, 0x8c, 0xff, 0x39, 0x50, 0xae, 0x92, 0x60, 0x35, 0x2f, 0x8b, 0x6e, 0xc9, 0xc1, 0x27, 0x3a, 0x94, 0x66, 0x3e, 0x26, 0x84, 0x93, 0xc8, 0x6c, 0xcf, 0xd2, 0x03, 0xa1, 0x10, 0xcf, 0xb7, - /* (2^407)P */ 0x64, 0xda, 0x19, 0xf6, 0xc5, 0x73, 0x17, 0x44, 0x88, 0x81, 0x07, 0x0d, 0x34, 0xb2, 0x75, 0xf9, 0xd9, 0xe2, 0xe0, 0x8b, 0x71, 0xcf, 0x72, 0x34, 0x83, 0xb4, 0xce, 0xfc, 0xd7, 0x29, 0x09, 0x5a, 0x98, 0xbf, 0x14, 0xac, 0x77, 0x55, 0x38, 0x47, 0x5b, 0x0f, 0x40, 0x24, 0xe5, 0xa5, 0xa6, 0xac, 0x2d, 0xa6, 0xff, 0x9c, 0x73, 0xfe, 0x5c, 0x7e, - /* (2^408)P */ 0x1e, 0x33, 0xcc, 0x68, 0xb2, 0xbc, 0x8c, 0x93, 0xaf, 0xcc, 0x38, 0xf8, 0xd9, 0x16, 0x72, 0x50, 0xac, 0xd9, 0xb5, 0x0b, 0x9a, 0xbe, 0x46, 0x7a, 0xf1, 0xee, 0xf1, 0xad, 0xec, 0x5b, 0x59, 0x27, 0x9c, 0x05, 0xa3, 0x87, 0xe0, 0x37, 0x2c, 0x83, 0xce, 0xb3, 0x65, 0x09, 0x8e, 0xc3, 0x9c, 0xbf, 0x6a, 0xa2, 0x00, 0xcc, 0x12, 0x36, 0xc5, 0x95, - /* (2^409)P */ 0x36, 0x11, 0x02, 0x14, 0x9c, 0x3c, 0xeb, 0x2f, 0x23, 0x5b, 0x6b, 0x2b, 0x08, 0x54, 0x53, 0xac, 0xb2, 0xa3, 0xe0, 0x26, 0x62, 0x3c, 0xe4, 0xe1, 0x81, 0xee, 0x13, 0x3e, 0xa4, 0x97, 0xef, 0xf9, 0x92, 0x27, 0x01, 0xce, 0x54, 0x8b, 0x3e, 0x31, 0xbe, 0xa7, 0x88, 0xcf, 0x47, 0x99, 0x3c, 0x10, 0x6f, 0x60, 0xb3, 0x06, 0x4e, 0xee, 0x1b, 0xf0, - /* (2^410)P */ 0x59, 0x49, 0x66, 0xcf, 0x22, 0xe6, 0xf6, 0x73, 0xfe, 0xa3, 0x1c, 0x09, 0xfa, 0x5f, 0x65, 0xa8, 0xf0, 0x82, 0xc2, 0xef, 0x16, 0x63, 0x6e, 0x79, 0x69, 0x51, 0x39, 0x07, 0x65, 0xc4, 0x81, 0xec, 0x73, 0x0f, 0x15, 0x93, 0xe1, 0x30, 0x33, 0xe9, 0x37, 0x86, 0x42, 0x4c, 0x1f, 0x9b, 0xad, 0xee, 0x3f, 0xf1, 0x2a, 0x8e, 0x6a, 0xa3, 0xc8, 0x35, - /* (2^411)P */ 0x1e, 0x49, 0xf1, 0xdd, 0xd2, 0x9c, 0x8e, 0x78, 0xb2, 0x06, 0xe4, 0x6a, 0xab, 0x3a, 0xdc, 0xcd, 0xf4, 0xeb, 0xe1, 0xe7, 0x2f, 0xaa, 0xeb, 0x40, 0x31, 0x9f, 0xb9, 0xab, 0x13, 0xa9, 0x78, 0xbf, 0x38, 0x89, 0x0e, 0x85, 0x14, 0x8b, 0x46, 0x76, 0x14, 0xda, 0xcf, 0x33, 0xc8, 0x79, 0xd3, 0xd5, 0xa3, 0x6a, 0x69, 0x45, 0x70, 0x34, 0xc3, 0xe9, - /* (2^412)P */ 0x5e, 0xe7, 0x78, 0xe9, 0x24, 0xcc, 0xe9, 0xf4, 0xc8, 0x6b, 0xe0, 0xfb, 0x3a, 0xbe, 0xcc, 0x42, 0x4a, 0x00, 0x22, 0xf8, 0xe6, 0x32, 0xbe, 0x6d, 0x18, 0x55, 0x60, 0xe9, 0x72, 0x69, 0x50, 0x56, 0xca, 0x04, 0x18, 0x38, 0xa1, 0xee, 0xd8, 0x38, 0x3c, 0xa7, 0x70, 0xe2, 0xb9, 0x4c, 0xa0, 0xc8, 0x89, 0x72, 0xcf, 0x49, 0x7f, 0xdf, 0xbc, 0x67, - /* (2^413)P */ 0x1d, 0x17, 0xcb, 0x0b, 0xbd, 0xb2, 0x36, 0xe3, 0xa8, 0x99, 0x31, 0xb6, 0x26, 0x9c, 0x0c, 0x74, 0xaf, 0x4d, 0x24, 0x61, 0xcf, 0x31, 0x7b, 0xed, 0xdd, 0xc3, 0xf6, 0x32, 0x70, 0xfe, 0x17, 0xf6, 0x51, 0x37, 0x65, 0xce, 0x5d, 0xaf, 0xa5, 0x2f, 0x2a, 0xfe, 0x00, 0x71, 0x7c, 0x50, 0xbe, 0x21, 0xc7, 0xed, 0xc6, 0xfc, 0x67, 0xcf, 0x9c, 0xdd, - /* (2^414)P */ 0x26, 0x3e, 0xf8, 0xbb, 0xd0, 0xb1, 0x01, 0xd8, 0xeb, 0x0b, 0x62, 0x87, 0x35, 0x4c, 0xde, 0xca, 0x99, 0x9c, 0x6d, 0xf7, 0xb6, 0xf0, 0x57, 0x0a, 0x52, 0x29, 0x6a, 0x3f, 0x26, 0x31, 0x04, 0x07, 0x2a, 0xc9, 0xfa, 0x9b, 0x0e, 0x62, 0x8e, 0x72, 0xf2, 0xad, 0xce, 0xb6, 0x35, 0x7a, 0xc1, 0xae, 0x35, 0xc7, 0xa3, 0x14, 0xcf, 0x0c, 0x28, 0xb7, - /* (2^415)P */ 0xa6, 0xf1, 0x32, 0x3a, 0x20, 0xd2, 0x24, 0x97, 0xcf, 0x5d, 0x37, 0x99, 0xaf, 0x33, 0x7a, 0x5b, 0x7a, 0xcc, 0x4e, 0x41, 0x38, 0xb1, 0x4e, 0xad, 0xc9, 0xd9, 0x71, 0x7e, 0xb2, 0xf5, 0xd5, 0x01, 0x6c, 0x4d, 0xfd, 0xa1, 0xda, 0x03, 0x38, 0x9b, 0x3d, 0x92, 0x92, 0xf2, 0xca, 0xbf, 0x1f, 0x24, 0xa4, 0xbb, 0x30, 0x6a, 0x74, 0x56, 0xc8, 0xce, - /* (2^416)P */ 0x27, 0xf4, 0xed, 0xc9, 0xc3, 0xb1, 0x79, 0x85, 0xbe, 0xf6, 0xeb, 0xf3, 0x55, 0xc7, 0xaa, 0xa6, 0xe9, 0x07, 0x5d, 0xf4, 0xeb, 0xa6, 0x81, 0xe3, 0x0e, 0xcf, 0xa3, 0xc1, 0xef, 0xe7, 0x34, 0xb2, 0x03, 0x73, 0x8a, 0x91, 0xf1, 0xad, 0x05, 0xc7, 0x0b, 0x43, 0x99, 0x12, 0x31, 0xc8, 0xc7, 0xc5, 0xa4, 0x3d, 0xcd, 0xe5, 0x4e, 0x6d, 0x24, 0xdd, - /* (2^417)P */ 0x61, 0x54, 0xd0, 0x95, 0x2c, 0x45, 0x75, 0xac, 0xb5, 0x1a, 0x9d, 0x11, 0xeb, 0xed, 0x6b, 0x57, 0xa3, 0xe6, 0xcd, 0x77, 0xd4, 0x83, 0x8e, 0x39, 0xf1, 0x0f, 0x98, 0xcb, 0x40, 0x02, 0x6e, 0x10, 0x82, 0x9e, 0xb4, 0x93, 0x76, 0xd7, 0x97, 0xa3, 0x53, 0x12, 0x86, 0xc6, 0x15, 0x78, 0x73, 0x93, 0xe7, 0x7f, 0xcf, 0x1f, 0xbf, 0xcd, 0xd2, 0x7a, - /* (2^418)P */ 0xc2, 0x21, 0xdc, 0xd5, 0x69, 0xff, 0xca, 0x49, 0x3a, 0xe1, 0xc3, 0x69, 0x41, 0x56, 0xc1, 0x76, 0x63, 0x24, 0xbd, 0x64, 0x1b, 0x3d, 0x92, 0xf9, 0x13, 0x04, 0x25, 0xeb, 0x27, 0xa6, 0xef, 0x39, 0x3a, 0x80, 0xe0, 0xf8, 0x27, 0xee, 0xc9, 0x49, 0x77, 0xef, 0x3f, 0x29, 0x3d, 0x5e, 0xe6, 0x66, 0x83, 0xd1, 0xf6, 0xfe, 0x9d, 0xbc, 0xf1, 0x96, - /* (2^419)P */ 0x6b, 0xc6, 0x99, 0x26, 0x3c, 0xf3, 0x63, 0xf9, 0xc7, 0x29, 0x8c, 0x52, 0x62, 0x2d, 0xdc, 0x8a, 0x66, 0xce, 0x2c, 0xa7, 0xe4, 0xf0, 0xd7, 0x37, 0x17, 0x1e, 0xe4, 0xa3, 0x53, 0x7b, 0x29, 0x8e, 0x60, 0x99, 0xf9, 0x0c, 0x7c, 0x6f, 0xa2, 0xcc, 0x9f, 0x80, 0xdd, 0x5e, 0x46, 0xaa, 0x0d, 0x6c, 0xc9, 0x6c, 0xf7, 0x78, 0x5b, 0x38, 0xe3, 0x24, - /* (2^420)P */ 0x4b, 0x75, 0x6a, 0x2f, 0x08, 0xe1, 0x72, 0x76, 0xab, 0x82, 0x96, 0xdf, 0x3b, 0x1f, 0x9b, 0xd8, 0xed, 0xdb, 0xcd, 0x15, 0x09, 0x5a, 0x1e, 0xb7, 0xc5, 0x26, 0x72, 0x07, 0x0c, 0x50, 0xcd, 0x3b, 0x4d, 0x3f, 0xa2, 0x67, 0xc2, 0x02, 0x61, 0x2e, 0x68, 0xe9, 0x6f, 0xf0, 0x21, 0x2a, 0xa7, 0x3b, 0x88, 0x04, 0x11, 0x64, 0x49, 0x0d, 0xb4, 0x46, - /* (2^421)P */ 0x63, 0x85, 0xf3, 0xc5, 0x2b, 0x5a, 0x9f, 0xf0, 0x17, 0xcb, 0x45, 0x0a, 0xf3, 0x6e, 0x7e, 0xb0, 0x7c, 0xbc, 0xf0, 0x4f, 0x3a, 0xb0, 0xbc, 0x36, 0x36, 0x52, 0x51, 0xcb, 0xfe, 0x9a, 0xcb, 0xe8, 0x7e, 0x4b, 0x06, 0x7f, 0xaa, 0x35, 0xc8, 0x0e, 0x7a, 0x30, 0xa3, 0xb1, 0x09, 0xbb, 0x86, 0x4c, 0xbe, 0xb8, 0xbd, 0xe0, 0x32, 0xa5, 0xd4, 0xf7, - /* (2^422)P */ 0x7d, 0x50, 0x37, 0x68, 0x4e, 0x22, 0xb2, 0x2c, 0xd5, 0x0f, 0x2b, 0x6d, 0xb1, 0x51, 0xf2, 0x82, 0xe9, 0x98, 0x7c, 0x50, 0xc7, 0x96, 0x7e, 0x0e, 0xdc, 0xb1, 0x0e, 0xb2, 0x63, 0x8c, 0x30, 0x37, 0x72, 0x21, 0x9c, 0x61, 0xc2, 0xa7, 0x33, 0xd9, 0xb2, 0x63, 0x93, 0xd1, 0x6b, 0x6a, 0x73, 0xa5, 0x58, 0x80, 0xff, 0x04, 0xc7, 0x83, 0x21, 0x29, - /* (2^423)P */ 0x29, 0x04, 0xbc, 0x99, 0x39, 0xc9, 0x58, 0xc9, 0x6b, 0x17, 0xe8, 0x90, 0xb3, 0xe6, 0xa9, 0xb6, 0x28, 0x9b, 0xcb, 0x3b, 0x28, 0x90, 0x68, 0x71, 0xff, 0xcf, 0x08, 0x78, 0xc9, 0x8d, 0xa8, 0x4e, 0x43, 0xd1, 0x1c, 0x9e, 0xa4, 0xe3, 0xdf, 0xbf, 0x92, 0xf4, 0xf9, 0x41, 0xba, 0x4d, 0x1c, 0xf9, 0xdd, 0x74, 0x76, 0x1c, 0x6e, 0x3e, 0x94, 0x87, - /* (2^424)P */ 0xe4, 0xda, 0xc5, 0xd7, 0xfb, 0x87, 0xc5, 0x4d, 0x6b, 0x19, 0xaa, 0xb9, 0xbc, 0x8c, 0xf2, 0x8a, 0xd8, 0x5d, 0xdb, 0x4d, 0xef, 0xa6, 0xf2, 0x65, 0xf1, 0x22, 0x9c, 0xf1, 0x46, 0x30, 0x71, 0x7c, 0xe4, 0x53, 0x8e, 0x55, 0x2e, 0x9c, 0x9a, 0x31, 0x2a, 0xc3, 0xab, 0x0f, 0xde, 0xe4, 0xbe, 0xd8, 0x96, 0x50, 0x6e, 0x0c, 0x54, 0x49, 0xe6, 0xec, - /* (2^425)P */ 0x3c, 0x1d, 0x5a, 0xa5, 0xda, 0xad, 0xdd, 0xc2, 0xae, 0xac, 0x6f, 0x86, 0x75, 0x31, 0x91, 0x64, 0x45, 0x9d, 0xa4, 0xf0, 0x81, 0xf1, 0x0e, 0xba, 0x74, 0xaf, 0x7b, 0xcd, 0x6f, 0xfe, 0xac, 0x4e, 0xdb, 0x4e, 0x45, 0x35, 0x36, 0xc5, 0xc0, 0x6c, 0x3d, 0x64, 0xf4, 0xd8, 0x07, 0x62, 0xd1, 0xec, 0xf3, 0xfc, 0x93, 0xc9, 0x28, 0x0c, 0x2c, 0xf3, - /* (2^426)P */ 0x0c, 0x69, 0x2b, 0x5c, 0xb6, 0x41, 0x69, 0xf1, 0xa4, 0xf1, 0x5b, 0x75, 0x4c, 0x42, 0x8b, 0x47, 0xeb, 0x69, 0xfb, 0xa8, 0xe6, 0xf9, 0x7b, 0x48, 0x50, 0xaf, 0xd3, 0xda, 0xb2, 0x35, 0x10, 0xb5, 0x5b, 0x40, 0x90, 0x39, 0xc9, 0x07, 0x06, 0x73, 0x26, 0x20, 0x95, 0x01, 0xa4, 0x2d, 0xf0, 0xe7, 0x2e, 0x00, 0x7d, 0x41, 0x09, 0x68, 0x13, 0xc4, - /* (2^427)P */ 0xbe, 0x38, 0x78, 0xcf, 0xc9, 0x4f, 0x36, 0xca, 0x09, 0x61, 0x31, 0x3c, 0x57, 0x2e, 0xec, 0x17, 0xa4, 0x7d, 0x19, 0x2b, 0x9b, 0x5b, 0xbe, 0x8f, 0xd6, 0xc5, 0x2f, 0x86, 0xf2, 0x64, 0x76, 0x17, 0x00, 0x6e, 0x1a, 0x8c, 0x67, 0x1b, 0x68, 0xeb, 0x15, 0xa2, 0xd6, 0x09, 0x91, 0xdd, 0x23, 0x0d, 0x98, 0xb2, 0x10, 0x19, 0x55, 0x9b, 0x63, 0xf2, - /* (2^428)P */ 0x51, 0x1f, 0x93, 0xea, 0x2a, 0x3a, 0xfa, 0x41, 0xc0, 0x57, 0xfb, 0x74, 0xa6, 0x65, 0x09, 0x56, 0x14, 0xb6, 0x12, 0xaa, 0xb3, 0x1a, 0x8d, 0x3b, 0x76, 0x91, 0x7a, 0x23, 0x56, 0x9c, 0x6a, 0xc0, 0xe0, 0x3c, 0x3f, 0xb5, 0x1a, 0xf4, 0x57, 0x71, 0x93, 0x2b, 0xb1, 0xa7, 0x70, 0x57, 0x22, 0x80, 0xf5, 0xb8, 0x07, 0x77, 0x87, 0x0c, 0xbe, 0x83, - /* (2^429)P */ 0x07, 0x9b, 0x0e, 0x52, 0x38, 0x63, 0x13, 0x86, 0x6a, 0xa6, 0xb4, 0xd2, 0x60, 0x68, 0x9a, 0x99, 0x82, 0x0a, 0x04, 0x5f, 0x89, 0x7a, 0x1a, 0x2a, 0xae, 0x2d, 0x35, 0x0c, 0x1e, 0xad, 0xef, 0x4f, 0x9a, 0xfc, 0xc8, 0xd9, 0xcf, 0x9d, 0x48, 0x71, 0xa5, 0x55, 0x79, 0x73, 0x39, 0x1b, 0xd8, 0x73, 0xec, 0x9b, 0x03, 0x16, 0xd8, 0x82, 0xf7, 0x67, - /* (2^430)P */ 0x52, 0x67, 0x42, 0x21, 0xc9, 0x40, 0x78, 0x82, 0x2b, 0x95, 0x2d, 0x20, 0x92, 0xd1, 0xe2, 0x61, 0x25, 0xb0, 0xc6, 0x9c, 0x20, 0x59, 0x8e, 0x28, 0x6f, 0xf3, 0xfd, 0xd3, 0xc1, 0x32, 0x43, 0xc9, 0xa6, 0x08, 0x7a, 0x77, 0x9c, 0x4c, 0x8c, 0x33, 0x71, 0x13, 0x69, 0xe3, 0x52, 0x30, 0xa7, 0xf5, 0x07, 0x67, 0xac, 0xad, 0x46, 0x8a, 0x26, 0x25, - /* (2^431)P */ 0xda, 0x86, 0xc4, 0xa2, 0x71, 0x56, 0xdd, 0xd2, 0x48, 0xd3, 0xde, 0x42, 0x63, 0x01, 0xa7, 0x2c, 0x92, 0x83, 0x6f, 0x2e, 0xd8, 0x1e, 0x3f, 0xc1, 0xc5, 0x42, 0x4e, 0x34, 0x19, 0x54, 0x6e, 0x35, 0x2c, 0x51, 0x2e, 0xfd, 0x0f, 0x9a, 0x45, 0x66, 0x5e, 0x4a, 0x83, 0xda, 0x0a, 0x53, 0x68, 0x63, 0xfa, 0xce, 0x47, 0x20, 0xd3, 0x34, 0xba, 0x0d, - /* (2^432)P */ 0xd0, 0xe9, 0x64, 0xa4, 0x61, 0x4b, 0x86, 0xe5, 0x93, 0x6f, 0xda, 0x0e, 0x31, 0x7e, 0x6e, 0xe3, 0xc6, 0x73, 0xd8, 0xa3, 0x08, 0x57, 0x52, 0xcd, 0x51, 0x63, 0x1d, 0x9f, 0x93, 0x00, 0x62, 0x91, 0x26, 0x21, 0xa7, 0xdd, 0x25, 0x0f, 0x09, 0x0d, 0x35, 0xad, 0xcf, 0x11, 0x8e, 0x6e, 0xe8, 0xae, 0x1d, 0x95, 0xcb, 0x88, 0xf8, 0x70, 0x7b, 0x91, - /* (2^433)P */ 0x0c, 0x19, 0x5c, 0xd9, 0x8d, 0xda, 0x9d, 0x2c, 0x90, 0x54, 0x65, 0xe8, 0xb6, 0x35, 0x50, 0xae, 0xea, 0xae, 0x43, 0xb7, 0x1e, 0x99, 0x8b, 0x4c, 0x36, 0x4e, 0xe4, 0x1e, 0xc4, 0x64, 0x43, 0xb6, 0xeb, 0xd4, 0xe9, 0x60, 0x22, 0xee, 0xcf, 0xb8, 0x52, 0x1b, 0xf0, 0x04, 0xce, 0xbc, 0x2b, 0xf0, 0xbe, 0xcd, 0x44, 0x74, 0x1e, 0x1f, 0x63, 0xf9, - /* (2^434)P */ 0xe1, 0x3f, 0x95, 0x94, 0xb2, 0xb6, 0x31, 0xa9, 0x1b, 0xdb, 0xfd, 0x0e, 0xdb, 0xdd, 0x1a, 0x22, 0x78, 0x60, 0x9f, 0x75, 0x5f, 0x93, 0x06, 0x0c, 0xd8, 0xbb, 0xa2, 0x85, 0x2b, 0x5e, 0xc0, 0x9b, 0xa8, 0x5d, 0xaf, 0x93, 0x91, 0x91, 0x47, 0x41, 0x1a, 0xfc, 0xb4, 0x51, 0x85, 0xad, 0x69, 0x4d, 0x73, 0x69, 0xd5, 0x4e, 0x82, 0xfb, 0x66, 0xcb, - /* (2^435)P */ 0x7c, 0xbe, 0xc7, 0x51, 0xc4, 0x74, 0x6e, 0xab, 0xfd, 0x41, 0x4f, 0x76, 0x4f, 0x24, 0x03, 0xd6, 0x2a, 0xb7, 0x42, 0xb4, 0xda, 0x41, 0x2c, 0x82, 0x48, 0x4c, 0x7f, 0x6f, 0x25, 0x5d, 0x36, 0xd4, 0x69, 0xf5, 0xef, 0x02, 0x81, 0xea, 0x6f, 0x19, 0x69, 0xe8, 0x6f, 0x5b, 0x2f, 0x14, 0x0e, 0x6f, 0x89, 0xb4, 0xb5, 0xd8, 0xae, 0xef, 0x7b, 0x87, - /* (2^436)P */ 0xe9, 0x91, 0xa0, 0x8b, 0xc9, 0xe0, 0x01, 0x90, 0x37, 0xc1, 0x6f, 0xdc, 0x5e, 0xf7, 0xbf, 0x43, 0x00, 0xaa, 0x10, 0x76, 0x76, 0x18, 0x6e, 0x19, 0x1e, 0x94, 0x50, 0x11, 0x0a, 0xd1, 0xe2, 0xdb, 0x08, 0x21, 0xa0, 0x1f, 0xdb, 0x54, 0xfe, 0xea, 0x6e, 0xa3, 0x68, 0x56, 0x87, 0x0b, 0x22, 0x4e, 0x66, 0xf3, 0x82, 0x82, 0x00, 0xcd, 0xd4, 0x12, - /* (2^437)P */ 0x25, 0x8e, 0x24, 0x77, 0x64, 0x4c, 0xe0, 0xf8, 0x18, 0xc0, 0xdc, 0xc7, 0x1b, 0x35, 0x65, 0xde, 0x67, 0x41, 0x5e, 0x6f, 0x90, 0x82, 0xa7, 0x2e, 0x6d, 0xf1, 0x47, 0xb4, 0x92, 0x9c, 0xfd, 0x6a, 0x9a, 0x41, 0x36, 0x20, 0x24, 0x58, 0xc3, 0x59, 0x07, 0x9a, 0xfa, 0x9f, 0x03, 0xcb, 0xc7, 0x69, 0x37, 0x60, 0xe1, 0xab, 0x13, 0x72, 0xee, 0xa2, - /* (2^438)P */ 0x74, 0x78, 0xfb, 0x13, 0xcb, 0x8e, 0x37, 0x1a, 0xf6, 0x1d, 0x17, 0x83, 0x06, 0xd4, 0x27, 0x06, 0x21, 0xe8, 0xda, 0xdf, 0x6b, 0xf3, 0x83, 0x6b, 0x34, 0x8a, 0x8c, 0xee, 0x01, 0x05, 0x5b, 0xed, 0xd3, 0x1b, 0xc9, 0x64, 0x83, 0xc9, 0x49, 0xc2, 0x57, 0x1b, 0xdd, 0xcf, 0xf1, 0x9d, 0x63, 0xee, 0x1c, 0x0d, 0xa0, 0x0a, 0x73, 0x1f, 0x5b, 0x32, - /* (2^439)P */ 0x29, 0xce, 0x1e, 0xc0, 0x6a, 0xf5, 0xeb, 0x99, 0x5a, 0x39, 0x23, 0xe9, 0xdd, 0xac, 0x44, 0x88, 0xbc, 0x80, 0x22, 0xde, 0x2c, 0xcb, 0xa8, 0x3b, 0xff, 0xf7, 0x6f, 0xc7, 0x71, 0x72, 0xa8, 0xa3, 0xf6, 0x4d, 0xc6, 0x75, 0xda, 0x80, 0xdc, 0xd9, 0x30, 0xd9, 0x07, 0x50, 0x5a, 0x54, 0x7d, 0xda, 0x39, 0x6f, 0x78, 0x94, 0xbf, 0x25, 0x98, 0xdc, - /* (2^440)P */ 0x01, 0x26, 0x62, 0x44, 0xfb, 0x0f, 0x11, 0x72, 0x73, 0x0a, 0x16, 0xc7, 0x16, 0x9c, 0x9b, 0x37, 0xd8, 0xff, 0x4f, 0xfe, 0x57, 0xdb, 0xae, 0xef, 0x7d, 0x94, 0x30, 0x04, 0x70, 0x83, 0xde, 0x3c, 0xd4, 0xb5, 0x70, 0xda, 0xa7, 0x55, 0xc8, 0x19, 0xe1, 0x36, 0x15, 0x61, 0xe7, 0x3b, 0x7d, 0x85, 0xbb, 0xf3, 0x42, 0x5a, 0x94, 0xf4, 0x53, 0x2a, - /* (2^441)P */ 0x14, 0x60, 0xa6, 0x0b, 0x83, 0xe1, 0x23, 0x77, 0xc0, 0xce, 0x50, 0xed, 0x35, 0x8d, 0x98, 0x99, 0x7d, 0xf5, 0x8d, 0xce, 0x94, 0x25, 0xc8, 0x0f, 0x6d, 0xfa, 0x4a, 0xa4, 0x3a, 0x1f, 0x66, 0xfb, 0x5a, 0x64, 0xaf, 0x8b, 0x54, 0x54, 0x44, 0x3f, 0x5b, 0x88, 0x61, 0xe4, 0x48, 0x45, 0x26, 0x20, 0xbe, 0x0d, 0x06, 0xbb, 0x65, 0x59, 0xe1, 0x36, - /* (2^442)P */ 0xb7, 0x98, 0xce, 0xa3, 0xe3, 0xee, 0x11, 0x1b, 0x9e, 0x24, 0x59, 0x75, 0x31, 0x37, 0x44, 0x6f, 0x6b, 0x9e, 0xec, 0xb7, 0x44, 0x01, 0x7e, 0xab, 0xbb, 0x69, 0x5d, 0x11, 0xb0, 0x30, 0x64, 0xea, 0x91, 0xb4, 0x7a, 0x8c, 0x02, 0x4c, 0xb9, 0x10, 0xa7, 0xc7, 0x79, 0xe6, 0xdc, 0x77, 0xe3, 0xc8, 0xef, 0x3e, 0xf9, 0x38, 0x81, 0xce, 0x9a, 0xb2, - /* (2^443)P */ 0x91, 0x12, 0x76, 0xd0, 0x10, 0xb4, 0xaf, 0xe1, 0x89, 0x3a, 0x93, 0x6b, 0x5c, 0x19, 0x5f, 0x24, 0xed, 0x04, 0x92, 0xc7, 0xf0, 0x00, 0x08, 0xc1, 0x92, 0xff, 0x90, 0xdb, 0xb2, 0xbf, 0xdf, 0x49, 0xcd, 0xbd, 0x5c, 0x6e, 0xbf, 0x16, 0xbb, 0x61, 0xf9, 0x20, 0x33, 0x35, 0x93, 0x11, 0xbc, 0x59, 0x69, 0xce, 0x18, 0x9f, 0xf8, 0x7b, 0xa1, 0x6e, - /* (2^444)P */ 0xa1, 0xf4, 0xaf, 0xad, 0xf8, 0xe6, 0x99, 0xd2, 0xa1, 0x4d, 0xde, 0x56, 0xc9, 0x7b, 0x0b, 0x11, 0x3e, 0xbf, 0x89, 0x1a, 0x9a, 0x90, 0xe5, 0xe2, 0xa6, 0x37, 0x88, 0xa1, 0x68, 0x59, 0xae, 0x8c, 0xec, 0x02, 0x14, 0x8d, 0xb7, 0x2e, 0x25, 0x75, 0x7f, 0x76, 0x1a, 0xd3, 0x4d, 0xad, 0x8a, 0x00, 0x6c, 0x96, 0x49, 0xa4, 0xc3, 0x2e, 0x5c, 0x7b, - /* (2^445)P */ 0x26, 0x53, 0xf7, 0xda, 0xa8, 0x01, 0x14, 0xb1, 0x63, 0xe3, 0xc3, 0x89, 0x88, 0xb0, 0x85, 0x40, 0x2b, 0x26, 0x9a, 0x10, 0x1a, 0x70, 0x33, 0xf4, 0x50, 0x9d, 0x4d, 0xd8, 0x64, 0xc6, 0x0f, 0xe1, 0x17, 0xc8, 0x10, 0x4b, 0xfc, 0xa0, 0xc9, 0xba, 0x2c, 0x98, 0x09, 0xf5, 0x84, 0xb6, 0x7c, 0x4e, 0xa3, 0xe3, 0x81, 0x1b, 0x32, 0x60, 0x02, 0xdd, - /* (2^446)P */ 0xa3, 0xe5, 0x86, 0xd4, 0x43, 0xa8, 0xd1, 0x98, 0x9d, 0x9d, 0xdb, 0x04, 0xcf, 0x6e, 0x35, 0x05, 0x30, 0x53, 0x3b, 0xbc, 0x90, 0x00, 0x4a, 0xc5, 0x40, 0x2a, 0x0f, 0xde, 0x1a, 0xd7, 0x36, 0x27, 0x44, 0x62, 0xa6, 0xac, 0x9d, 0xd2, 0x70, 0x69, 0x14, 0x39, 0x9b, 0xd1, 0xc3, 0x0a, 0x3a, 0x82, 0x0e, 0xf1, 0x94, 0xd7, 0x42, 0x94, 0xd5, 0x7d, - /* (2^447)P */ 0x04, 0xc0, 0x6e, 0x12, 0x90, 0x70, 0xf9, 0xdf, 0xf7, 0xc9, 0x86, 0xc0, 0xe6, 0x92, 0x8b, 0x0a, 0xa1, 0xc1, 0x3b, 0xcc, 0x33, 0xb7, 0xf0, 0xeb, 0x51, 0x50, 0x80, 0x20, 0x69, 0x1c, 0x4f, 0x89, 0x05, 0x1e, 0xe4, 0x7a, 0x0a, 0xc2, 0xf0, 0xf5, 0x78, 0x91, 0x76, 0x34, 0x45, 0xdc, 0x24, 0x53, 0x24, 0x98, 0xe2, 0x73, 0x6f, 0xe6, 0x46, 0x67, -} diff --git a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/constants.go b/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/constants.go deleted file mode 100644 index b6b236e..0000000 --- a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/constants.go +++ /dev/null @@ -1,71 +0,0 @@ -package goldilocks - -import fp "github.com/cloudflare/circl/math/fp448" - -var ( - // genX is the x-coordinate of the generator of Goldilocks curve. - genX = fp.Elt{ - 0x5e, 0xc0, 0x0c, 0xc7, 0x2b, 0xa8, 0x26, 0x26, - 0x8e, 0x93, 0x00, 0x8b, 0xe1, 0x80, 0x3b, 0x43, - 0x11, 0x65, 0xb6, 0x2a, 0xf7, 0x1a, 0xae, 0x12, - 0x64, 0xa4, 0xd3, 0xa3, 0x24, 0xe3, 0x6d, 0xea, - 0x67, 0x17, 0x0f, 0x47, 0x70, 0x65, 0x14, 0x9e, - 0xda, 0x36, 0xbf, 0x22, 0xa6, 0x15, 0x1d, 0x22, - 0xed, 0x0d, 0xed, 0x6b, 0xc6, 0x70, 0x19, 0x4f, - } - // genY is the y-coordinate of the generator of Goldilocks curve. - genY = fp.Elt{ - 0x14, 0xfa, 0x30, 0xf2, 0x5b, 0x79, 0x08, 0x98, - 0xad, 0xc8, 0xd7, 0x4e, 0x2c, 0x13, 0xbd, 0xfd, - 0xc4, 0x39, 0x7c, 0xe6, 0x1c, 0xff, 0xd3, 0x3a, - 0xd7, 0xc2, 0xa0, 0x05, 0x1e, 0x9c, 0x78, 0x87, - 0x40, 0x98, 0xa3, 0x6c, 0x73, 0x73, 0xea, 0x4b, - 0x62, 0xc7, 0xc9, 0x56, 0x37, 0x20, 0x76, 0x88, - 0x24, 0xbc, 0xb6, 0x6e, 0x71, 0x46, 0x3f, 0x69, - } - // paramD is -39081 in Fp. - paramD = fp.Elt{ - 0x56, 0x67, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - } - // order is 2^446-0x8335dc163bb124b65129c96fde933d8d723a70aadc873d6d54a7bb0d, - // which is the number of points in the prime subgroup. - order = Scalar{ - 0xf3, 0x44, 0x58, 0xab, 0x92, 0xc2, 0x78, 0x23, - 0x55, 0x8f, 0xc5, 0x8d, 0x72, 0xc2, 0x6c, 0x21, - 0x90, 0x36, 0xd6, 0xae, 0x49, 0xdb, 0x4e, 0xc4, - 0xe9, 0x23, 0xca, 0x7c, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f, - } - // residue448 is 2^448 mod order. - residue448 = [4]uint64{ - 0x721cf5b5529eec34, 0x7a4cf635c8e9c2ab, 0xeec492d944a725bf, 0x20cd77058, - } - // invFour is 1/4 mod order. - invFour = Scalar{ - 0x3d, 0x11, 0xd6, 0xaa, 0xa4, 0x30, 0xde, 0x48, - 0xd5, 0x63, 0x71, 0xa3, 0x9c, 0x30, 0x5b, 0x08, - 0xa4, 0x8d, 0xb5, 0x6b, 0xd2, 0xb6, 0x13, 0x71, - 0xfa, 0x88, 0x32, 0xdf, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x0f, - } - // paramDTwist is -39082 in Fp. The D parameter of the twist curve. - paramDTwist = fp.Elt{ - 0x55, 0x67, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - } -) diff --git a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/curve.go b/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/curve.go deleted file mode 100644 index 1f16514..0000000 --- a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/curve.go +++ /dev/null @@ -1,84 +0,0 @@ -// Package goldilocks provides elliptic curve operations over the goldilocks curve. -package goldilocks - -import fp "github.com/cloudflare/circl/math/fp448" - -// Curve is the Goldilocks curve x^2+y^2=z^2-39081x^2y^2. -type Curve struct{} - -// Identity returns the identity point. -func (Curve) Identity() *Point { - return &Point{ - y: fp.One(), - z: fp.One(), - } -} - -// IsOnCurve returns true if the point lies on the curve. -func (Curve) IsOnCurve(P *Point) bool { - x2, y2, t, t2, z2 := &fp.Elt{}, &fp.Elt{}, &fp.Elt{}, &fp.Elt{}, &fp.Elt{} - rhs, lhs := &fp.Elt{}, &fp.Elt{} - // Check z != 0 - eq0 := !fp.IsZero(&P.z) - - fp.Mul(t, &P.ta, &P.tb) // t = ta*tb - fp.Sqr(x2, &P.x) // x^2 - fp.Sqr(y2, &P.y) // y^2 - fp.Sqr(z2, &P.z) // z^2 - fp.Sqr(t2, t) // t^2 - fp.Add(lhs, x2, y2) // x^2 + y^2 - fp.Mul(rhs, t2, ¶mD) // dt^2 - fp.Add(rhs, rhs, z2) // z^2 + dt^2 - fp.Sub(lhs, lhs, rhs) // x^2 + y^2 - (z^2 + dt^2) - eq1 := fp.IsZero(lhs) - - fp.Mul(lhs, &P.x, &P.y) // xy - fp.Mul(rhs, t, &P.z) // tz - fp.Sub(lhs, lhs, rhs) // xy - tz - eq2 := fp.IsZero(lhs) - - return eq0 && eq1 && eq2 -} - -// Generator returns the generator point. -func (Curve) Generator() *Point { - return &Point{ - x: genX, - y: genY, - z: fp.One(), - ta: genX, - tb: genY, - } -} - -// Order returns the number of points in the prime subgroup. -func (Curve) Order() Scalar { return order } - -// Double returns 2P. -func (Curve) Double(P *Point) *Point { R := *P; R.Double(); return &R } - -// Add returns P+Q. -func (Curve) Add(P, Q *Point) *Point { R := *P; R.Add(Q); return &R } - -// ScalarMult returns kP. This function runs in constant time. -func (e Curve) ScalarMult(k *Scalar, P *Point) *Point { - k4 := &Scalar{} - k4.divBy4(k) - return e.pull(twistCurve{}.ScalarMult(k4, e.push(P))) -} - -// ScalarBaseMult returns kG where G is the generator point. This function runs in constant time. -func (e Curve) ScalarBaseMult(k *Scalar) *Point { - k4 := &Scalar{} - k4.divBy4(k) - return e.pull(twistCurve{}.ScalarBaseMult(k4)) -} - -// CombinedMult returns mG+nP, where G is the generator point. This function is non-constant time. -func (e Curve) CombinedMult(m, n *Scalar, P *Point) *Point { - m4 := &Scalar{} - n4 := &Scalar{} - m4.divBy4(m) - n4.divBy4(n) - return e.pull(twistCurve{}.CombinedMult(m4, n4, twistCurve{}.pull(P))) -} diff --git a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/isogeny.go b/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/isogeny.go deleted file mode 100644 index b1daab8..0000000 --- a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/isogeny.go +++ /dev/null @@ -1,52 +0,0 @@ -package goldilocks - -import fp "github.com/cloudflare/circl/math/fp448" - -func (Curve) pull(P *twistPoint) *Point { return twistCurve{}.push(P) } -func (twistCurve) pull(P *Point) *twistPoint { return Curve{}.push(P) } - -// push sends a point on the Goldilocks curve to a point on the twist curve. -func (Curve) push(P *Point) *twistPoint { - Q := &twistPoint{} - Px, Py, Pz := &P.x, &P.y, &P.z - a, b, c, d, e, f, g, h := &Q.x, &Q.y, &Q.z, &fp.Elt{}, &Q.ta, &Q.x, &Q.y, &Q.tb - fp.Add(e, Px, Py) // x+y - fp.Sqr(a, Px) // A = x^2 - fp.Sqr(b, Py) // B = y^2 - fp.Sqr(c, Pz) // z^2 - fp.Add(c, c, c) // C = 2*z^2 - *d = *a // D = A - fp.Sqr(e, e) // (x+y)^2 - fp.Sub(e, e, a) // (x+y)^2-A - fp.Sub(e, e, b) // E = (x+y)^2-A-B - fp.Add(h, b, d) // H = B+D - fp.Sub(g, b, d) // G = B-D - fp.Sub(f, c, h) // F = C-H - fp.Mul(&Q.z, f, g) // Z = F * G - fp.Mul(&Q.x, e, f) // X = E * F - fp.Mul(&Q.y, g, h) // Y = G * H, // T = E * H - return Q -} - -// push sends a point on the twist curve to a point on the Goldilocks curve. -func (twistCurve) push(P *twistPoint) *Point { - Q := &Point{} - Px, Py, Pz := &P.x, &P.y, &P.z - a, b, c, d, e, f, g, h := &Q.x, &Q.y, &Q.z, &fp.Elt{}, &Q.ta, &Q.x, &Q.y, &Q.tb - fp.Add(e, Px, Py) // x+y - fp.Sqr(a, Px) // A = x^2 - fp.Sqr(b, Py) // B = y^2 - fp.Sqr(c, Pz) // z^2 - fp.Add(c, c, c) // C = 2*z^2 - fp.Neg(d, a) // D = -A - fp.Sqr(e, e) // (x+y)^2 - fp.Sub(e, e, a) // (x+y)^2-A - fp.Sub(e, e, b) // E = (x+y)^2-A-B - fp.Add(h, b, d) // H = B+D - fp.Sub(g, b, d) // G = B-D - fp.Sub(f, c, h) // F = C-H - fp.Mul(&Q.z, f, g) // Z = F * G - fp.Mul(&Q.x, e, f) // X = E * F - fp.Mul(&Q.y, g, h) // Y = G * H, // T = E * H - return Q -} diff --git a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/point.go b/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/point.go deleted file mode 100644 index 11f73de..0000000 --- a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/point.go +++ /dev/null @@ -1,171 +0,0 @@ -package goldilocks - -import ( - "errors" - "fmt" - - fp "github.com/cloudflare/circl/math/fp448" -) - -// Point is a point on the Goldilocks Curve. -type Point struct{ x, y, z, ta, tb fp.Elt } - -func (P Point) String() string { - return fmt.Sprintf("x: %v\ny: %v\nz: %v\nta: %v\ntb: %v", P.x, P.y, P.z, P.ta, P.tb) -} - -// FromAffine creates a point from affine coordinates. -func FromAffine(x, y *fp.Elt) (*Point, error) { - P := &Point{ - x: *x, - y: *y, - z: fp.One(), - ta: *x, - tb: *y, - } - if !(Curve{}).IsOnCurve(P) { - return P, errors.New("point not on curve") - } - return P, nil -} - -// isLessThan returns true if 0 <= x < y, and assumes that slices are of the -// same length and are interpreted in little-endian order. -func isLessThan(x, y []byte) bool { - i := len(x) - 1 - for i > 0 && x[i] == y[i] { - i-- - } - return x[i] < y[i] -} - -// FromBytes returns a point from the input buffer. -func FromBytes(in []byte) (*Point, error) { - if len(in) < fp.Size+1 { - return nil, errors.New("wrong input length") - } - err := errors.New("invalid decoding") - P := &Point{} - signX := in[fp.Size] >> 7 - copy(P.y[:], in[:fp.Size]) - p := fp.P() - if !isLessThan(P.y[:], p[:]) { - return nil, err - } - - u, v := &fp.Elt{}, &fp.Elt{} - one := fp.One() - fp.Sqr(u, &P.y) // u = y^2 - fp.Mul(v, u, ¶mD) // v = dy^2 - fp.Sub(u, u, &one) // u = y^2-1 - fp.Sub(v, v, &one) // v = dy^2-1 - isQR := fp.InvSqrt(&P.x, u, v) // x = sqrt(u/v) - if !isQR { - return nil, err - } - fp.Modp(&P.x) // x = x mod p - if fp.IsZero(&P.x) && signX == 1 { - return nil, err - } - if signX != (P.x[0] & 1) { - fp.Neg(&P.x, &P.x) - } - P.ta = P.x - P.tb = P.y - P.z = fp.One() - return P, nil -} - -// IsIdentity returns true is P is the identity Point. -func (P *Point) IsIdentity() bool { - return fp.IsZero(&P.x) && !fp.IsZero(&P.y) && !fp.IsZero(&P.z) && P.y == P.z -} - -// IsEqual returns true if P is equivalent to Q. -func (P *Point) IsEqual(Q *Point) bool { - l, r := &fp.Elt{}, &fp.Elt{} - fp.Mul(l, &P.x, &Q.z) - fp.Mul(r, &Q.x, &P.z) - fp.Sub(l, l, r) - b := fp.IsZero(l) - fp.Mul(l, &P.y, &Q.z) - fp.Mul(r, &Q.y, &P.z) - fp.Sub(l, l, r) - b = b && fp.IsZero(l) - fp.Mul(l, &P.ta, &P.tb) - fp.Mul(l, l, &Q.z) - fp.Mul(r, &Q.ta, &Q.tb) - fp.Mul(r, r, &P.z) - fp.Sub(l, l, r) - b = b && fp.IsZero(l) - return b -} - -// Neg obtains the inverse of the Point. -func (P *Point) Neg() { fp.Neg(&P.x, &P.x); fp.Neg(&P.ta, &P.ta) } - -// ToAffine returns the x,y affine coordinates of P. -func (P *Point) ToAffine() (x, y fp.Elt) { - fp.Inv(&P.z, &P.z) // 1/z - fp.Mul(&P.x, &P.x, &P.z) // x/z - fp.Mul(&P.y, &P.y, &P.z) // y/z - fp.Modp(&P.x) - fp.Modp(&P.y) - fp.SetOne(&P.z) - P.ta = P.x - P.tb = P.y - return P.x, P.y -} - -// ToBytes stores P into a slice of bytes. -func (P *Point) ToBytes(out []byte) error { - if len(out) < fp.Size+1 { - return errors.New("invalid decoding") - } - x, y := P.ToAffine() - out[fp.Size] = (x[0] & 1) << 7 - return fp.ToBytes(out[:fp.Size], &y) -} - -// MarshalBinary encodes the receiver into a binary form and returns the result. -func (P *Point) MarshalBinary() (data []byte, err error) { - data = make([]byte, fp.Size+1) - err = P.ToBytes(data[:fp.Size+1]) - return data, err -} - -// UnmarshalBinary must be able to decode the form generated by MarshalBinary. -func (P *Point) UnmarshalBinary(data []byte) error { Q, err := FromBytes(data); *P = *Q; return err } - -// Double sets P = 2Q. -func (P *Point) Double() { P.Add(P) } - -// Add sets P =P+Q.. -func (P *Point) Add(Q *Point) { - // This is formula (5) from "Twisted Edwards Curves Revisited" by - // Hisil H., Wong K.KH., Carter G., Dawson E. (2008) - // https://doi.org/10.1007/978-3-540-89255-7_20 - x1, y1, z1, ta1, tb1 := &P.x, &P.y, &P.z, &P.ta, &P.tb - x2, y2, z2, ta2, tb2 := &Q.x, &Q.y, &Q.z, &Q.ta, &Q.tb - x3, y3, z3, E, H := &P.x, &P.y, &P.z, &P.ta, &P.tb - A, B, C, D := &fp.Elt{}, &fp.Elt{}, &fp.Elt{}, &fp.Elt{} - t1, t2, F, G := C, D, &fp.Elt{}, &fp.Elt{} - fp.Mul(t1, ta1, tb1) // t1 = ta1*tb1 - fp.Mul(t2, ta2, tb2) // t2 = ta2*tb2 - fp.Mul(A, x1, x2) // A = x1*x2 - fp.Mul(B, y1, y2) // B = y1*y2 - fp.Mul(C, t1, t2) // t1*t2 - fp.Mul(C, C, ¶mD) // C = d*t1*t2 - fp.Mul(D, z1, z2) // D = z1*z2 - fp.Add(F, x1, y1) // x1+y1 - fp.Add(E, x2, y2) // x2+y2 - fp.Mul(E, E, F) // (x1+y1)*(x2+y2) - fp.Sub(E, E, A) // (x1+y1)*(x2+y2)-A - fp.Sub(E, E, B) // E = (x1+y1)*(x2+y2)-A-B - fp.Sub(F, D, C) // F = D-C - fp.Add(G, D, C) // G = D+C - fp.Sub(H, B, A) // H = B-A - fp.Mul(z3, F, G) // Z = F * G - fp.Mul(x3, E, F) // X = E * F - fp.Mul(y3, G, H) // Y = G * H, T = E * H -} diff --git a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/scalar.go b/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/scalar.go deleted file mode 100644 index f98117b..0000000 --- a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/scalar.go +++ /dev/null @@ -1,203 +0,0 @@ -package goldilocks - -import ( - "encoding/binary" - "math/bits" -) - -// ScalarSize is the size (in bytes) of scalars. -const ScalarSize = 56 // 448 / 8 - -// _N is the number of 64-bit words to store scalars. -const _N = 7 // 448 / 64 - -// Scalar represents a positive integer stored in little-endian order. -type Scalar [ScalarSize]byte - -type scalar64 [_N]uint64 - -func (z *scalar64) fromScalar(x *Scalar) { - z[0] = binary.LittleEndian.Uint64(x[0*8 : 1*8]) - z[1] = binary.LittleEndian.Uint64(x[1*8 : 2*8]) - z[2] = binary.LittleEndian.Uint64(x[2*8 : 3*8]) - z[3] = binary.LittleEndian.Uint64(x[3*8 : 4*8]) - z[4] = binary.LittleEndian.Uint64(x[4*8 : 5*8]) - z[5] = binary.LittleEndian.Uint64(x[5*8 : 6*8]) - z[6] = binary.LittleEndian.Uint64(x[6*8 : 7*8]) -} - -func (z *scalar64) toScalar(x *Scalar) { - binary.LittleEndian.PutUint64(x[0*8:1*8], z[0]) - binary.LittleEndian.PutUint64(x[1*8:2*8], z[1]) - binary.LittleEndian.PutUint64(x[2*8:3*8], z[2]) - binary.LittleEndian.PutUint64(x[3*8:4*8], z[3]) - binary.LittleEndian.PutUint64(x[4*8:5*8], z[4]) - binary.LittleEndian.PutUint64(x[5*8:6*8], z[5]) - binary.LittleEndian.PutUint64(x[6*8:7*8], z[6]) -} - -// add calculates z = x + y. Assumes len(z) > max(len(x),len(y)). -func add(z, x, y []uint64) uint64 { - l, L, zz := len(x), len(y), y - if l > L { - l, L, zz = L, l, x - } - c := uint64(0) - for i := 0; i < l; i++ { - z[i], c = bits.Add64(x[i], y[i], c) - } - for i := l; i < L; i++ { - z[i], c = bits.Add64(zz[i], 0, c) - } - return c -} - -// sub calculates z = x - y. Assumes len(z) > max(len(x),len(y)). -func sub(z, x, y []uint64) uint64 { - l, L, zz := len(x), len(y), y - if l > L { - l, L, zz = L, l, x - } - c := uint64(0) - for i := 0; i < l; i++ { - z[i], c = bits.Sub64(x[i], y[i], c) - } - for i := l; i < L; i++ { - z[i], c = bits.Sub64(zz[i], 0, c) - } - return c -} - -// mulWord calculates z = x * y. Assumes len(z) >= len(x)+1. -func mulWord(z, x []uint64, y uint64) { - for i := range z { - z[i] = 0 - } - carry := uint64(0) - for i := range x { - hi, lo := bits.Mul64(x[i], y) - lo, cc := bits.Add64(lo, z[i], 0) - hi, _ = bits.Add64(hi, 0, cc) - z[i], cc = bits.Add64(lo, carry, 0) - carry, _ = bits.Add64(hi, 0, cc) - } - z[len(x)] = carry -} - -// Cmov moves x into z if b=1. -func (z *scalar64) Cmov(b uint64, x *scalar64) { - m := uint64(0) - b - for i := range z { - z[i] = (z[i] &^ m) | (x[i] & m) - } -} - -// leftShift shifts to the left the words of z returning the more significant word. -func (z *scalar64) leftShift(low uint64) uint64 { - high := z[_N-1] - for i := _N - 1; i > 0; i-- { - z[i] = z[i-1] - } - z[0] = low - return high -} - -// reduceOneWord calculates z = z + 2^448*x such that the result fits in a Scalar. -func (z *scalar64) reduceOneWord(x uint64) { - prod := (&scalar64{})[:] - mulWord(prod, residue448[:], x) - cc := add(z[:], z[:], prod) - mulWord(prod, residue448[:], cc) - add(z[:], z[:], prod) -} - -// modOrder reduces z mod order. -func (z *scalar64) modOrder() { - var o64, x scalar64 - o64.fromScalar(&order) - // Performs: while (z >= order) { z = z-order } - // At most 8 (eight) iterations reduce 3 bits by subtracting. - for i := 0; i < 8; i++ { - c := sub(x[:], z[:], o64[:]) // (c || x) = z-order - z.Cmov(1-c, &x) // if c != 0 { z = x } - } -} - -// FromBytes stores z = x mod order, where x is a number stored in little-endian order. -func (z *Scalar) FromBytes(x []byte) { - n := len(x) - nCeil := (n + 7) >> 3 - for i := range z { - z[i] = 0 - } - if nCeil < _N { - copy(z[:], x) - return - } - copy(z[:], x[8*(nCeil-_N):]) - var z64 scalar64 - z64.fromScalar(z) - for i := nCeil - _N - 1; i >= 0; i-- { - low := binary.LittleEndian.Uint64(x[8*i:]) - high := z64.leftShift(low) - z64.reduceOneWord(high) - } - z64.modOrder() - z64.toScalar(z) -} - -// divBy4 calculates z = x/4 mod order. -func (z *Scalar) divBy4(x *Scalar) { z.Mul(x, &invFour) } - -// Red reduces z mod order. -func (z *Scalar) Red() { var t scalar64; t.fromScalar(z); t.modOrder(); t.toScalar(z) } - -// Neg calculates z = -z mod order. -func (z *Scalar) Neg() { z.Sub(&order, z) } - -// Add calculates z = x+y mod order. -func (z *Scalar) Add(x, y *Scalar) { - var z64, x64, y64, t scalar64 - x64.fromScalar(x) - y64.fromScalar(y) - c := add(z64[:], x64[:], y64[:]) - add(t[:], z64[:], residue448[:]) - z64.Cmov(c, &t) - z64.modOrder() - z64.toScalar(z) -} - -// Sub calculates z = x-y mod order. -func (z *Scalar) Sub(x, y *Scalar) { - var z64, x64, y64, t scalar64 - x64.fromScalar(x) - y64.fromScalar(y) - c := sub(z64[:], x64[:], y64[:]) - sub(t[:], z64[:], residue448[:]) - z64.Cmov(c, &t) - z64.modOrder() - z64.toScalar(z) -} - -// Mul calculates z = x*y mod order. -func (z *Scalar) Mul(x, y *Scalar) { - var z64, x64, y64 scalar64 - prod := (&[_N + 1]uint64{})[:] - x64.fromScalar(x) - y64.fromScalar(y) - mulWord(prod, x64[:], y64[_N-1]) - copy(z64[:], prod[:_N]) - z64.reduceOneWord(prod[_N]) - for i := _N - 2; i >= 0; i-- { - h := z64.leftShift(0) - z64.reduceOneWord(h) - mulWord(prod, x64[:], y64[i]) - c := add(z64[:], z64[:], prod[:_N]) - z64.reduceOneWord(prod[_N] + c) - } - z64.modOrder() - z64.toScalar(z) -} - -// IsZero returns true if z=0. -func (z *Scalar) IsZero() bool { z.Red(); return *z == Scalar{} } diff --git a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist.go b/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist.go deleted file mode 100644 index 83d7cda..0000000 --- a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist.go +++ /dev/null @@ -1,138 +0,0 @@ -package goldilocks - -import ( - "crypto/subtle" - "math/bits" - - "github.com/cloudflare/circl/internal/conv" - "github.com/cloudflare/circl/math" - fp "github.com/cloudflare/circl/math/fp448" -) - -// twistCurve is -x^2+y^2=1-39082x^2y^2 and is 4-isogenous to Goldilocks. -type twistCurve struct{} - -// Identity returns the identity point. -func (twistCurve) Identity() *twistPoint { - return &twistPoint{ - y: fp.One(), - z: fp.One(), - } -} - -// subYDiv16 update x = (x - y) / 16. -func subYDiv16(x *scalar64, y int64) { - s := uint64(y >> 63) - x0, b0 := bits.Sub64((*x)[0], uint64(y), 0) - x1, b1 := bits.Sub64((*x)[1], s, b0) - x2, b2 := bits.Sub64((*x)[2], s, b1) - x3, b3 := bits.Sub64((*x)[3], s, b2) - x4, b4 := bits.Sub64((*x)[4], s, b3) - x5, b5 := bits.Sub64((*x)[5], s, b4) - x6, _ := bits.Sub64((*x)[6], s, b5) - x[0] = (x0 >> 4) | (x1 << 60) - x[1] = (x1 >> 4) | (x2 << 60) - x[2] = (x2 >> 4) | (x3 << 60) - x[3] = (x3 >> 4) | (x4 << 60) - x[4] = (x4 >> 4) | (x5 << 60) - x[5] = (x5 >> 4) | (x6 << 60) - x[6] = (x6 >> 4) -} - -func recodeScalar(d *[113]int8, k *Scalar) { - var k64 scalar64 - k64.fromScalar(k) - for i := 0; i < 112; i++ { - d[i] = int8((k64[0] & 0x1f) - 16) - subYDiv16(&k64, int64(d[i])) - } - d[112] = int8(k64[0]) -} - -// ScalarMult returns kP. -func (e twistCurve) ScalarMult(k *Scalar, P *twistPoint) *twistPoint { - var TabP [8]preTwistPointProy - var S preTwistPointProy - var d [113]int8 - - var isZero int - if k.IsZero() { - isZero = 1 - } - subtle.ConstantTimeCopy(isZero, k[:], order[:]) - - minusK := *k - isEven := 1 - int(k[0]&0x1) - minusK.Neg() - subtle.ConstantTimeCopy(isEven, k[:], minusK[:]) - recodeScalar(&d, k) - - P.oddMultiples(TabP[:]) - Q := e.Identity() - for i := 112; i >= 0; i-- { - Q.Double() - Q.Double() - Q.Double() - Q.Double() - mask := d[i] >> 7 - absDi := (d[i] + mask) ^ mask - inx := int32((absDi - 1) >> 1) - sig := int((d[i] >> 7) & 0x1) - for j := range TabP { - S.cmov(&TabP[j], uint(subtle.ConstantTimeEq(inx, int32(j)))) - } - S.cneg(sig) - Q.mixAdd(&S) - } - Q.cneg(uint(isEven)) - return Q -} - -const ( - omegaFix = 7 - omegaVar = 5 -) - -// CombinedMult returns mG+nP. -func (e twistCurve) CombinedMult(m, n *Scalar, P *twistPoint) *twistPoint { - nafFix := math.OmegaNAF(conv.BytesLe2BigInt(m[:]), omegaFix) - nafVar := math.OmegaNAF(conv.BytesLe2BigInt(n[:]), omegaVar) - - if len(nafFix) > len(nafVar) { - nafVar = append(nafVar, make([]int32, len(nafFix)-len(nafVar))...) - } else if len(nafFix) < len(nafVar) { - nafFix = append(nafFix, make([]int32, len(nafVar)-len(nafFix))...) - } - - var TabQ [1 << (omegaVar - 2)]preTwistPointProy - P.oddMultiples(TabQ[:]) - Q := e.Identity() - for i := len(nafFix) - 1; i >= 0; i-- { - Q.Double() - // Generator point - if nafFix[i] != 0 { - idxM := absolute(nafFix[i]) >> 1 - R := tabVerif[idxM] - if nafFix[i] < 0 { - R.neg() - } - Q.mixAddZ1(&R) - } - // Variable input point - if nafVar[i] != 0 { - idxN := absolute(nafVar[i]) >> 1 - S := TabQ[idxN] - if nafVar[i] < 0 { - S.neg() - } - Q.mixAdd(&S) - } - } - return Q -} - -// absolute returns always a positive value. -func absolute(x int32) int32 { - mask := x >> 31 - return (x + mask) ^ mask -} diff --git a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistPoint.go b/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistPoint.go deleted file mode 100644 index c55db77..0000000 --- a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistPoint.go +++ /dev/null @@ -1,135 +0,0 @@ -package goldilocks - -import ( - "fmt" - - fp "github.com/cloudflare/circl/math/fp448" -) - -type twistPoint struct{ x, y, z, ta, tb fp.Elt } - -type preTwistPointAffine struct{ addYX, subYX, dt2 fp.Elt } - -type preTwistPointProy struct { - preTwistPointAffine - z2 fp.Elt -} - -func (P *twistPoint) String() string { - return fmt.Sprintf("x: %v\ny: %v\nz: %v\nta: %v\ntb: %v", P.x, P.y, P.z, P.ta, P.tb) -} - -// cneg conditionally negates the point if b=1. -func (P *twistPoint) cneg(b uint) { - t := &fp.Elt{} - fp.Neg(t, &P.x) - fp.Cmov(&P.x, t, b) - fp.Neg(t, &P.ta) - fp.Cmov(&P.ta, t, b) -} - -// Double updates P with 2P. -func (P *twistPoint) Double() { - // This is formula (7) from "Twisted Edwards Curves Revisited" by - // Hisil H., Wong K.KH., Carter G., Dawson E. (2008) - // https://doi.org/10.1007/978-3-540-89255-7_20 - Px, Py, Pz, Pta, Ptb := &P.x, &P.y, &P.z, &P.ta, &P.tb - a, b, c, e, f, g, h := Px, Py, Pz, Pta, Px, Py, Ptb - fp.Add(e, Px, Py) // x+y - fp.Sqr(a, Px) // A = x^2 - fp.Sqr(b, Py) // B = y^2 - fp.Sqr(c, Pz) // z^2 - fp.Add(c, c, c) // C = 2*z^2 - fp.Add(h, a, b) // H = A+B - fp.Sqr(e, e) // (x+y)^2 - fp.Sub(e, e, h) // E = (x+y)^2-A-B - fp.Sub(g, b, a) // G = B-A - fp.Sub(f, c, g) // F = C-G - fp.Mul(Pz, f, g) // Z = F * G - fp.Mul(Px, e, f) // X = E * F - fp.Mul(Py, g, h) // Y = G * H, T = E * H -} - -// mixAdd calculates P= P+Q, where Q is a precomputed point with Z_Q = 1. -func (P *twistPoint) mixAddZ1(Q *preTwistPointAffine) { - fp.Add(&P.z, &P.z, &P.z) // D = 2*z1 (z2=1) - P.coreAddition(Q) -} - -// coreAddition calculates P=P+Q for curves with A=-1. -func (P *twistPoint) coreAddition(Q *preTwistPointAffine) { - // This is the formula following (5) from "Twisted Edwards Curves Revisited" by - // Hisil H., Wong K.KH., Carter G., Dawson E. (2008) - // https://doi.org/10.1007/978-3-540-89255-7_20 - Px, Py, Pz, Pta, Ptb := &P.x, &P.y, &P.z, &P.ta, &P.tb - addYX2, subYX2, dt2 := &Q.addYX, &Q.subYX, &Q.dt2 - a, b, c, d, e, f, g, h := Px, Py, &fp.Elt{}, Pz, Pta, Px, Py, Ptb - fp.Mul(c, Pta, Ptb) // t1 = ta*tb - fp.Sub(h, Py, Px) // y1-x1 - fp.Add(b, Py, Px) // y1+x1 - fp.Mul(a, h, subYX2) // A = (y1-x1)*(y2-x2) - fp.Mul(b, b, addYX2) // B = (y1+x1)*(y2+x2) - fp.Mul(c, c, dt2) // C = 2*D*t1*t2 - fp.Sub(e, b, a) // E = B-A - fp.Add(h, b, a) // H = B+A - fp.Sub(f, d, c) // F = D-C - fp.Add(g, d, c) // G = D+C - fp.Mul(Pz, f, g) // Z = F * G - fp.Mul(Px, e, f) // X = E * F - fp.Mul(Py, g, h) // Y = G * H, T = E * H -} - -func (P *preTwistPointAffine) neg() { - P.addYX, P.subYX = P.subYX, P.addYX - fp.Neg(&P.dt2, &P.dt2) -} - -func (P *preTwistPointAffine) cneg(b int) { - t := &fp.Elt{} - fp.Cswap(&P.addYX, &P.subYX, uint(b)) - fp.Neg(t, &P.dt2) - fp.Cmov(&P.dt2, t, uint(b)) -} - -func (P *preTwistPointAffine) cmov(Q *preTwistPointAffine, b uint) { - fp.Cmov(&P.addYX, &Q.addYX, b) - fp.Cmov(&P.subYX, &Q.subYX, b) - fp.Cmov(&P.dt2, &Q.dt2, b) -} - -// mixAdd calculates P= P+Q, where Q is a precomputed point with Z_Q != 1. -func (P *twistPoint) mixAdd(Q *preTwistPointProy) { - fp.Mul(&P.z, &P.z, &Q.z2) // D = 2*z1*z2 - P.coreAddition(&Q.preTwistPointAffine) -} - -// oddMultiples calculates T[i] = (2*i-1)P for 0 < i < len(T). -func (P *twistPoint) oddMultiples(T []preTwistPointProy) { - if n := len(T); n > 0 { - T[0].FromTwistPoint(P) - _2P := *P - _2P.Double() - R := &preTwistPointProy{} - R.FromTwistPoint(&_2P) - for i := 1; i < n; i++ { - P.mixAdd(R) - T[i].FromTwistPoint(P) - } - } -} - -// cmov conditionally moves Q into P if b=1. -func (P *preTwistPointProy) cmov(Q *preTwistPointProy, b uint) { - P.preTwistPointAffine.cmov(&Q.preTwistPointAffine, b) - fp.Cmov(&P.z2, &Q.z2, b) -} - -// FromTwistPoint precomputes some coordinates of Q for missed addition. -func (P *preTwistPointProy) FromTwistPoint(Q *twistPoint) { - fp.Add(&P.addYX, &Q.y, &Q.x) // addYX = X + Y - fp.Sub(&P.subYX, &Q.y, &Q.x) // subYX = Y - X - fp.Mul(&P.dt2, &Q.ta, &Q.tb) // T = ta*tb - fp.Mul(&P.dt2, &P.dt2, ¶mDTwist) // D*T - fp.Add(&P.dt2, &P.dt2, &P.dt2) // dt2 = 2*D*T - fp.Add(&P.z2, &Q.z, &Q.z) // z2 = 2*Z -} diff --git a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistTables.go b/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistTables.go deleted file mode 100644 index ed432e0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twistTables.go +++ /dev/null @@ -1,216 +0,0 @@ -package goldilocks - -import fp "github.com/cloudflare/circl/math/fp448" - -var tabFixMult = [fxV][fx2w1]preTwistPointAffine{ - { - { - addYX: fp.Elt{0x65, 0x4a, 0xdd, 0xdf, 0xb4, 0x79, 0x60, 0xc8, 0xa1, 0x70, 0xb4, 0x3a, 0x1e, 0x0c, 0x9b, 0x19, 0xe5, 0x48, 0x3f, 0xd7, 0x44, 0x18, 0x18, 0x14, 0x14, 0x27, 0x45, 0xd0, 0x2b, 0x24, 0xd5, 0x93, 0xc3, 0x74, 0x4c, 0x50, 0x70, 0x43, 0x26, 0x05, 0x08, 0x24, 0xca, 0x78, 0x30, 0xc1, 0x06, 0x8d, 0xd4, 0x86, 0x42, 0xf0, 0x14, 0xde, 0x08, 0x05}, - subYX: fp.Elt{0x64, 0x4a, 0xdd, 0xdf, 0xb4, 0x79, 0x60, 0xc8, 0xa1, 0x70, 0xb4, 0x3a, 0x1e, 0x0c, 0x9b, 0x19, 0xe5, 0x48, 0x3f, 0xd7, 0x44, 0x18, 0x18, 0x14, 0x14, 0x27, 0x45, 0xd0, 0x2d, 0x24, 0xd5, 0x93, 0xc3, 0x74, 0x4c, 0x50, 0x70, 0x43, 0x26, 0x05, 0x08, 0x24, 0xca, 0x78, 0x30, 0xc1, 0x06, 0x8d, 0xd4, 0x86, 0x42, 0xf0, 0x14, 0xde, 0x08, 0x05}, - dt2: fp.Elt{0x1a, 0x33, 0xea, 0x64, 0x45, 0x1c, 0xdf, 0x17, 0x1d, 0x16, 0x34, 0x28, 0xd6, 0x61, 0x19, 0x67, 0x79, 0xb4, 0x13, 0xcf, 0x3e, 0x7c, 0x0e, 0x72, 0xda, 0xf1, 0x5f, 0xda, 0xe6, 0xcf, 0x42, 0xd3, 0xb6, 0x17, 0xc2, 0x68, 0x13, 0x2d, 0xd9, 0x60, 0x3e, 0xae, 0xf0, 0x5b, 0x96, 0xf0, 0xcd, 0xaf, 0xea, 0xb7, 0x0d, 0x59, 0x16, 0xa7, 0xff, 0x55}, - }, - { - addYX: fp.Elt{0xca, 0xd8, 0x7d, 0x86, 0x1a, 0xef, 0xad, 0x11, 0xe3, 0x27, 0x41, 0x7e, 0x7f, 0x3e, 0xa9, 0xd2, 0xb5, 0x4e, 0x50, 0xe0, 0x77, 0x91, 0xc2, 0x13, 0x52, 0x73, 0x41, 0x09, 0xa6, 0x57, 0x9a, 0xc8, 0xa8, 0x90, 0x9d, 0x26, 0x14, 0xbb, 0xa1, 0x2a, 0xf7, 0x45, 0x43, 0x4e, 0xea, 0x35, 0x62, 0xe1, 0x08, 0x85, 0x46, 0xb8, 0x24, 0x05, 0x2d, 0xab}, - subYX: fp.Elt{0x9b, 0xe6, 0xd3, 0xe5, 0xfe, 0x50, 0x36, 0x3c, 0x3c, 0x6d, 0x74, 0x1d, 0x74, 0xc0, 0xde, 0x5b, 0x45, 0x27, 0xe5, 0x12, 0xee, 0x63, 0x35, 0x6b, 0x13, 0xe2, 0x41, 0x6b, 0x3a, 0x05, 0x2b, 0xb1, 0x89, 0x26, 0xb6, 0xc6, 0xd1, 0x84, 0xff, 0x0e, 0x9b, 0xa3, 0xfb, 0x21, 0x36, 0x6b, 0x01, 0xf7, 0x9f, 0x7c, 0xeb, 0xf5, 0x18, 0x7a, 0x2a, 0x70}, - dt2: fp.Elt{0x09, 0xad, 0x99, 0x1a, 0x38, 0xd3, 0xdf, 0x22, 0x37, 0x32, 0x61, 0x8b, 0xf3, 0x19, 0x48, 0x08, 0xe8, 0x49, 0xb6, 0x4a, 0xa7, 0xed, 0xa4, 0xa2, 0xee, 0x86, 0xd7, 0x31, 0x5e, 0xce, 0x95, 0x76, 0x86, 0x42, 0x1c, 0x9d, 0x07, 0x14, 0x8c, 0x34, 0x18, 0x9c, 0x6d, 0x3a, 0xdf, 0xa9, 0xe8, 0x36, 0x7e, 0xe4, 0x95, 0xbe, 0xb5, 0x09, 0xf8, 0x9c}, - }, - { - addYX: fp.Elt{0x51, 0xdb, 0x49, 0xa8, 0x9f, 0xe3, 0xd7, 0xec, 0x0d, 0x0f, 0x49, 0xe8, 0xb6, 0xc5, 0x0f, 0x5a, 0x1c, 0xce, 0x54, 0x0d, 0xb1, 0x8d, 0x5b, 0xbf, 0xf4, 0xaa, 0x34, 0x77, 0xc4, 0x5d, 0x59, 0xb6, 0xc5, 0x0e, 0x5a, 0xd8, 0x5b, 0x30, 0xc2, 0x1d, 0xec, 0x85, 0x1c, 0x42, 0xbe, 0x24, 0x2e, 0x50, 0x55, 0x44, 0xb2, 0x3a, 0x01, 0xaa, 0x98, 0xfb}, - subYX: fp.Elt{0xe7, 0x29, 0xb7, 0xd0, 0xaa, 0x4f, 0x32, 0x53, 0x56, 0xde, 0xbc, 0xd1, 0x92, 0x5d, 0x19, 0xbe, 0xa3, 0xe3, 0x75, 0x48, 0xe0, 0x7a, 0x1b, 0x54, 0x7a, 0xb7, 0x41, 0x77, 0x84, 0x38, 0xdd, 0x14, 0x9f, 0xca, 0x3f, 0xa3, 0xc8, 0xa7, 0x04, 0x70, 0xf1, 0x4d, 0x3d, 0xb3, 0x84, 0x79, 0xcb, 0xdb, 0xe4, 0xc5, 0x42, 0x9b, 0x57, 0x19, 0xf1, 0x2d}, - dt2: fp.Elt{0x20, 0xb4, 0x94, 0x9e, 0xdf, 0x31, 0x44, 0x0b, 0xc9, 0x7b, 0x75, 0x40, 0x9d, 0xd1, 0x96, 0x39, 0x70, 0x71, 0x15, 0xc8, 0x93, 0xd5, 0xc5, 0xe5, 0xba, 0xfe, 0xee, 0x08, 0x6a, 0x98, 0x0a, 0x1b, 0xb2, 0xaa, 0x3a, 0xf4, 0xa4, 0x79, 0xf9, 0x8e, 0x4d, 0x65, 0x10, 0x9b, 0x3a, 0x6e, 0x7c, 0x87, 0x94, 0x92, 0x11, 0x65, 0xbf, 0x1a, 0x09, 0xde}, - }, - { - addYX: fp.Elt{0xf3, 0x84, 0x76, 0x77, 0xa5, 0x6b, 0x27, 0x3b, 0x83, 0x3d, 0xdf, 0xa0, 0xeb, 0x32, 0x6d, 0x58, 0x81, 0x57, 0x64, 0xc2, 0x21, 0x7c, 0x9b, 0xea, 0xe6, 0xb0, 0x93, 0xf9, 0xe7, 0xc3, 0xed, 0x5a, 0x8e, 0xe2, 0xb4, 0x72, 0x76, 0x66, 0x0f, 0x22, 0x29, 0x94, 0x3e, 0x63, 0x48, 0x5e, 0x80, 0xcb, 0xac, 0xfa, 0x95, 0xb6, 0x4b, 0xc4, 0x95, 0x33}, - subYX: fp.Elt{0x0c, 0x55, 0xd1, 0x5e, 0x5f, 0xbf, 0xbf, 0xe2, 0x4c, 0xfc, 0x37, 0x4a, 0xc4, 0xb1, 0xf4, 0x83, 0x61, 0x93, 0x60, 0x8e, 0x9f, 0x31, 0xf0, 0xa0, 0x41, 0xff, 0x1d, 0xe2, 0x7f, 0xca, 0x40, 0xd6, 0x88, 0xe8, 0x91, 0x61, 0xe2, 0x11, 0x18, 0x83, 0xf3, 0x25, 0x2f, 0x3f, 0x49, 0x40, 0xd4, 0x83, 0xe2, 0xd7, 0x74, 0x6a, 0x16, 0x86, 0x4e, 0xab}, - dt2: fp.Elt{0xdd, 0x58, 0x65, 0xd8, 0x9f, 0xdd, 0x70, 0x7f, 0x0f, 0xec, 0xbd, 0x5c, 0x5c, 0x9b, 0x7e, 0x1b, 0x9f, 0x79, 0x36, 0x1f, 0xfd, 0x79, 0x10, 0x1c, 0x52, 0xf3, 0x22, 0xa4, 0x1f, 0x71, 0x6e, 0x63, 0x14, 0xf4, 0xa7, 0x3e, 0xbe, 0xad, 0x43, 0x30, 0x38, 0x8c, 0x29, 0xc6, 0xcf, 0x50, 0x75, 0x21, 0xe5, 0x78, 0xfd, 0xb0, 0x9a, 0xc4, 0x6d, 0xd4}, - }, - }, - { - { - addYX: fp.Elt{0x7a, 0xa1, 0x38, 0xa6, 0xfd, 0x0e, 0x96, 0xd5, 0x26, 0x76, 0x86, 0x70, 0x80, 0x30, 0xa6, 0x67, 0xeb, 0xf4, 0x39, 0xdb, 0x22, 0xf5, 0x9f, 0x98, 0xe4, 0xb5, 0x3a, 0x0c, 0x59, 0xbf, 0x85, 0xc6, 0xf0, 0x0b, 0x1c, 0x41, 0x38, 0x09, 0x01, 0xdb, 0xd6, 0x3c, 0xb7, 0xf1, 0x08, 0x6b, 0x4b, 0x9e, 0x63, 0x53, 0x83, 0xd3, 0xab, 0xa3, 0x72, 0x0d}, - subYX: fp.Elt{0x84, 0x68, 0x25, 0xe8, 0xe9, 0x8f, 0x91, 0xbf, 0xf7, 0xa4, 0x30, 0xae, 0xea, 0x9f, 0xdd, 0x56, 0x64, 0x09, 0xc9, 0x54, 0x68, 0x4e, 0x33, 0xc5, 0x6f, 0x7b, 0x2d, 0x52, 0x2e, 0x42, 0xbe, 0xbe, 0xf5, 0x64, 0xbf, 0x77, 0x54, 0xdf, 0xb0, 0x10, 0xd2, 0x16, 0x5d, 0xce, 0xaf, 0x9f, 0xfb, 0xa3, 0x63, 0x50, 0xcb, 0xc0, 0xd0, 0x88, 0x44, 0xa3}, - dt2: fp.Elt{0xc3, 0x8b, 0xa5, 0xf1, 0x44, 0xe4, 0x41, 0xcd, 0x75, 0xe3, 0x17, 0x69, 0x5b, 0xb9, 0xbb, 0xee, 0x82, 0xbb, 0xce, 0x57, 0xdf, 0x2a, 0x9c, 0x12, 0xab, 0x66, 0x08, 0x68, 0x05, 0x1b, 0x87, 0xee, 0x5d, 0x1e, 0x18, 0x14, 0x22, 0x4b, 0x99, 0x61, 0x75, 0x28, 0xe7, 0x65, 0x1c, 0x36, 0xb6, 0x18, 0x09, 0xa8, 0xdf, 0xef, 0x30, 0x35, 0xbc, 0x58}, - }, - { - addYX: fp.Elt{0xc5, 0xd3, 0x0e, 0x6f, 0xaf, 0x06, 0x69, 0xc4, 0x07, 0x9e, 0x58, 0x6e, 0x3f, 0x49, 0xd9, 0x0a, 0x3c, 0x2c, 0x37, 0xcd, 0x27, 0x4d, 0x87, 0x91, 0x7a, 0xb0, 0x28, 0xad, 0x2f, 0x68, 0x92, 0x05, 0x97, 0xf1, 0x30, 0x5f, 0x4c, 0x10, 0x20, 0x30, 0xd3, 0x08, 0x3f, 0xc1, 0xc6, 0xb7, 0xb5, 0xd1, 0x71, 0x7b, 0xa8, 0x0a, 0xd8, 0xf5, 0x17, 0xcf}, - subYX: fp.Elt{0x64, 0xd4, 0x8f, 0x91, 0x40, 0xab, 0x6e, 0x1a, 0x62, 0x83, 0xdc, 0xd7, 0x30, 0x1a, 0x4a, 0x2a, 0x4c, 0x54, 0x86, 0x19, 0x81, 0x5d, 0x04, 0x52, 0xa3, 0xca, 0x82, 0x38, 0xdc, 0x1e, 0xf0, 0x7a, 0x78, 0x76, 0x49, 0x4f, 0x71, 0xc4, 0x74, 0x2f, 0xf0, 0x5b, 0x2e, 0x5e, 0xac, 0xef, 0x17, 0xe4, 0x8e, 0x6e, 0xed, 0x43, 0x23, 0x61, 0x99, 0x49}, - dt2: fp.Elt{0x64, 0x90, 0x72, 0x76, 0xf8, 0x2c, 0x7d, 0x57, 0xf9, 0x30, 0x5e, 0x7a, 0x10, 0x74, 0x19, 0x39, 0xd9, 0xaf, 0x0a, 0xf1, 0x43, 0xed, 0x88, 0x9c, 0x8b, 0xdc, 0x9b, 0x1c, 0x90, 0xe7, 0xf7, 0xa3, 0xa5, 0x0d, 0xc6, 0xbc, 0x30, 0xfb, 0x91, 0x1a, 0x51, 0xba, 0x2d, 0xbe, 0x89, 0xdf, 0x1d, 0xdc, 0x53, 0xa8, 0x82, 0x8a, 0xd3, 0x8d, 0x16, 0x68}, - }, - { - addYX: fp.Elt{0xef, 0x5c, 0xe3, 0x74, 0xbf, 0x13, 0x4a, 0xbf, 0x66, 0x73, 0x64, 0xb7, 0xd4, 0xce, 0x98, 0x82, 0x05, 0xfa, 0x98, 0x0c, 0x0a, 0xae, 0xe5, 0x6b, 0x9f, 0xac, 0xbb, 0x6e, 0x1f, 0xcf, 0xff, 0xa6, 0x71, 0x9a, 0xa8, 0x7a, 0x9e, 0x64, 0x1f, 0x20, 0x4a, 0x61, 0xa2, 0xd6, 0x50, 0xe3, 0xba, 0x81, 0x0c, 0x50, 0x59, 0x69, 0x59, 0x15, 0x55, 0xdb}, - subYX: fp.Elt{0xe8, 0x77, 0x4d, 0xe8, 0x66, 0x3d, 0xc1, 0x00, 0x3c, 0xf2, 0x25, 0x00, 0xdc, 0xb2, 0xe5, 0x9b, 0x12, 0x89, 0xf3, 0xd6, 0xea, 0x85, 0x60, 0xfe, 0x67, 0x91, 0xfd, 0x04, 0x7c, 0xe0, 0xf1, 0x86, 0x06, 0x11, 0x66, 0xee, 0xd4, 0xd5, 0xbe, 0x3b, 0x0f, 0xe3, 0x59, 0xb3, 0x4f, 0x00, 0xb6, 0xce, 0x80, 0xc1, 0x61, 0xf7, 0xaf, 0x04, 0x6a, 0x3c}, - dt2: fp.Elt{0x00, 0xd7, 0x32, 0x93, 0x67, 0x70, 0x6f, 0xd7, 0x69, 0xab, 0xb1, 0xd3, 0xdc, 0xd6, 0xa8, 0xdd, 0x35, 0x25, 0xca, 0xd3, 0x8a, 0x6d, 0xce, 0xfb, 0xfd, 0x2b, 0x83, 0xf0, 0xd4, 0xac, 0x66, 0xfb, 0x72, 0x87, 0x7e, 0x55, 0xb7, 0x91, 0x58, 0x10, 0xc3, 0x11, 0x7e, 0x15, 0xfe, 0x7c, 0x55, 0x90, 0xa3, 0x9e, 0xed, 0x9a, 0x7f, 0xa7, 0xb7, 0xeb}, - }, - { - addYX: fp.Elt{0x25, 0x0f, 0xc2, 0x09, 0x9c, 0x10, 0xc8, 0x7c, 0x93, 0xa7, 0xbe, 0xe9, 0x26, 0x25, 0x7c, 0x21, 0xfe, 0xe7, 0x5f, 0x3c, 0x02, 0x83, 0xa7, 0x9e, 0xdf, 0xc0, 0x94, 0x2b, 0x7d, 0x1a, 0xd0, 0x1d, 0xcc, 0x2e, 0x7d, 0xd4, 0x85, 0xe7, 0xc1, 0x15, 0x66, 0xd6, 0xd6, 0x32, 0xb8, 0xf7, 0x63, 0xaa, 0x3b, 0xa5, 0xea, 0x49, 0xad, 0x88, 0x9b, 0x66}, - subYX: fp.Elt{0x09, 0x97, 0x79, 0x36, 0x41, 0x56, 0x9b, 0xdf, 0x15, 0xd8, 0x43, 0x28, 0x17, 0x5b, 0x96, 0xc9, 0xcf, 0x39, 0x1f, 0x13, 0xf7, 0x4d, 0x1d, 0x1f, 0xda, 0x51, 0x56, 0xe7, 0x0a, 0x5a, 0x65, 0xb6, 0x2a, 0x87, 0x49, 0x86, 0xc2, 0x2b, 0xcd, 0xfe, 0x07, 0xf6, 0x4c, 0xe2, 0x1d, 0x9b, 0xd8, 0x82, 0x09, 0x5b, 0x11, 0x10, 0x62, 0x56, 0x89, 0xbd}, - dt2: fp.Elt{0xd9, 0x15, 0x73, 0xf2, 0x96, 0x35, 0x53, 0xb0, 0xe7, 0xa8, 0x0b, 0x93, 0x35, 0x0b, 0x3a, 0x00, 0xf5, 0x18, 0xb1, 0xc3, 0x12, 0x3f, 0x91, 0x17, 0xc1, 0x4c, 0x15, 0x5a, 0x86, 0x92, 0x11, 0xbd, 0x44, 0x40, 0x5a, 0x7b, 0x15, 0x89, 0xba, 0xc1, 0xc1, 0xbc, 0x43, 0x45, 0xe6, 0x52, 0x02, 0x73, 0x0a, 0xd0, 0x2a, 0x19, 0xda, 0x47, 0xa8, 0xff}, - }, - }, -} - -// tabVerif contains the odd multiples of P. The entry T[i] = (2i+1)P, where -// P = phi(G) and G is the generator of the Goldilocks curve, and phi is a -// 4-degree isogeny. -var tabVerif = [1 << (omegaFix - 2)]preTwistPointAffine{ - { /* 1P*/ - addYX: fp.Elt{0x65, 0x4a, 0xdd, 0xdf, 0xb4, 0x79, 0x60, 0xc8, 0xa1, 0x70, 0xb4, 0x3a, 0x1e, 0x0c, 0x9b, 0x19, 0xe5, 0x48, 0x3f, 0xd7, 0x44, 0x18, 0x18, 0x14, 0x14, 0x27, 0x45, 0xd0, 0x2b, 0x24, 0xd5, 0x93, 0xc3, 0x74, 0x4c, 0x50, 0x70, 0x43, 0x26, 0x05, 0x08, 0x24, 0xca, 0x78, 0x30, 0xc1, 0x06, 0x8d, 0xd4, 0x86, 0x42, 0xf0, 0x14, 0xde, 0x08, 0x05}, - subYX: fp.Elt{0x64, 0x4a, 0xdd, 0xdf, 0xb4, 0x79, 0x60, 0xc8, 0xa1, 0x70, 0xb4, 0x3a, 0x1e, 0x0c, 0x9b, 0x19, 0xe5, 0x48, 0x3f, 0xd7, 0x44, 0x18, 0x18, 0x14, 0x14, 0x27, 0x45, 0xd0, 0x2d, 0x24, 0xd5, 0x93, 0xc3, 0x74, 0x4c, 0x50, 0x70, 0x43, 0x26, 0x05, 0x08, 0x24, 0xca, 0x78, 0x30, 0xc1, 0x06, 0x8d, 0xd4, 0x86, 0x42, 0xf0, 0x14, 0xde, 0x08, 0x05}, - dt2: fp.Elt{0x1a, 0x33, 0xea, 0x64, 0x45, 0x1c, 0xdf, 0x17, 0x1d, 0x16, 0x34, 0x28, 0xd6, 0x61, 0x19, 0x67, 0x79, 0xb4, 0x13, 0xcf, 0x3e, 0x7c, 0x0e, 0x72, 0xda, 0xf1, 0x5f, 0xda, 0xe6, 0xcf, 0x42, 0xd3, 0xb6, 0x17, 0xc2, 0x68, 0x13, 0x2d, 0xd9, 0x60, 0x3e, 0xae, 0xf0, 0x5b, 0x96, 0xf0, 0xcd, 0xaf, 0xea, 0xb7, 0x0d, 0x59, 0x16, 0xa7, 0xff, 0x55}, - }, - { /* 3P*/ - addYX: fp.Elt{0xd1, 0xe9, 0xa8, 0x33, 0x20, 0x76, 0x18, 0x08, 0x45, 0x2a, 0xc9, 0x67, 0x2a, 0xc3, 0x15, 0x24, 0xf9, 0x74, 0x21, 0x30, 0x99, 0x59, 0x8b, 0xb2, 0xf0, 0xa4, 0x07, 0xe2, 0x6a, 0x36, 0x8d, 0xd9, 0xd2, 0x4a, 0x7f, 0x73, 0x50, 0x39, 0x3d, 0xaa, 0xa7, 0x51, 0x73, 0x0d, 0x2b, 0x8b, 0x96, 0x47, 0xac, 0x3c, 0x5d, 0xaa, 0x39, 0x9c, 0xcf, 0xd5}, - subYX: fp.Elt{0x6b, 0x11, 0x5d, 0x1a, 0xf9, 0x41, 0x9d, 0xc5, 0x30, 0x3e, 0xad, 0x25, 0x2c, 0x04, 0x45, 0xea, 0xcc, 0x67, 0x07, 0x85, 0xe9, 0xda, 0x0e, 0xb5, 0x40, 0xb7, 0x32, 0xb4, 0x49, 0xdd, 0xff, 0xaa, 0xfc, 0xbb, 0x19, 0xca, 0x8b, 0x79, 0x2b, 0x8f, 0x8d, 0x00, 0x33, 0xc2, 0xad, 0xe9, 0xd3, 0x12, 0xa8, 0xaa, 0x87, 0x62, 0xad, 0x2d, 0xff, 0xa4}, - dt2: fp.Elt{0xb0, 0xaf, 0x3b, 0xea, 0xf0, 0x42, 0x0b, 0x5e, 0x88, 0xd3, 0x98, 0x08, 0x87, 0x59, 0x72, 0x0a, 0xc2, 0xdf, 0xcb, 0x7f, 0x59, 0xb5, 0x4c, 0x63, 0x68, 0xe8, 0x41, 0x38, 0x67, 0x4f, 0xe9, 0xc6, 0xb2, 0x6b, 0x08, 0xa7, 0xf7, 0x0e, 0xcd, 0xea, 0xca, 0x3d, 0xaf, 0x8e, 0xda, 0x4b, 0x2e, 0xd2, 0x88, 0x64, 0x8d, 0xc5, 0x5f, 0x76, 0x0f, 0x3d}, - }, - { /* 5P*/ - addYX: fp.Elt{0xe5, 0x65, 0xc9, 0xe2, 0x75, 0xf0, 0x7d, 0x1a, 0xba, 0xa4, 0x40, 0x4b, 0x93, 0x12, 0xa2, 0x80, 0x95, 0x0d, 0x03, 0x93, 0xe8, 0xa5, 0x4d, 0xe2, 0x3d, 0x81, 0xf5, 0xce, 0xd4, 0x2d, 0x25, 0x59, 0x16, 0x5c, 0xe7, 0xda, 0xc7, 0x45, 0xd2, 0x7e, 0x2c, 0x38, 0xd4, 0x37, 0x64, 0xb2, 0xc2, 0x28, 0xc5, 0x72, 0x16, 0x32, 0x45, 0x36, 0x6f, 0x9f}, - subYX: fp.Elt{0x09, 0xf4, 0x7e, 0xbd, 0x89, 0xdb, 0x19, 0x58, 0xe1, 0x08, 0x00, 0x8a, 0xf4, 0x5f, 0x2a, 0x32, 0x40, 0xf0, 0x2c, 0x3f, 0x5d, 0xe4, 0xfc, 0x89, 0x11, 0x24, 0xb4, 0x2f, 0x97, 0xad, 0xac, 0x8f, 0x19, 0xab, 0xfa, 0x12, 0xe5, 0xf9, 0x50, 0x4e, 0x50, 0x6f, 0x32, 0x30, 0x88, 0xa6, 0xe5, 0x48, 0x28, 0xa2, 0x1b, 0x9f, 0xcd, 0xe2, 0x43, 0x38}, - dt2: fp.Elt{0xa9, 0xcc, 0x53, 0x39, 0x86, 0x02, 0x60, 0x75, 0x34, 0x99, 0x57, 0xbd, 0xfc, 0x5a, 0x8e, 0xce, 0x5e, 0x98, 0x22, 0xd0, 0xa5, 0x24, 0xff, 0x90, 0x28, 0x9f, 0x58, 0xf3, 0x39, 0xe9, 0xba, 0x36, 0x23, 0xfb, 0x7f, 0x41, 0xcc, 0x2b, 0x5a, 0x25, 0x3f, 0x4c, 0x2a, 0xf1, 0x52, 0x6f, 0x2f, 0x07, 0xe3, 0x88, 0x81, 0x77, 0xdd, 0x7c, 0x88, 0x82}, - }, - { /* 7P*/ - addYX: fp.Elt{0xf7, 0xee, 0x88, 0xfd, 0x3a, 0xbf, 0x7e, 0x28, 0x39, 0x23, 0x79, 0xe6, 0x5c, 0x56, 0xcb, 0xb5, 0x48, 0x6a, 0x80, 0x6d, 0x37, 0x60, 0x6c, 0x10, 0x35, 0x49, 0x4b, 0x46, 0x60, 0xd4, 0x79, 0xd4, 0x53, 0xd3, 0x67, 0x88, 0xd0, 0x41, 0xd5, 0x43, 0x85, 0xc8, 0x71, 0xe3, 0x1c, 0xb6, 0xda, 0x22, 0x64, 0x8f, 0x80, 0xac, 0xad, 0x7d, 0xd5, 0x82}, - subYX: fp.Elt{0x92, 0x40, 0xc1, 0x83, 0x21, 0x9b, 0xd5, 0x7d, 0x3f, 0x29, 0xb6, 0x26, 0xef, 0x12, 0xb9, 0x27, 0x39, 0x42, 0x37, 0x97, 0x09, 0x9a, 0x08, 0xe1, 0x68, 0xb6, 0x7a, 0x3f, 0x9f, 0x45, 0xf8, 0x37, 0x19, 0x83, 0x97, 0xe6, 0x73, 0x30, 0x32, 0x35, 0xcf, 0xae, 0x5c, 0x12, 0x68, 0xdf, 0x6e, 0x2b, 0xde, 0x83, 0xa0, 0x44, 0x74, 0x2e, 0x4a, 0xe9}, - dt2: fp.Elt{0xcb, 0x22, 0x0a, 0xda, 0x6b, 0xc1, 0x8a, 0x29, 0xa1, 0xac, 0x8b, 0x5b, 0x8b, 0x32, 0x20, 0xf2, 0x21, 0xae, 0x0c, 0x43, 0xc4, 0xd7, 0x19, 0x37, 0x3d, 0x79, 0x25, 0x98, 0x6c, 0x9c, 0x22, 0x31, 0x2a, 0x55, 0x9f, 0xda, 0x5e, 0xa8, 0x13, 0xdb, 0x8e, 0x2e, 0x16, 0x39, 0xf4, 0x91, 0x6f, 0xec, 0x71, 0x71, 0xc9, 0x10, 0xf2, 0xa4, 0x8f, 0x11}, - }, - { /* 9P*/ - addYX: fp.Elt{0x85, 0xdd, 0x37, 0x62, 0x74, 0x8e, 0x33, 0x5b, 0x25, 0x12, 0x1b, 0xe7, 0xdf, 0x47, 0xe5, 0x12, 0xfd, 0x3a, 0x3a, 0xf5, 0x5d, 0x4c, 0xa2, 0x29, 0x3c, 0x5c, 0x2f, 0xee, 0x18, 0x19, 0x0a, 0x2b, 0xef, 0x67, 0x50, 0x7a, 0x0d, 0x29, 0xae, 0x55, 0x82, 0xcd, 0xd6, 0x41, 0x90, 0xb4, 0x13, 0x31, 0x5d, 0x11, 0xb8, 0xaa, 0x12, 0x86, 0x08, 0xac}, - subYX: fp.Elt{0xcc, 0x37, 0x8d, 0x83, 0x5f, 0xfd, 0xde, 0xd5, 0xf7, 0xf1, 0xae, 0x0a, 0xa7, 0x0b, 0xeb, 0x6d, 0x19, 0x8a, 0xb6, 0x1a, 0x59, 0xd8, 0xff, 0x3c, 0xbc, 0xbc, 0xef, 0x9c, 0xda, 0x7b, 0x75, 0x12, 0xaf, 0x80, 0x8f, 0x2c, 0x3c, 0xaa, 0x0b, 0x17, 0x86, 0x36, 0x78, 0x18, 0xc8, 0x8a, 0xf6, 0xb8, 0x2c, 0x2f, 0x57, 0x2c, 0x62, 0x57, 0xf6, 0x90}, - dt2: fp.Elt{0x83, 0xbc, 0xa2, 0x07, 0xa5, 0x38, 0x96, 0xea, 0xfe, 0x11, 0x46, 0x1d, 0x3b, 0xcd, 0x42, 0xc5, 0xee, 0x67, 0x04, 0x72, 0x08, 0xd8, 0xd9, 0x96, 0x07, 0xf7, 0xac, 0xc3, 0x64, 0xf1, 0x98, 0x2c, 0x55, 0xd7, 0x7d, 0xc8, 0x6c, 0xbd, 0x2c, 0xff, 0x15, 0xd6, 0x6e, 0xb8, 0x17, 0x8e, 0xa8, 0x27, 0x66, 0xb1, 0x73, 0x79, 0x96, 0xff, 0x29, 0x10}, - }, - { /* 11P*/ - addYX: fp.Elt{0x76, 0xcb, 0x9b, 0x0c, 0x5b, 0xfe, 0xe1, 0x2a, 0xdd, 0x6f, 0x6c, 0xdd, 0x6f, 0xb4, 0xc0, 0xc2, 0x1b, 0x4b, 0x38, 0xe8, 0x66, 0x8c, 0x1e, 0x31, 0x63, 0xb9, 0x94, 0xcd, 0xc3, 0x8c, 0x44, 0x25, 0x7b, 0xd5, 0x39, 0x80, 0xfc, 0x01, 0xaa, 0xf7, 0x2a, 0x61, 0x8a, 0x25, 0xd2, 0x5f, 0xc5, 0x66, 0x38, 0xa4, 0x17, 0xcf, 0x3e, 0x11, 0x0f, 0xa3}, - subYX: fp.Elt{0xe0, 0xb6, 0xd1, 0x9c, 0x71, 0x49, 0x2e, 0x7b, 0xde, 0x00, 0xda, 0x6b, 0xf1, 0xec, 0xe6, 0x7a, 0x15, 0x38, 0x71, 0xe9, 0x7b, 0xdb, 0xf8, 0x98, 0xc0, 0x91, 0x2e, 0x53, 0xee, 0x92, 0x87, 0x25, 0xc9, 0xb0, 0xbb, 0x33, 0x15, 0x46, 0x7f, 0xfd, 0x4f, 0x8b, 0x77, 0x05, 0x96, 0xb6, 0xe2, 0x08, 0xdb, 0x0d, 0x09, 0xee, 0x5b, 0xd1, 0x2a, 0x63}, - dt2: fp.Elt{0x8f, 0x7b, 0x57, 0x8c, 0xbf, 0x06, 0x0d, 0x43, 0x21, 0x92, 0x94, 0x2d, 0x6a, 0x38, 0x07, 0x0f, 0xa0, 0xf1, 0xe3, 0xd8, 0x2a, 0xbf, 0x46, 0xc6, 0x9e, 0x1f, 0x8f, 0x2b, 0x46, 0x84, 0x0b, 0x74, 0xed, 0xff, 0xf8, 0xa5, 0x94, 0xae, 0xf1, 0x67, 0xb1, 0x9b, 0xdd, 0x4a, 0xd0, 0xdb, 0xc2, 0xb5, 0x58, 0x49, 0x0c, 0xa9, 0x1d, 0x7d, 0xa9, 0xd3}, - }, - { /* 13P*/ - addYX: fp.Elt{0x73, 0x84, 0x2e, 0x31, 0x1f, 0xdc, 0xed, 0x9f, 0x74, 0xfa, 0xe0, 0x35, 0xb1, 0x85, 0x6a, 0x8d, 0x86, 0xd0, 0xff, 0xd6, 0x08, 0x43, 0x73, 0x1a, 0xd5, 0xf8, 0x43, 0xd4, 0xb3, 0xe5, 0x3f, 0xa8, 0x84, 0x17, 0x59, 0x65, 0x4e, 0xe6, 0xee, 0x54, 0x9c, 0xda, 0x5e, 0x7e, 0x98, 0x29, 0x6d, 0x73, 0x34, 0x1f, 0x99, 0x80, 0x54, 0x54, 0x81, 0x0b}, - subYX: fp.Elt{0xb1, 0xe5, 0xbb, 0x80, 0x22, 0x9c, 0x81, 0x6d, 0xaf, 0x27, 0x65, 0x6f, 0x7e, 0x9c, 0xb6, 0x8d, 0x35, 0x5c, 0x2e, 0x20, 0x48, 0x7a, 0x28, 0xf0, 0x97, 0xfe, 0xb7, 0x71, 0xce, 0xd6, 0xad, 0x3a, 0x81, 0xf6, 0x74, 0x5e, 0xf3, 0xfd, 0x1b, 0xd4, 0x1e, 0x7c, 0xc2, 0xb7, 0xc8, 0xa6, 0xc9, 0x89, 0x03, 0x47, 0xec, 0x24, 0xd6, 0x0e, 0xec, 0x9c}, - dt2: fp.Elt{0x91, 0x0a, 0x43, 0x34, 0x20, 0xc2, 0x64, 0xf7, 0x4e, 0x48, 0xc8, 0xd2, 0x95, 0x83, 0xd1, 0xa4, 0xfb, 0x4e, 0x41, 0x3b, 0x0d, 0xd5, 0x07, 0xd9, 0xf1, 0x13, 0x16, 0x78, 0x54, 0x57, 0xd0, 0xf1, 0x4f, 0x20, 0xac, 0xcf, 0x9c, 0x3b, 0x33, 0x0b, 0x99, 0x54, 0xc3, 0x7f, 0x3e, 0x57, 0x26, 0x86, 0xd5, 0xa5, 0x2b, 0x8d, 0xe3, 0x19, 0x36, 0xf7}, - }, - { /* 15P*/ - addYX: fp.Elt{0x23, 0x69, 0x47, 0x14, 0xf9, 0x9a, 0x50, 0xff, 0x64, 0xd1, 0x50, 0x35, 0xc3, 0x11, 0xd3, 0x19, 0xcf, 0x87, 0xda, 0x30, 0x0b, 0x50, 0xda, 0xc0, 0xe0, 0x25, 0x00, 0xe5, 0x68, 0x93, 0x04, 0xc2, 0xaf, 0xbd, 0x2f, 0x36, 0x5f, 0x47, 0x96, 0x10, 0xa8, 0xbd, 0xe4, 0x88, 0xac, 0x80, 0x52, 0x61, 0x73, 0xe9, 0x63, 0xdd, 0x99, 0xad, 0x20, 0x5b}, - subYX: fp.Elt{0x1b, 0x5e, 0xa2, 0x2a, 0x25, 0x0f, 0x86, 0xc0, 0xb1, 0x2e, 0x0c, 0x13, 0x40, 0x8d, 0xf0, 0xe6, 0x00, 0x55, 0x08, 0xc5, 0x7d, 0xf4, 0xc9, 0x31, 0x25, 0x3a, 0x99, 0x69, 0xdd, 0x67, 0x63, 0x9a, 0xd6, 0x89, 0x2e, 0xa1, 0x19, 0xca, 0x2c, 0xd9, 0x59, 0x5f, 0x5d, 0xc3, 0x6e, 0x62, 0x36, 0x12, 0x59, 0x15, 0xe1, 0xdc, 0xa4, 0xad, 0xc9, 0xd0}, - dt2: fp.Elt{0xbc, 0xea, 0xfc, 0xaf, 0x66, 0x23, 0xb7, 0x39, 0x6b, 0x2a, 0x96, 0xa8, 0x54, 0x43, 0xe9, 0xaa, 0x32, 0x40, 0x63, 0x92, 0x5e, 0xdf, 0x35, 0xc2, 0x9f, 0x24, 0x0c, 0xed, 0xfc, 0xde, 0x73, 0x8f, 0xa7, 0xd5, 0xa3, 0x2b, 0x18, 0x1f, 0xb0, 0xf8, 0xeb, 0x55, 0xd9, 0xc3, 0xfd, 0x28, 0x7c, 0x4f, 0xce, 0x0d, 0xf7, 0xae, 0xc2, 0x83, 0xc3, 0x78}, - }, - { /* 17P*/ - addYX: fp.Elt{0x71, 0xe6, 0x60, 0x93, 0x37, 0xdb, 0x01, 0xa5, 0x4c, 0xba, 0xe8, 0x8e, 0xd5, 0xf9, 0xd3, 0x98, 0xe5, 0xeb, 0xab, 0x3a, 0x15, 0x8b, 0x35, 0x60, 0xbe, 0xe5, 0x9c, 0x2d, 0x10, 0x9b, 0x2e, 0xcf, 0x65, 0x64, 0xea, 0x8f, 0x72, 0xce, 0xf5, 0x18, 0xe5, 0xe2, 0xf0, 0x0e, 0xae, 0x04, 0xec, 0xa0, 0x20, 0x65, 0x63, 0x07, 0xb1, 0x9f, 0x03, 0x97}, - subYX: fp.Elt{0x9e, 0x41, 0x64, 0x30, 0x95, 0x7f, 0x3a, 0x89, 0x7b, 0x0a, 0x79, 0x59, 0x23, 0x9a, 0x3b, 0xfe, 0xa4, 0x13, 0x08, 0xb2, 0x2e, 0x04, 0x50, 0x10, 0x30, 0xcd, 0x2e, 0xa4, 0x91, 0x71, 0x50, 0x36, 0x4a, 0x02, 0xf4, 0x8d, 0xa3, 0x36, 0x1b, 0xf4, 0x52, 0xba, 0x15, 0x04, 0x8b, 0x80, 0x25, 0xd9, 0xae, 0x67, 0x20, 0xd9, 0x88, 0x8f, 0x97, 0xa6}, - dt2: fp.Elt{0xb5, 0xe7, 0x46, 0xbd, 0x55, 0x23, 0xa0, 0x68, 0xc0, 0x12, 0xd9, 0xf1, 0x0a, 0x75, 0xe2, 0xda, 0xf4, 0x6b, 0xca, 0x14, 0xe4, 0x9f, 0x0f, 0xb5, 0x3c, 0xa6, 0xa5, 0xa2, 0x63, 0x94, 0xd1, 0x1c, 0x39, 0x58, 0x57, 0x02, 0x27, 0x98, 0xb6, 0x47, 0xc6, 0x61, 0x4b, 0x5c, 0xab, 0x6f, 0x2d, 0xab, 0xe3, 0xc1, 0x69, 0xf9, 0x12, 0xb0, 0xc8, 0xd5}, - }, - { /* 19P*/ - addYX: fp.Elt{0x19, 0x7d, 0xd5, 0xac, 0x79, 0xa2, 0x82, 0x9b, 0x28, 0x31, 0x22, 0xc0, 0x73, 0x02, 0x76, 0x17, 0x10, 0x70, 0x79, 0x57, 0xc9, 0x84, 0x62, 0x8e, 0x04, 0x04, 0x61, 0x67, 0x08, 0x48, 0xb4, 0x4b, 0xde, 0x53, 0x8c, 0xff, 0x36, 0x1b, 0x62, 0x86, 0x5d, 0xe1, 0x9b, 0xb1, 0xe5, 0xe8, 0x44, 0x64, 0xa1, 0x68, 0x3f, 0xa8, 0x45, 0x52, 0x91, 0xed}, - subYX: fp.Elt{0x42, 0x1a, 0x36, 0x1f, 0x90, 0x15, 0x24, 0x8d, 0x24, 0x80, 0xe6, 0xfe, 0x1e, 0xf0, 0xad, 0xaf, 0x6a, 0x93, 0xf0, 0xa6, 0x0d, 0x5d, 0xea, 0xf6, 0x62, 0x96, 0x7a, 0x05, 0x76, 0x85, 0x74, 0x32, 0xc7, 0xc8, 0x64, 0x53, 0x62, 0xe7, 0x54, 0x84, 0xe0, 0x40, 0x66, 0x19, 0x70, 0x40, 0x95, 0x35, 0x68, 0x64, 0x43, 0xcd, 0xba, 0x29, 0x32, 0xa8}, - dt2: fp.Elt{0x3e, 0xf6, 0xd6, 0xe4, 0x99, 0xeb, 0x20, 0x66, 0x08, 0x2e, 0x26, 0x64, 0xd7, 0x76, 0xf3, 0xb4, 0xc5, 0xa4, 0x35, 0x92, 0xd2, 0x99, 0x70, 0x5a, 0x1a, 0xe9, 0xe9, 0x3d, 0x3b, 0xe1, 0xcd, 0x0e, 0xee, 0x24, 0x13, 0x03, 0x22, 0xd6, 0xd6, 0x72, 0x08, 0x2b, 0xde, 0xfd, 0x93, 0xed, 0x0c, 0x7f, 0x5e, 0x31, 0x22, 0x4d, 0x80, 0x78, 0xc0, 0x48}, - }, - { /* 21P*/ - addYX: fp.Elt{0x8f, 0x72, 0xd2, 0x9e, 0xc4, 0xcd, 0x2c, 0xbf, 0xa8, 0xd3, 0x24, 0x62, 0x28, 0xee, 0x39, 0x0a, 0x19, 0x3a, 0x58, 0xff, 0x21, 0x2e, 0x69, 0x6c, 0x6e, 0x18, 0xd0, 0xcd, 0x61, 0xc1, 0x18, 0x02, 0x5a, 0xe9, 0xe3, 0xef, 0x1f, 0x8e, 0x10, 0xe8, 0x90, 0x2b, 0x48, 0xcd, 0xee, 0x38, 0xbd, 0x3a, 0xca, 0xbc, 0x2d, 0xe2, 0x3a, 0x03, 0x71, 0x02}, - subYX: fp.Elt{0xf8, 0xa4, 0x32, 0x26, 0x66, 0xaf, 0x3b, 0x53, 0xe7, 0xb0, 0x91, 0x92, 0xf5, 0x3c, 0x74, 0xce, 0xf2, 0xdd, 0x68, 0xa9, 0xf4, 0xcd, 0x5f, 0x60, 0xab, 0x71, 0xdf, 0xcd, 0x5c, 0x5d, 0x51, 0x72, 0x3a, 0x96, 0xea, 0xd6, 0xde, 0x54, 0x8e, 0x55, 0x4c, 0x08, 0x4c, 0x60, 0xdd, 0x34, 0xa9, 0x6f, 0xf3, 0x04, 0x02, 0xa8, 0xa6, 0x4e, 0x4d, 0x62}, - dt2: fp.Elt{0x76, 0x4a, 0xae, 0x38, 0x62, 0x69, 0x72, 0xdc, 0xe8, 0x43, 0xbe, 0x1d, 0x61, 0xde, 0x31, 0xc3, 0x42, 0x8f, 0x33, 0x9d, 0xca, 0xc7, 0x9c, 0xec, 0x6a, 0xe2, 0xaa, 0x01, 0x49, 0x78, 0x8d, 0x72, 0x4f, 0x38, 0xea, 0x52, 0xc2, 0xd3, 0xc9, 0x39, 0x71, 0xba, 0xb9, 0x09, 0x9b, 0xa3, 0x7f, 0x45, 0x43, 0x65, 0x36, 0x29, 0xca, 0xe7, 0x5c, 0x5f}, - }, - { /* 23P*/ - addYX: fp.Elt{0x89, 0x42, 0x35, 0x48, 0x6d, 0x74, 0xe5, 0x1f, 0xc3, 0xdd, 0x28, 0x5b, 0x84, 0x41, 0x33, 0x9f, 0x42, 0xf3, 0x1d, 0x5d, 0x15, 0x6d, 0x76, 0x33, 0x36, 0xaf, 0xe9, 0xdd, 0xfa, 0x63, 0x4f, 0x7a, 0x9c, 0xeb, 0x1c, 0x4f, 0x34, 0x65, 0x07, 0x54, 0xbb, 0x4c, 0x8b, 0x62, 0x9d, 0xd0, 0x06, 0x99, 0xb3, 0xe9, 0xda, 0x85, 0x19, 0xb0, 0x3d, 0x3c}, - subYX: fp.Elt{0xbb, 0x99, 0xf6, 0xbf, 0xaf, 0x2c, 0x22, 0x0d, 0x7a, 0xaa, 0x98, 0x6f, 0x01, 0x82, 0x99, 0xcf, 0x88, 0xbd, 0x0e, 0x3a, 0x89, 0xe0, 0x9c, 0x8c, 0x17, 0x20, 0xc4, 0xe0, 0xcf, 0x43, 0x7a, 0xef, 0x0d, 0x9f, 0x87, 0xd4, 0xfb, 0xf2, 0x96, 0xb8, 0x03, 0xe8, 0xcb, 0x5c, 0xec, 0x65, 0x5f, 0x49, 0xa4, 0x7c, 0x85, 0xb4, 0xf6, 0xc7, 0xdb, 0xa3}, - dt2: fp.Elt{0x11, 0xf3, 0x32, 0xa3, 0xa7, 0xb2, 0x7d, 0x51, 0x82, 0x44, 0xeb, 0xa2, 0x7d, 0x72, 0xcb, 0xc6, 0xf6, 0xc7, 0xb2, 0x38, 0x0e, 0x0f, 0x4f, 0x29, 0x00, 0xe4, 0x5b, 0x94, 0x46, 0x86, 0x66, 0xa1, 0x83, 0xb3, 0xeb, 0x15, 0xb6, 0x31, 0x50, 0x28, 0xeb, 0xed, 0x0d, 0x32, 0x39, 0xe9, 0x23, 0x81, 0x99, 0x3e, 0xff, 0x17, 0x4c, 0x11, 0x43, 0xd1}, - }, - { /* 25P*/ - addYX: fp.Elt{0xce, 0xe7, 0xf8, 0x94, 0x8f, 0x96, 0xf8, 0x96, 0xe6, 0x72, 0x20, 0x44, 0x2c, 0xa7, 0xfc, 0xba, 0xc8, 0xe1, 0xbb, 0xc9, 0x16, 0x85, 0xcd, 0x0b, 0xe5, 0xb5, 0x5a, 0x7f, 0x51, 0x43, 0x63, 0x8b, 0x23, 0x8e, 0x1d, 0x31, 0xff, 0x46, 0x02, 0x66, 0xcc, 0x9e, 0x4d, 0xa2, 0xca, 0xe2, 0xc7, 0xfd, 0x22, 0xb1, 0xdb, 0xdf, 0x6f, 0xe6, 0xa5, 0x82}, - subYX: fp.Elt{0xd0, 0xf5, 0x65, 0x40, 0xec, 0x8e, 0x65, 0x42, 0x78, 0xc1, 0x65, 0xe4, 0x10, 0xc8, 0x0b, 0x1b, 0xdd, 0x96, 0x68, 0xce, 0xee, 0x45, 0x55, 0xd8, 0x6e, 0xd3, 0xe6, 0x77, 0x19, 0xae, 0xc2, 0x8d, 0x8d, 0x3e, 0x14, 0x3f, 0x6d, 0x00, 0x2f, 0x9b, 0xd1, 0x26, 0x60, 0x28, 0x0f, 0x3a, 0x47, 0xb3, 0xe6, 0x68, 0x28, 0x24, 0x25, 0xca, 0xc8, 0x06}, - dt2: fp.Elt{0x54, 0xbb, 0x60, 0x92, 0xdb, 0x8f, 0x0f, 0x38, 0xe0, 0xe6, 0xe4, 0xc9, 0xcc, 0x14, 0x62, 0x01, 0xc4, 0x2b, 0x0f, 0xcf, 0xed, 0x7d, 0x8e, 0xa4, 0xd9, 0x73, 0x0b, 0xba, 0x0c, 0xaf, 0x0c, 0xf9, 0xe2, 0xeb, 0x29, 0x2a, 0x53, 0xdf, 0x2c, 0x5a, 0xfa, 0x8f, 0xc1, 0x01, 0xd7, 0xb1, 0x45, 0x73, 0x92, 0x32, 0x83, 0x85, 0x12, 0x74, 0x89, 0x44}, - }, - { /* 27P*/ - addYX: fp.Elt{0x0b, 0x73, 0x3c, 0xc2, 0xb1, 0x2e, 0xe1, 0xa7, 0xf5, 0xc9, 0x7a, 0xfb, 0x3d, 0x2d, 0xac, 0x59, 0xdb, 0xfa, 0x36, 0x11, 0xd1, 0x13, 0x04, 0x51, 0x1d, 0xab, 0x9b, 0x6b, 0x93, 0xfe, 0xda, 0xb0, 0x8e, 0xb4, 0x79, 0x11, 0x21, 0x0f, 0x65, 0xb9, 0xbb, 0x79, 0x96, 0x2a, 0xfd, 0x30, 0xe0, 0xb4, 0x2d, 0x9a, 0x55, 0x25, 0x5d, 0xd4, 0xad, 0x2a}, - subYX: fp.Elt{0x9e, 0xc5, 0x04, 0xfe, 0xec, 0x3c, 0x64, 0x1c, 0xed, 0x95, 0xed, 0xae, 0xaf, 0x5c, 0x6e, 0x08, 0x9e, 0x02, 0x29, 0x59, 0x7e, 0x5f, 0xc4, 0x9a, 0xd5, 0x32, 0x72, 0x86, 0xe1, 0x4e, 0x3c, 0xce, 0x99, 0x69, 0x3b, 0xc4, 0xdd, 0x4d, 0xb7, 0xbb, 0xda, 0x3b, 0x1a, 0x99, 0xaa, 0x62, 0x15, 0xc1, 0xf0, 0xb6, 0x6c, 0xec, 0x56, 0xc1, 0xff, 0x0c}, - dt2: fp.Elt{0x2f, 0xf1, 0x3f, 0x7a, 0x2d, 0x56, 0x19, 0x7f, 0xea, 0xbe, 0x59, 0x2e, 0x13, 0x67, 0x81, 0xfb, 0xdb, 0xc8, 0xa3, 0x1d, 0xd5, 0xe9, 0x13, 0x8b, 0x29, 0xdf, 0xcf, 0x9f, 0xe7, 0xd9, 0x0b, 0x70, 0xd3, 0x15, 0x57, 0x4a, 0xe9, 0x50, 0x12, 0x1b, 0x81, 0x4b, 0x98, 0x98, 0xa8, 0x31, 0x1d, 0x27, 0x47, 0x38, 0xed, 0x57, 0x99, 0x26, 0xb2, 0xee}, - }, - { /* 29P*/ - addYX: fp.Elt{0x1c, 0xb2, 0xb2, 0x67, 0x3b, 0x8b, 0x3d, 0x5a, 0x30, 0x7e, 0x38, 0x7e, 0x3c, 0x3d, 0x28, 0x56, 0x59, 0xd8, 0x87, 0x53, 0x8b, 0xe6, 0x6c, 0x5d, 0xe5, 0x0a, 0x33, 0x10, 0xce, 0xa2, 0x17, 0x0d, 0xe8, 0x76, 0xee, 0x68, 0xa8, 0x72, 0x54, 0xbd, 0xa6, 0x24, 0x94, 0x6e, 0x77, 0xc7, 0x53, 0xb7, 0x89, 0x1c, 0x7a, 0xe9, 0x78, 0x9a, 0x74, 0x5f}, - subYX: fp.Elt{0x76, 0x96, 0x1c, 0xcf, 0x08, 0x55, 0xd8, 0x1e, 0x0d, 0xa3, 0x59, 0x95, 0x32, 0xf4, 0xc2, 0x8e, 0x84, 0x5e, 0x4b, 0x04, 0xda, 0x71, 0xc9, 0x78, 0x52, 0xde, 0x14, 0xb4, 0x31, 0xf4, 0xd4, 0xb8, 0x58, 0xc5, 0x20, 0xe8, 0xdd, 0x15, 0xb5, 0xee, 0xea, 0x61, 0xe0, 0xf5, 0xd6, 0xae, 0x55, 0x59, 0x05, 0x3e, 0xaf, 0x74, 0xac, 0x1f, 0x17, 0x82}, - dt2: fp.Elt{0x59, 0x24, 0xcd, 0xfc, 0x11, 0x7e, 0x85, 0x18, 0x3d, 0x69, 0xf7, 0x71, 0x31, 0x66, 0x98, 0x42, 0x95, 0x00, 0x8c, 0xb2, 0xae, 0x39, 0x7e, 0x85, 0xd6, 0xb0, 0x02, 0xec, 0xce, 0xfc, 0x25, 0xb2, 0xe3, 0x99, 0x8e, 0x5b, 0x61, 0x96, 0x2e, 0x6d, 0x96, 0x57, 0x71, 0xa5, 0x93, 0x41, 0x0e, 0x6f, 0xfd, 0x0a, 0xbf, 0xa9, 0xf7, 0x56, 0xa9, 0x3e}, - }, - { /* 31P*/ - addYX: fp.Elt{0xa2, 0x2e, 0x0c, 0x17, 0x4d, 0xcc, 0x85, 0x2c, 0x18, 0xa0, 0xd2, 0x08, 0xba, 0x11, 0xfa, 0x47, 0x71, 0x86, 0xaf, 0x36, 0x6a, 0xd7, 0xfe, 0xb9, 0xb0, 0x2f, 0x89, 0x98, 0x49, 0x69, 0xf8, 0x6a, 0xad, 0x27, 0x5e, 0x0a, 0x22, 0x60, 0x5e, 0x5d, 0xca, 0x06, 0x51, 0x27, 0x99, 0x29, 0x85, 0x68, 0x98, 0xe1, 0xc4, 0x21, 0x50, 0xa0, 0xe9, 0xc1}, - subYX: fp.Elt{0x4d, 0x70, 0xee, 0x91, 0x92, 0x3f, 0xb7, 0xd3, 0x1d, 0xdb, 0x8d, 0x6e, 0x16, 0xf5, 0x65, 0x7d, 0x5f, 0xb5, 0x6c, 0x59, 0x26, 0x70, 0x4b, 0xf2, 0xfc, 0xe7, 0xdf, 0x86, 0xfe, 0xa5, 0xa7, 0xa6, 0x5d, 0xfb, 0x06, 0xe9, 0xf9, 0xcc, 0xc0, 0x37, 0xcc, 0xd8, 0x09, 0x04, 0xd2, 0xa5, 0x1d, 0xd7, 0xb7, 0xce, 0x92, 0xac, 0x3c, 0xad, 0xfb, 0xae}, - dt2: fp.Elt{0x17, 0xa3, 0x9a, 0xc7, 0x86, 0x2a, 0x51, 0xf7, 0x96, 0x79, 0x49, 0x22, 0x2e, 0x5a, 0x01, 0x5c, 0xb5, 0x95, 0xd4, 0xe8, 0xcb, 0x00, 0xca, 0x2d, 0x55, 0xb6, 0x34, 0x36, 0x0b, 0x65, 0x46, 0xf0, 0x49, 0xfc, 0x87, 0x86, 0xe5, 0xc3, 0x15, 0xdb, 0x32, 0xcd, 0xf2, 0xd3, 0x82, 0x4c, 0xe6, 0x61, 0x8a, 0xaf, 0xd4, 0x9e, 0x0f, 0x5a, 0xf2, 0x81}, - }, - { /* 33P*/ - addYX: fp.Elt{0x88, 0x10, 0xc0, 0xcb, 0xf5, 0x77, 0xae, 0xa5, 0xbe, 0xf6, 0xcd, 0x2e, 0x8b, 0x7e, 0xbd, 0x79, 0x62, 0x4a, 0xeb, 0x69, 0xc3, 0x28, 0xaa, 0x72, 0x87, 0xa9, 0x25, 0x87, 0x46, 0xea, 0x0e, 0x62, 0xa3, 0x6a, 0x1a, 0xe2, 0xba, 0xdc, 0x81, 0x10, 0x33, 0x01, 0xf6, 0x16, 0x89, 0x80, 0xc6, 0xcd, 0xdb, 0xdc, 0xba, 0x0e, 0x09, 0x4a, 0x35, 0x4a}, - subYX: fp.Elt{0x86, 0xb2, 0x2b, 0xd0, 0xb8, 0x4a, 0x6d, 0x66, 0x7b, 0x32, 0xdf, 0x3b, 0x1a, 0x19, 0x1f, 0x63, 0xee, 0x1f, 0x3d, 0x1c, 0x5c, 0x14, 0x60, 0x5b, 0x72, 0x49, 0x07, 0xb1, 0x0d, 0x72, 0xc6, 0x35, 0xf0, 0xbc, 0x5e, 0xda, 0x80, 0x6b, 0x64, 0x5b, 0xe5, 0x34, 0x54, 0x39, 0xdd, 0xe6, 0x3c, 0xcb, 0xe5, 0x29, 0x32, 0x06, 0xc6, 0xb1, 0x96, 0x34}, - dt2: fp.Elt{0x85, 0x86, 0xf5, 0x84, 0x86, 0xe6, 0x77, 0x8a, 0x71, 0x85, 0x0c, 0x4f, 0x81, 0x5b, 0x29, 0x06, 0xb5, 0x2e, 0x26, 0x71, 0x07, 0x78, 0x07, 0xae, 0xbc, 0x95, 0x46, 0xc3, 0x65, 0xac, 0xe3, 0x76, 0x51, 0x7d, 0xd4, 0x85, 0x31, 0xe3, 0x43, 0xf3, 0x1b, 0x7c, 0xf7, 0x6b, 0x2c, 0xf8, 0x1c, 0xbb, 0x8d, 0xca, 0xab, 0x4b, 0xba, 0x7f, 0xa4, 0xe2}, - }, - { /* 35P*/ - addYX: fp.Elt{0x1a, 0xee, 0xe7, 0xa4, 0x8a, 0x9d, 0x53, 0x80, 0xc6, 0xb8, 0x4e, 0xdc, 0x89, 0xe0, 0xc4, 0x2b, 0x60, 0x52, 0x6f, 0xec, 0x81, 0xd2, 0x55, 0x6b, 0x1b, 0x6f, 0x17, 0x67, 0x8e, 0x42, 0x26, 0x4c, 0x65, 0x23, 0x29, 0xc6, 0x7b, 0xcd, 0x9f, 0xad, 0x4b, 0x42, 0xd3, 0x0c, 0x75, 0xc3, 0x8a, 0xf5, 0xbe, 0x9e, 0x55, 0xf7, 0x47, 0x5d, 0xbd, 0x3a}, - subYX: fp.Elt{0x0d, 0xa8, 0x3b, 0xf9, 0xc7, 0x7e, 0xc6, 0x86, 0x94, 0xc0, 0x01, 0xff, 0x27, 0xce, 0x43, 0xac, 0xe5, 0xe1, 0xd2, 0x8d, 0xc1, 0x22, 0x31, 0xbe, 0xe1, 0xaf, 0xf9, 0x4a, 0x78, 0xa1, 0x0c, 0xaa, 0xd4, 0x80, 0xe4, 0x09, 0x8d, 0xfb, 0x1d, 0x52, 0xc8, 0x60, 0x2d, 0xf2, 0xa2, 0x89, 0x02, 0x56, 0x3d, 0x56, 0x27, 0x85, 0xc7, 0xf0, 0x2b, 0x9a}, - dt2: fp.Elt{0x62, 0x7c, 0xc7, 0x6b, 0x2c, 0x9d, 0x0a, 0x7c, 0xe5, 0x50, 0x3c, 0xe6, 0x87, 0x1c, 0x82, 0x30, 0x67, 0x3c, 0x39, 0xb6, 0xa0, 0x31, 0xfb, 0x03, 0x7b, 0xa1, 0x58, 0xdf, 0x12, 0x76, 0x5d, 0x5d, 0x0a, 0x8f, 0x9b, 0x37, 0x32, 0xc3, 0x60, 0x33, 0xea, 0x9f, 0x0a, 0x99, 0xfa, 0x20, 0xd0, 0x33, 0x21, 0xc3, 0x94, 0xd4, 0x86, 0x49, 0x7c, 0x4e}, - }, - { /* 37P*/ - addYX: fp.Elt{0xc7, 0x0c, 0x71, 0xfe, 0x55, 0xd1, 0x95, 0x8f, 0x43, 0xbb, 0x6b, 0x74, 0x30, 0xbd, 0xe8, 0x6f, 0x1c, 0x1b, 0x06, 0x62, 0xf5, 0xfc, 0x65, 0xa0, 0xeb, 0x81, 0x12, 0xc9, 0x64, 0x66, 0x61, 0xde, 0xf3, 0x6d, 0xd4, 0xae, 0x8e, 0xb1, 0x72, 0xe0, 0xcd, 0x37, 0x01, 0x28, 0x52, 0xd7, 0x39, 0x46, 0x0c, 0x55, 0xcf, 0x47, 0x70, 0xef, 0xa1, 0x17}, - subYX: fp.Elt{0x8d, 0x58, 0xde, 0x83, 0x88, 0x16, 0x0e, 0x12, 0x42, 0x03, 0x50, 0x60, 0x4b, 0xdf, 0xbf, 0x95, 0xcc, 0x7d, 0x18, 0x17, 0x7e, 0x31, 0x5d, 0x8a, 0x66, 0xc1, 0xcf, 0x14, 0xea, 0xf4, 0xf4, 0xe5, 0x63, 0x2d, 0x32, 0x86, 0x9b, 0xed, 0x1f, 0x4f, 0x03, 0xaf, 0x33, 0x92, 0xcb, 0xaf, 0x9c, 0x05, 0x0d, 0x47, 0x1b, 0x42, 0xba, 0x13, 0x22, 0x98}, - dt2: fp.Elt{0xb5, 0x48, 0xeb, 0x7d, 0x3d, 0x10, 0x9f, 0x59, 0xde, 0xf8, 0x1c, 0x4f, 0x7d, 0x9d, 0x40, 0x4d, 0x9e, 0x13, 0x24, 0xb5, 0x21, 0x09, 0xb7, 0xee, 0x98, 0x5c, 0x56, 0xbc, 0x5e, 0x2b, 0x78, 0x38, 0x06, 0xac, 0xe3, 0xe0, 0xfa, 0x2e, 0xde, 0x4f, 0xd2, 0xb3, 0xfb, 0x2d, 0x71, 0x84, 0xd1, 0x9d, 0x12, 0x5b, 0x35, 0xc8, 0x03, 0x68, 0x67, 0xc7}, - }, - { /* 39P*/ - addYX: fp.Elt{0xb6, 0x65, 0xfb, 0xa7, 0x06, 0x35, 0xbb, 0xe0, 0x31, 0x8d, 0x91, 0x40, 0x98, 0xab, 0x30, 0xe4, 0xca, 0x12, 0x59, 0x89, 0xed, 0x65, 0x5d, 0x7f, 0xae, 0x69, 0xa0, 0xa4, 0xfa, 0x78, 0xb4, 0xf7, 0xed, 0xae, 0x86, 0x78, 0x79, 0x64, 0x24, 0xa6, 0xd4, 0xe1, 0xf6, 0xd3, 0xa0, 0x89, 0xba, 0x20, 0xf4, 0x54, 0x0d, 0x8f, 0xdb, 0x1a, 0x79, 0xdb}, - subYX: fp.Elt{0xe1, 0x82, 0x0c, 0x4d, 0xde, 0x9f, 0x40, 0xf0, 0xc1, 0xbd, 0x8b, 0xd3, 0x24, 0x03, 0xcd, 0xf2, 0x92, 0x7d, 0xe2, 0x68, 0x7f, 0xf1, 0xbe, 0x69, 0xde, 0x34, 0x67, 0x4c, 0x85, 0x3b, 0xec, 0x98, 0xcc, 0x4d, 0x3e, 0xc0, 0x96, 0x27, 0xe6, 0x75, 0xfc, 0xdf, 0x37, 0xc0, 0x1e, 0x27, 0xe0, 0xf6, 0xc2, 0xbd, 0xbc, 0x3d, 0x9b, 0x39, 0xdc, 0xe2}, - dt2: fp.Elt{0xd8, 0x29, 0xa7, 0x39, 0xe3, 0x9f, 0x2f, 0x0e, 0x4b, 0x24, 0x21, 0x70, 0xef, 0xfd, 0x91, 0xea, 0xbf, 0xe1, 0x72, 0x90, 0xcc, 0xc9, 0x84, 0x0e, 0xad, 0xd5, 0xe6, 0xbb, 0xc5, 0x99, 0x7f, 0xa4, 0xf0, 0x2e, 0xcc, 0x95, 0x64, 0x27, 0x19, 0xd8, 0x4c, 0x27, 0x0d, 0xff, 0xb6, 0x29, 0xe2, 0x6c, 0xfa, 0xbb, 0x4d, 0x9c, 0xbb, 0xaf, 0xa5, 0xec}, - }, - { /* 41P*/ - addYX: fp.Elt{0xd6, 0x33, 0x3f, 0x9f, 0xcf, 0xfd, 0x4c, 0xd1, 0xfe, 0xe5, 0xeb, 0x64, 0x27, 0xae, 0x7a, 0xa2, 0x82, 0x50, 0x6d, 0xaa, 0xe3, 0x5d, 0xe2, 0x48, 0x60, 0xb3, 0x76, 0x04, 0xd9, 0x19, 0xa7, 0xa1, 0x73, 0x8d, 0x38, 0xa9, 0xaf, 0x45, 0xb5, 0xb2, 0x62, 0x9b, 0xf1, 0x35, 0x7b, 0x84, 0x66, 0xeb, 0x06, 0xef, 0xf1, 0xb2, 0x2d, 0x6a, 0x61, 0x15}, - subYX: fp.Elt{0x86, 0x50, 0x42, 0xf7, 0xda, 0x59, 0xb2, 0xcf, 0x0d, 0x3d, 0xee, 0x8e, 0x53, 0x5d, 0xf7, 0x9e, 0x6a, 0x26, 0x2d, 0xc7, 0x8c, 0x8e, 0x18, 0x50, 0x6d, 0xb7, 0x51, 0x4c, 0xa7, 0x52, 0x6e, 0x0e, 0x0a, 0x16, 0x74, 0xb2, 0x81, 0x8b, 0x56, 0x27, 0x22, 0x84, 0xf4, 0x56, 0xc5, 0x06, 0xe1, 0x8b, 0xca, 0x2d, 0xdb, 0x9a, 0xf6, 0x10, 0x9c, 0x51}, - dt2: fp.Elt{0x1f, 0x16, 0xa2, 0x78, 0x96, 0x1b, 0x85, 0x9c, 0x76, 0x49, 0xd4, 0x0f, 0xac, 0xb0, 0xf4, 0xd0, 0x06, 0x2c, 0x7e, 0x6d, 0x6e, 0x8e, 0xc7, 0x9f, 0x18, 0xad, 0xfc, 0x88, 0x0c, 0x0c, 0x09, 0x05, 0x05, 0xa0, 0x79, 0x72, 0x32, 0x72, 0x87, 0x0f, 0x49, 0x87, 0x0c, 0xb4, 0x12, 0xc2, 0x09, 0xf8, 0x9f, 0x30, 0x72, 0xa9, 0x47, 0x13, 0x93, 0x49}, - }, - { /* 43P*/ - addYX: fp.Elt{0xcc, 0xb1, 0x4c, 0xd3, 0xc0, 0x9e, 0x9e, 0x4d, 0x6d, 0x28, 0x0b, 0xa5, 0x94, 0xa7, 0x2e, 0xc2, 0xc7, 0xaf, 0x29, 0x73, 0xc9, 0x68, 0xea, 0x0f, 0x34, 0x37, 0x8d, 0x96, 0x8f, 0x3a, 0x3d, 0x73, 0x1e, 0x6d, 0x9f, 0xcf, 0x8d, 0x83, 0xb5, 0x71, 0xb9, 0xe1, 0x4b, 0x67, 0x71, 0xea, 0xcf, 0x56, 0xe5, 0xeb, 0x72, 0x15, 0x2f, 0x9e, 0xa8, 0xaa}, - subYX: fp.Elt{0xf4, 0x3e, 0x85, 0x1c, 0x1a, 0xef, 0x50, 0xd1, 0xb4, 0x20, 0xb2, 0x60, 0x05, 0x98, 0xfe, 0x47, 0x3b, 0xc1, 0x76, 0xca, 0x2c, 0x4e, 0x5a, 0x42, 0xa3, 0xf7, 0x20, 0xaa, 0x57, 0x39, 0xee, 0x34, 0x1f, 0xe1, 0x68, 0xd3, 0x7e, 0x06, 0xc4, 0x6c, 0xc7, 0x76, 0x2b, 0xe4, 0x1c, 0x48, 0x44, 0xe6, 0xe5, 0x44, 0x24, 0x8d, 0xb3, 0xb6, 0x88, 0x32}, - dt2: fp.Elt{0x18, 0xa7, 0xba, 0xd0, 0x44, 0x6f, 0x33, 0x31, 0x00, 0xf8, 0xf6, 0x12, 0xe3, 0xc5, 0xc7, 0xb5, 0x91, 0x9c, 0x91, 0xb5, 0x75, 0x18, 0x18, 0x8a, 0xab, 0xed, 0x24, 0x11, 0x2e, 0xce, 0x5a, 0x0f, 0x94, 0x5f, 0x2e, 0xca, 0xd3, 0x80, 0xea, 0xe5, 0x34, 0x96, 0x67, 0x8b, 0x6a, 0x26, 0x5e, 0xc8, 0x9d, 0x2c, 0x5e, 0x6c, 0xa2, 0x0c, 0xbf, 0xf0}, - }, - { /* 45P*/ - addYX: fp.Elt{0xb3, 0xbf, 0xa3, 0x85, 0xee, 0xf6, 0x58, 0x02, 0x78, 0xc4, 0x30, 0xd6, 0x57, 0x59, 0x8c, 0x88, 0x08, 0x7c, 0xbc, 0xbe, 0x0a, 0x74, 0xa9, 0xde, 0x69, 0xe7, 0x41, 0xd8, 0xbf, 0x66, 0x8d, 0x3d, 0x28, 0x00, 0x8c, 0x47, 0x65, 0x34, 0xfe, 0x86, 0x9e, 0x6a, 0xf2, 0x41, 0x6a, 0x94, 0xc4, 0x88, 0x75, 0x23, 0x0d, 0x52, 0x69, 0xee, 0x07, 0x89}, - subYX: fp.Elt{0x22, 0x3c, 0xa1, 0x70, 0x58, 0x97, 0x93, 0xbe, 0x59, 0xa8, 0x0b, 0x8a, 0x46, 0x2a, 0x38, 0x1e, 0x08, 0x6b, 0x61, 0x9f, 0xf2, 0x4a, 0x8b, 0x80, 0x68, 0x6e, 0xc8, 0x92, 0x60, 0xf3, 0xc9, 0x89, 0xb2, 0x6d, 0x63, 0xb0, 0xeb, 0x83, 0x15, 0x63, 0x0e, 0x64, 0xbb, 0xb8, 0xfe, 0xb4, 0x81, 0x90, 0x01, 0x28, 0x10, 0xb9, 0x74, 0x6e, 0xde, 0xa4}, - dt2: fp.Elt{0x1a, 0x23, 0x45, 0xa8, 0x6f, 0x4e, 0xa7, 0x4a, 0x0c, 0xeb, 0xb0, 0x43, 0xf9, 0xef, 0x99, 0x60, 0x5b, 0xdb, 0x66, 0xc0, 0x86, 0x71, 0x43, 0xb1, 0x22, 0x7b, 0x1c, 0xe7, 0x8d, 0x09, 0x1d, 0x83, 0x76, 0x9c, 0xd3, 0x5a, 0xdd, 0x42, 0xd9, 0x2f, 0x2d, 0xba, 0x7a, 0xc2, 0xd9, 0x6b, 0xd4, 0x7a, 0xf1, 0xd5, 0x5f, 0x6b, 0x85, 0xbf, 0x0b, 0xf1}, - }, - { /* 47P*/ - addYX: fp.Elt{0xb2, 0x83, 0xfa, 0x1f, 0xd2, 0xce, 0xb6, 0xf2, 0x2d, 0xea, 0x1b, 0xe5, 0x29, 0xa5, 0x72, 0xf9, 0x25, 0x48, 0x4e, 0xf2, 0x50, 0x1b, 0x39, 0xda, 0x34, 0xc5, 0x16, 0x13, 0xb4, 0x0c, 0xa1, 0x00, 0x79, 0x7a, 0xf5, 0x8b, 0xf3, 0x70, 0x14, 0xb6, 0xfc, 0x9a, 0x47, 0x68, 0x1e, 0x42, 0x70, 0x64, 0x2a, 0x84, 0x3e, 0x3d, 0x20, 0x58, 0xf9, 0x6a}, - subYX: fp.Elt{0xd9, 0xee, 0xc0, 0xc4, 0xf5, 0xc2, 0x86, 0xaf, 0x45, 0xd2, 0xd2, 0x87, 0x1b, 0x64, 0xd5, 0xe0, 0x8c, 0x44, 0x00, 0x4f, 0x43, 0x89, 0x04, 0x48, 0x4a, 0x0b, 0xca, 0x94, 0x06, 0x2f, 0x23, 0x5b, 0x6c, 0x8d, 0x44, 0x66, 0x53, 0xf5, 0x5a, 0x20, 0x72, 0x28, 0x58, 0x84, 0xcc, 0x73, 0x22, 0x5e, 0xd1, 0x0b, 0x56, 0x5e, 0x6a, 0xa3, 0x11, 0x91}, - dt2: fp.Elt{0x6e, 0x9f, 0x88, 0xa8, 0x68, 0x2f, 0x12, 0x37, 0x88, 0xfc, 0x92, 0x8f, 0x24, 0xeb, 0x5b, 0x2a, 0x2a, 0xd0, 0x14, 0x40, 0x4c, 0xa9, 0xa4, 0x03, 0x0c, 0x45, 0x48, 0x13, 0xe8, 0xa6, 0x37, 0xab, 0xc0, 0x06, 0x38, 0x6c, 0x96, 0x73, 0x40, 0x6c, 0xc6, 0xea, 0x56, 0xc6, 0xe9, 0x1a, 0x69, 0xeb, 0x7a, 0xd1, 0x33, 0x69, 0x58, 0x2b, 0xea, 0x2f}, - }, - { /* 49P*/ - addYX: fp.Elt{0x58, 0xa8, 0x05, 0x41, 0x00, 0x9d, 0xaa, 0xd9, 0x98, 0xcf, 0xb9, 0x41, 0xb5, 0x4a, 0x8d, 0xe2, 0xe7, 0xc0, 0x72, 0xef, 0xc8, 0x28, 0x6b, 0x68, 0x9d, 0xc9, 0xdf, 0x05, 0x8b, 0xd0, 0x04, 0x74, 0x79, 0x45, 0x52, 0x05, 0xa3, 0x6e, 0x35, 0x3a, 0xe3, 0xef, 0xb2, 0xdc, 0x08, 0x6f, 0x4e, 0x76, 0x85, 0x67, 0xba, 0x23, 0x8f, 0xdd, 0xaf, 0x09}, - subYX: fp.Elt{0xb4, 0x38, 0xc8, 0xff, 0x4f, 0x65, 0x2a, 0x7e, 0xad, 0xb1, 0xc6, 0xb9, 0x3d, 0xd6, 0xf7, 0x14, 0xcf, 0xf6, 0x98, 0x75, 0xbb, 0x47, 0x83, 0x90, 0xe7, 0xe1, 0xf6, 0x14, 0x99, 0x7e, 0xfa, 0xe4, 0x77, 0x24, 0xe3, 0xe7, 0xf0, 0x1e, 0xdb, 0x27, 0x4e, 0x16, 0x04, 0xf2, 0x08, 0x52, 0xfc, 0xec, 0x55, 0xdb, 0x2e, 0x67, 0xe1, 0x94, 0x32, 0x89}, - dt2: fp.Elt{0x00, 0xad, 0x03, 0x35, 0x1a, 0xb1, 0x88, 0xf0, 0xc9, 0x11, 0xe4, 0x12, 0x52, 0x61, 0xfd, 0x8a, 0x1b, 0x6a, 0x0a, 0x4c, 0x42, 0x46, 0x22, 0x0e, 0xa5, 0xf9, 0xe2, 0x50, 0xf2, 0xb2, 0x1f, 0x20, 0x78, 0x10, 0xf6, 0xbf, 0x7f, 0x0c, 0x9c, 0xad, 0x40, 0x8b, 0x82, 0xd4, 0xba, 0x69, 0x09, 0xac, 0x4b, 0x6d, 0xc4, 0x49, 0x17, 0x81, 0x57, 0x3b}, - }, - { /* 51P*/ - addYX: fp.Elt{0x0d, 0xfe, 0xb4, 0x35, 0x11, 0xbd, 0x1d, 0x6b, 0xc2, 0xc5, 0x3b, 0xd2, 0x23, 0x2c, 0x72, 0xe3, 0x48, 0xb1, 0x48, 0x73, 0xfb, 0xa3, 0x21, 0x6e, 0xc0, 0x09, 0x69, 0xac, 0xe1, 0x60, 0xbc, 0x24, 0x03, 0x99, 0x63, 0x0a, 0x00, 0xf0, 0x75, 0xf6, 0x92, 0xc5, 0xd6, 0xdb, 0x51, 0xd4, 0x7d, 0xe6, 0xf4, 0x11, 0x79, 0xd7, 0xc3, 0xaf, 0x48, 0xd0}, - subYX: fp.Elt{0xf4, 0x4f, 0xaf, 0x31, 0xe3, 0x10, 0x89, 0x95, 0xf0, 0x8a, 0xf6, 0x31, 0x9f, 0x48, 0x02, 0xba, 0x42, 0x2b, 0x3c, 0x22, 0x8b, 0xcc, 0x12, 0x98, 0x6e, 0x7a, 0x64, 0x3a, 0xc4, 0xca, 0x32, 0x2a, 0x72, 0xf8, 0x2c, 0xcf, 0x78, 0x5e, 0x7a, 0x75, 0x6e, 0x72, 0x46, 0x48, 0x62, 0x28, 0xac, 0x58, 0x1a, 0xc6, 0x59, 0x88, 0x2a, 0x44, 0x9e, 0x83}, - dt2: fp.Elt{0xb3, 0xde, 0x36, 0xfd, 0xeb, 0x1b, 0xd4, 0x24, 0x1b, 0x08, 0x8c, 0xfe, 0xa9, 0x41, 0xa1, 0x64, 0xf2, 0x6d, 0xdb, 0xf9, 0x94, 0xae, 0x86, 0x71, 0xab, 0x10, 0xbf, 0xa3, 0xb2, 0xa0, 0xdf, 0x10, 0x8c, 0x74, 0xce, 0xb3, 0xfc, 0xdb, 0xba, 0x15, 0xf6, 0x91, 0x7a, 0x9c, 0x36, 0x1e, 0x45, 0x07, 0x3c, 0xec, 0x1a, 0x61, 0x26, 0x93, 0xe3, 0x50}, - }, - { /* 53P*/ - addYX: fp.Elt{0xc5, 0x50, 0xc5, 0x83, 0xb0, 0xbd, 0xd9, 0xf6, 0x6d, 0x15, 0x5e, 0xc1, 0x1a, 0x33, 0xa0, 0xce, 0x13, 0x70, 0x3b, 0xe1, 0x31, 0xc6, 0xc4, 0x02, 0xec, 0x8c, 0xd5, 0x9c, 0x97, 0xd3, 0x12, 0xc4, 0xa2, 0xf9, 0xd5, 0xfb, 0x22, 0x69, 0x94, 0x09, 0x2f, 0x59, 0xce, 0xdb, 0xf2, 0xf2, 0x00, 0xe0, 0xa9, 0x08, 0x44, 0x2e, 0x8b, 0x6b, 0xf5, 0xb3}, - subYX: fp.Elt{0x90, 0xdd, 0xec, 0xa2, 0x65, 0xb7, 0x61, 0xbc, 0xaa, 0x70, 0xa2, 0x15, 0xd8, 0xb0, 0xf8, 0x8e, 0x23, 0x3d, 0x9f, 0x46, 0xa3, 0x29, 0x20, 0xd1, 0xa1, 0x15, 0x81, 0xc6, 0xb6, 0xde, 0xbe, 0x60, 0x63, 0x24, 0xac, 0x15, 0xfb, 0xeb, 0xd3, 0xea, 0x57, 0x13, 0x86, 0x38, 0x1e, 0x22, 0xf4, 0x8c, 0x5d, 0xaf, 0x1b, 0x27, 0x21, 0x4f, 0xa3, 0x63}, - dt2: fp.Elt{0x07, 0x15, 0x87, 0xc4, 0xfd, 0xa1, 0x97, 0x7a, 0x07, 0x1f, 0x56, 0xcc, 0xe3, 0x6a, 0x01, 0x90, 0xce, 0xf9, 0xfa, 0x50, 0xb2, 0xe0, 0x87, 0x8b, 0x6c, 0x63, 0x6c, 0xf6, 0x2a, 0x09, 0xef, 0xef, 0xd2, 0x31, 0x40, 0x25, 0xf6, 0x84, 0xcb, 0xe0, 0xc4, 0x23, 0xc1, 0xcb, 0xe2, 0x02, 0x83, 0x2d, 0xed, 0x74, 0x74, 0x8b, 0xf8, 0x7c, 0x81, 0x18}, - }, - { /* 55P*/ - addYX: fp.Elt{0x9e, 0xe5, 0x59, 0x95, 0x63, 0x2e, 0xac, 0x8b, 0x03, 0x3c, 0xc1, 0x8e, 0xe1, 0x5b, 0x56, 0x3c, 0x16, 0x41, 0xe4, 0xc2, 0x60, 0x0c, 0x6d, 0x65, 0x9f, 0xfc, 0x27, 0x68, 0x43, 0x44, 0x05, 0x12, 0x6c, 0xda, 0x04, 0xef, 0xcf, 0xcf, 0xdc, 0x0a, 0x1a, 0x7f, 0x12, 0xd3, 0xeb, 0x02, 0xb6, 0x04, 0xca, 0xd6, 0xcb, 0xf0, 0x22, 0xba, 0x35, 0x6d}, - subYX: fp.Elt{0x09, 0x6d, 0xf9, 0x64, 0x4c, 0xe6, 0x41, 0xff, 0x01, 0x4d, 0xce, 0x1e, 0xfa, 0x38, 0xa2, 0x25, 0x62, 0xff, 0x03, 0x39, 0x18, 0x91, 0xbb, 0x9d, 0xce, 0x02, 0xf0, 0xf1, 0x3c, 0x55, 0x18, 0xa9, 0xab, 0x4d, 0xd2, 0x35, 0xfd, 0x8d, 0xa9, 0xb2, 0xad, 0xb7, 0x06, 0x6e, 0xc6, 0x69, 0x49, 0xd6, 0x98, 0x98, 0x0b, 0x22, 0x81, 0x6b, 0xbd, 0xa0}, - dt2: fp.Elt{0x22, 0xf4, 0x85, 0x5d, 0x2b, 0xf1, 0x55, 0xa5, 0xd6, 0x27, 0x86, 0x57, 0x12, 0x1f, 0x16, 0x0a, 0x5a, 0x9b, 0xf2, 0x38, 0xb6, 0x28, 0xd8, 0x99, 0x0c, 0x89, 0x1d, 0x7f, 0xca, 0x21, 0x17, 0x1a, 0x0b, 0x02, 0x5f, 0x77, 0x2f, 0x73, 0x30, 0x7c, 0xc8, 0xd7, 0x2b, 0xcc, 0xe7, 0xf3, 0x21, 0xac, 0x53, 0xa7, 0x11, 0x5d, 0xd8, 0x1d, 0x9b, 0xf5}, - }, - { /* 57P*/ - addYX: fp.Elt{0x94, 0x63, 0x5d, 0xef, 0xfd, 0x6d, 0x25, 0x4e, 0x6d, 0x29, 0x03, 0xed, 0x24, 0x28, 0x27, 0x57, 0x47, 0x3e, 0x6a, 0x1a, 0xfe, 0x37, 0xee, 0x5f, 0x83, 0x29, 0x14, 0xfd, 0x78, 0x25, 0x8a, 0xe1, 0x02, 0x38, 0xd8, 0xca, 0x65, 0x55, 0x40, 0x7d, 0x48, 0x2c, 0x7c, 0x7e, 0x60, 0xb6, 0x0c, 0x6d, 0xf7, 0xe8, 0xb3, 0x62, 0x53, 0xd6, 0x9c, 0x2b}, - subYX: fp.Elt{0x47, 0x25, 0x70, 0x62, 0xf5, 0x65, 0x93, 0x62, 0x08, 0xac, 0x59, 0x66, 0xdb, 0x08, 0xd9, 0x1a, 0x19, 0xaf, 0xf4, 0xef, 0x02, 0xa2, 0x78, 0xa9, 0x55, 0x1c, 0xfa, 0x08, 0x11, 0xcb, 0xa3, 0x71, 0x74, 0xb1, 0x62, 0xe7, 0xc7, 0xf3, 0x5a, 0xb5, 0x8b, 0xd4, 0xf6, 0x10, 0x57, 0x79, 0x72, 0x2f, 0x13, 0x86, 0x7b, 0x44, 0x5f, 0x48, 0xfd, 0x88}, - dt2: fp.Elt{0x10, 0x02, 0xcd, 0x05, 0x9a, 0xc3, 0x32, 0x6d, 0x10, 0x3a, 0x74, 0xba, 0x06, 0xc4, 0x3b, 0x34, 0xbc, 0x36, 0xed, 0xa3, 0xba, 0x9a, 0xdb, 0x6d, 0xd4, 0x69, 0x99, 0x97, 0xd0, 0xe4, 0xdd, 0xf5, 0xd4, 0x7c, 0xd3, 0x4e, 0xab, 0xd1, 0x3b, 0xbb, 0xe9, 0xc7, 0x6a, 0x94, 0x25, 0x61, 0xf0, 0x06, 0xc5, 0x12, 0xa8, 0x86, 0xe5, 0x35, 0x46, 0xeb}, - }, - { /* 59P*/ - addYX: fp.Elt{0x9e, 0x95, 0x11, 0xc6, 0xc7, 0xe8, 0xee, 0x5a, 0x26, 0xa0, 0x72, 0x72, 0x59, 0x91, 0x59, 0x16, 0x49, 0x99, 0x7e, 0xbb, 0xd7, 0x15, 0xb4, 0xf2, 0x40, 0xf9, 0x5a, 0x4d, 0xc8, 0xa0, 0xe2, 0x34, 0x7b, 0x34, 0xf3, 0x99, 0xbf, 0xa9, 0xf3, 0x79, 0xc1, 0x1a, 0x0c, 0xf4, 0x86, 0x74, 0x4e, 0xcb, 0xbc, 0x90, 0xad, 0xb6, 0x51, 0x6d, 0xaa, 0x33}, - subYX: fp.Elt{0x9f, 0xd1, 0xc5, 0xa2, 0x6c, 0x24, 0x88, 0x15, 0x71, 0x68, 0xf6, 0x07, 0x45, 0x02, 0xc4, 0x73, 0x7e, 0x75, 0x87, 0xca, 0x7c, 0xf0, 0x92, 0x00, 0x75, 0xd6, 0x5a, 0xdd, 0xe0, 0x64, 0x16, 0x9d, 0x62, 0x80, 0x33, 0x9f, 0xf4, 0x8e, 0x1a, 0x15, 0x1c, 0xd3, 0x0f, 0x4d, 0x4f, 0x62, 0x2d, 0xd7, 0xa5, 0x77, 0xe3, 0xea, 0xf0, 0xfb, 0x1a, 0xdb}, - dt2: fp.Elt{0x6a, 0xa2, 0xb1, 0xaa, 0xfb, 0x5a, 0x32, 0x4e, 0xff, 0x47, 0x06, 0xd5, 0x9a, 0x4f, 0xce, 0x83, 0x5b, 0x82, 0x34, 0x3e, 0x47, 0xb8, 0xf8, 0xe9, 0x7c, 0x67, 0x69, 0x8d, 0x9c, 0xb7, 0xde, 0x57, 0xf4, 0x88, 0x41, 0x56, 0x0c, 0x87, 0x1e, 0xc9, 0x2f, 0x54, 0xbf, 0x5c, 0x68, 0x2c, 0xd9, 0xc4, 0xef, 0x53, 0x73, 0x1e, 0xa6, 0x38, 0x02, 0x10}, - }, - { /* 61P*/ - addYX: fp.Elt{0x08, 0x80, 0x4a, 0xc9, 0xb7, 0xa8, 0x88, 0xd9, 0xfc, 0x6a, 0xc0, 0x3e, 0xc2, 0x33, 0x4d, 0x2b, 0x2a, 0xa3, 0x6d, 0x72, 0x3e, 0xdc, 0x34, 0x68, 0x08, 0xbf, 0x27, 0xef, 0xf4, 0xff, 0xe2, 0x0c, 0x31, 0x0c, 0xa2, 0x0a, 0x1f, 0x65, 0xc1, 0x4c, 0x61, 0xd3, 0x1b, 0xbc, 0x25, 0xb1, 0xd0, 0xd4, 0x89, 0xb2, 0x53, 0xfb, 0x43, 0xa5, 0xaf, 0x04}, - subYX: fp.Elt{0xe3, 0xe1, 0x37, 0xad, 0x58, 0xa9, 0x55, 0x81, 0xee, 0x64, 0x21, 0xb9, 0xf5, 0x4c, 0x35, 0xea, 0x4a, 0xd3, 0x26, 0xaa, 0x90, 0xd4, 0x60, 0x46, 0x09, 0x4b, 0x4a, 0x62, 0xf9, 0xcd, 0xe1, 0xee, 0xbb, 0xc2, 0x09, 0x0b, 0xb0, 0x96, 0x8e, 0x43, 0x77, 0xaf, 0x25, 0x20, 0x5e, 0x47, 0xe4, 0x1d, 0x50, 0x69, 0x74, 0x08, 0xd7, 0xb9, 0x90, 0x13}, - dt2: fp.Elt{0x51, 0x91, 0x95, 0x64, 0x03, 0x16, 0xfd, 0x6e, 0x26, 0x94, 0x6b, 0x61, 0xe7, 0xd9, 0xe0, 0x4a, 0x6d, 0x7c, 0xfa, 0xc0, 0xe2, 0x43, 0x23, 0x53, 0x70, 0xf5, 0x6f, 0x73, 0x8b, 0x81, 0xb0, 0x0c, 0xee, 0x2e, 0x46, 0xf2, 0x8d, 0xa6, 0xfb, 0xb5, 0x1c, 0x33, 0xbf, 0x90, 0x59, 0xc9, 0x7c, 0xb8, 0x6f, 0xad, 0x75, 0x02, 0x90, 0x8e, 0x59, 0x75}, - }, - { /* 63P*/ - addYX: fp.Elt{0x36, 0x4d, 0x77, 0x04, 0xb8, 0x7d, 0x4a, 0xd1, 0xc5, 0xbb, 0x7b, 0x50, 0x5f, 0x8d, 0x9d, 0x62, 0x0f, 0x66, 0x71, 0xec, 0x87, 0xc5, 0x80, 0x82, 0xc8, 0xf4, 0x6a, 0x94, 0x92, 0x5b, 0xb0, 0x16, 0x9b, 0xb2, 0xc9, 0x6f, 0x2b, 0x2d, 0xee, 0x95, 0x73, 0x2e, 0xc2, 0x1b, 0xc5, 0x55, 0x36, 0x86, 0x24, 0xf8, 0x20, 0x05, 0x0d, 0x93, 0xd7, 0x76}, - subYX: fp.Elt{0x7f, 0x01, 0xeb, 0x2e, 0x48, 0x4d, 0x1d, 0xf1, 0x06, 0x7e, 0x7c, 0x2a, 0x43, 0xbf, 0x28, 0xac, 0xe9, 0x58, 0x13, 0xc8, 0xbf, 0x8e, 0xc0, 0xef, 0xe8, 0x4f, 0x46, 0x8a, 0xe7, 0xc0, 0xf6, 0x0f, 0x0a, 0x03, 0x48, 0x91, 0x55, 0x39, 0x2a, 0xe3, 0xdc, 0xf6, 0x22, 0x9d, 0x4d, 0x71, 0x55, 0x68, 0x25, 0x6e, 0x95, 0x52, 0xee, 0x4c, 0xd9, 0x01}, - dt2: fp.Elt{0xac, 0x33, 0x3f, 0x7c, 0x27, 0x35, 0x15, 0x91, 0x33, 0x8d, 0xf9, 0xc4, 0xf4, 0xf3, 0x90, 0x09, 0x75, 0x69, 0x62, 0x9f, 0x61, 0x35, 0x83, 0x92, 0x04, 0xef, 0x96, 0x38, 0x80, 0x9e, 0x88, 0xb3, 0x67, 0x95, 0xbe, 0x79, 0x3c, 0x35, 0xd8, 0xdc, 0xb2, 0x3e, 0x2d, 0xe6, 0x46, 0xbe, 0x81, 0xf3, 0x32, 0x0e, 0x37, 0x23, 0x75, 0x2a, 0x3d, 0xa0}, - }, -} diff --git a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist_basemult.go b/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist_basemult.go deleted file mode 100644 index f6ac5ed..0000000 --- a/backend/vendor/github.com/cloudflare/circl/ecc/goldilocks/twist_basemult.go +++ /dev/null @@ -1,62 +0,0 @@ -package goldilocks - -import ( - "crypto/subtle" - - mlsb "github.com/cloudflare/circl/math/mlsbset" -) - -const ( - // MLSBRecoding parameters - fxT = 448 - fxV = 2 - fxW = 3 - fx2w1 = 1 << (uint(fxW) - 1) -) - -// ScalarBaseMult returns kG where G is the generator point. -func (e twistCurve) ScalarBaseMult(k *Scalar) *twistPoint { - m, err := mlsb.New(fxT, fxV, fxW) - if err != nil { - panic(err) - } - if m.IsExtended() { - panic("not extended") - } - - var isZero int - if k.IsZero() { - isZero = 1 - } - subtle.ConstantTimeCopy(isZero, k[:], order[:]) - - minusK := *k - isEven := 1 - int(k[0]&0x1) - minusK.Neg() - subtle.ConstantTimeCopy(isEven, k[:], minusK[:]) - c, err := m.Encode(k[:]) - if err != nil { - panic(err) - } - - gP := c.Exp(groupMLSB{}) - P := gP.(*twistPoint) - P.cneg(uint(isEven)) - return P -} - -type groupMLSB struct{} - -func (e groupMLSB) ExtendedEltP() mlsb.EltP { return nil } -func (e groupMLSB) Sqr(x mlsb.EltG) { x.(*twistPoint).Double() } -func (e groupMLSB) Mul(x mlsb.EltG, y mlsb.EltP) { x.(*twistPoint).mixAddZ1(y.(*preTwistPointAffine)) } -func (e groupMLSB) Identity() mlsb.EltG { return twistCurve{}.Identity() } -func (e groupMLSB) NewEltP() mlsb.EltP { return &preTwistPointAffine{} } -func (e groupMLSB) Lookup(a mlsb.EltP, v uint, s, u int32) { - Tabj := &tabFixMult[v] - P := a.(*preTwistPointAffine) - for k := range Tabj { - P.cmov(&Tabj[k], uint(subtle.ConstantTimeEq(int32(k), u))) - } - P.cneg(int(s >> 31)) -} diff --git a/backend/vendor/github.com/cloudflare/circl/hpke/aead.go b/backend/vendor/github.com/cloudflare/circl/hpke/aead.go deleted file mode 100644 index baf147b..0000000 --- a/backend/vendor/github.com/cloudflare/circl/hpke/aead.go +++ /dev/null @@ -1,103 +0,0 @@ -package hpke - -import ( - "crypto/cipher" - "fmt" -) - -type encdecContext struct { - // Serialized parameters - suite Suite - sharedSecret []byte - secret []byte - keyScheduleContext []byte - exporterSecret []byte - key []byte - baseNonce []byte - sequenceNumber []byte - - // Operational parameters - cipher.AEAD - nonce []byte -} - -type ( - sealContext struct{ *encdecContext } - openContext struct{ *encdecContext } -) - -// Export takes a context string exporterContext and a desired length (in -// bytes), and produces a secret derived from the internal exporter secret -// using the corresponding KDF Expand function. It panics if length is -// greater than 255*N bytes, where N is the size (in bytes) of the KDF's -// output. -func (c *encdecContext) Export(exporterContext []byte, length uint) []byte { - maxLength := uint(255 * c.suite.kdfID.ExtractSize()) - if length > maxLength { - panic(fmt.Errorf("output length must be lesser than %v bytes", maxLength)) - } - return c.suite.labeledExpand(c.exporterSecret, []byte("sec"), - exporterContext, uint16(length)) -} - -func (c *encdecContext) Suite() Suite { - return c.suite -} - -func (c *encdecContext) calcNonce() []byte { - for i := range c.baseNonce { - c.nonce[i] = c.baseNonce[i] ^ c.sequenceNumber[i] - } - return c.nonce -} - -func (c *encdecContext) increment() error { - // tests whether the sequence number is all-ones, which prevents an - // overflow after the increment. - allOnes := byte(0xFF) - for i := range c.sequenceNumber { - allOnes &= c.sequenceNumber[i] - } - if allOnes == byte(0xFF) { - return ErrAEADSeqOverflows - } - - // performs an increment by 1 and verifies whether the sequence overflows. - carry := uint(1) - for i := len(c.sequenceNumber) - 1; i >= 0; i-- { - sum := uint(c.sequenceNumber[i]) + carry - carry = sum >> 8 - c.sequenceNumber[i] = byte(sum & 0xFF) - } - if carry != 0 { - return ErrAEADSeqOverflows - } - return nil -} - -func (c *sealContext) Seal(pt, aad []byte) ([]byte, error) { - ct := c.AEAD.Seal(nil, c.calcNonce(), pt, aad) - err := c.increment() - if err != nil { - for i := range ct { - ct[i] = 0 - } - return nil, err - } - return ct, nil -} - -func (c *openContext) Open(ct, aad []byte) ([]byte, error) { - pt, err := c.AEAD.Open(nil, c.calcNonce(), ct, aad) - if err != nil { - return nil, err - } - err = c.increment() - if err != nil { - for i := range pt { - pt[i] = 0 - } - return nil, err - } - return pt, nil -} diff --git a/backend/vendor/github.com/cloudflare/circl/hpke/algs.go b/backend/vendor/github.com/cloudflare/circl/hpke/algs.go deleted file mode 100644 index 6ae2465..0000000 --- a/backend/vendor/github.com/cloudflare/circl/hpke/algs.go +++ /dev/null @@ -1,287 +0,0 @@ -package hpke - -import ( - "crypto" - "crypto/aes" - "crypto/cipher" - "crypto/ecdh" - _ "crypto/sha256" // Linking sha256. - _ "crypto/sha512" // Linking sha512. - "fmt" - "hash" - "io" - - "github.com/cloudflare/circl/dh/x25519" - "github.com/cloudflare/circl/dh/x448" - "github.com/cloudflare/circl/kem" - "github.com/cloudflare/circl/kem/kyber/kyber768" - "github.com/cloudflare/circl/kem/xwing" - "golang.org/x/crypto/chacha20poly1305" - "golang.org/x/crypto/hkdf" -) - -type KEM uint16 - -//nolint:golint,stylecheck -const ( - // KEM_P256_HKDF_SHA256 is a KEM using P256 curve and HKDF with SHA-256. - KEM_P256_HKDF_SHA256 KEM = 0x10 - // KEM_P384_HKDF_SHA384 is a KEM using P384 curve and HKDF with SHA-384. - KEM_P384_HKDF_SHA384 KEM = 0x11 - // KEM_P521_HKDF_SHA512 is a KEM using P521 curve and HKDF with SHA-512. - KEM_P521_HKDF_SHA512 KEM = 0x12 - // KEM_X25519_HKDF_SHA256 is a KEM using X25519 Diffie-Hellman function - // and HKDF with SHA-256. - KEM_X25519_HKDF_SHA256 KEM = 0x20 - // KEM_X448_HKDF_SHA512 is a KEM using X448 Diffie-Hellman function and - // HKDF with SHA-512. - KEM_X448_HKDF_SHA512 KEM = 0x21 - // KEM_X25519_KYBER768_DRAFT00 is a hybrid KEM built on DHKEM(X25519, HKDF-SHA256) - // and Kyber768Draft00 - KEM_X25519_KYBER768_DRAFT00 KEM = 0x30 - // KEM_XWING is a hybrid KEM using X25519 and ML-KEM-768. - KEM_XWING KEM = 0x647a -) - -// IsValid returns true if the KEM identifier is supported by the HPKE package. -func (k KEM) IsValid() bool { - switch k { - case KEM_P256_HKDF_SHA256, - KEM_P384_HKDF_SHA384, - KEM_P521_HKDF_SHA512, - KEM_X25519_HKDF_SHA256, - KEM_X448_HKDF_SHA512, - KEM_X25519_KYBER768_DRAFT00, - KEM_XWING: - return true - default: - return false - } -} - -// Scheme returns an instance of a KEM that supports authentication. Panics if -// the KEM identifier is invalid. -func (k KEM) Scheme() kem.Scheme { - switch k { - case KEM_P256_HKDF_SHA256: - return dhkemp256hkdfsha256 - case KEM_P384_HKDF_SHA384: - return dhkemp384hkdfsha384 - case KEM_P521_HKDF_SHA512: - return dhkemp521hkdfsha512 - case KEM_X25519_HKDF_SHA256: - return dhkemx25519hkdfsha256 - case KEM_X448_HKDF_SHA512: - return dhkemx448hkdfsha512 - case KEM_X25519_KYBER768_DRAFT00: - return hybridkemX25519Kyber768 - case KEM_XWING: - return kemXwing - default: - panic(ErrInvalidKEM) - } -} - -type KDF uint16 - -//nolint:golint,stylecheck -const ( - // KDF_HKDF_SHA256 is a KDF using HKDF with SHA-256. - KDF_HKDF_SHA256 KDF = 0x01 - // KDF_HKDF_SHA384 is a KDF using HKDF with SHA-384. - KDF_HKDF_SHA384 KDF = 0x02 - // KDF_HKDF_SHA512 is a KDF using HKDF with SHA-512. - KDF_HKDF_SHA512 KDF = 0x03 -) - -func (k KDF) IsValid() bool { - switch k { - case KDF_HKDF_SHA256, - KDF_HKDF_SHA384, - KDF_HKDF_SHA512: - return true - default: - return false - } -} - -// ExtractSize returns the size (in bytes) of the pseudorandom key produced -// by KDF.Extract. -func (k KDF) ExtractSize() int { - switch k { - case KDF_HKDF_SHA256: - return crypto.SHA256.Size() - case KDF_HKDF_SHA384: - return crypto.SHA384.Size() - case KDF_HKDF_SHA512: - return crypto.SHA512.Size() - default: - panic(ErrInvalidKDF) - } -} - -// Extract derives a pseudorandom key from a high-entropy, secret input and a -// salt. The size of the output is determined by KDF.ExtractSize. -func (k KDF) Extract(secret, salt []byte) (pseudorandomKey []byte) { - return hkdf.Extract(k.hash(), secret, salt) -} - -// Expand derives a variable length pseudorandom string from a pseudorandom key -// and an information string. Panics if the pseudorandom key is less -// than N bytes, or if the output length is greater than 255*N bytes, -// where N is the size returned by KDF.Extract function. -func (k KDF) Expand(pseudorandomKey, info []byte, outputLen uint) []byte { - extractSize := k.ExtractSize() - if len(pseudorandomKey) < extractSize { - panic(fmt.Errorf("pseudorandom key must be %v bytes", extractSize)) - } - maxLength := uint(255 * extractSize) - if outputLen > maxLength { - panic(fmt.Errorf("output length must be less than %v bytes", maxLength)) - } - output := make([]byte, outputLen) - rd := hkdf.Expand(k.hash(), pseudorandomKey[:extractSize], info) - _, err := io.ReadFull(rd, output) - if err != nil { - panic(err) - } - return output -} - -func (k KDF) hash() func() hash.Hash { - switch k { - case KDF_HKDF_SHA256: - return crypto.SHA256.New - case KDF_HKDF_SHA384: - return crypto.SHA384.New - case KDF_HKDF_SHA512: - return crypto.SHA512.New - default: - panic(ErrInvalidKDF) - } -} - -type AEAD uint16 - -//nolint:golint,stylecheck -const ( - // AEAD_AES128GCM is AES-128 block cipher in Galois Counter Mode (GCM). - AEAD_AES128GCM AEAD = 0x01 - // AEAD_AES256GCM is AES-256 block cipher in Galois Counter Mode (GCM). - AEAD_AES256GCM AEAD = 0x02 - // AEAD_ChaCha20Poly1305 is ChaCha20 stream cipher and Poly1305 MAC. - AEAD_ChaCha20Poly1305 AEAD = 0x03 -) - -// New instantiates an AEAD cipher from the identifier, returns an error if the -// identifier is not known. -func (a AEAD) New(key []byte) (cipher.AEAD, error) { - switch a { - case AEAD_AES128GCM, AEAD_AES256GCM: - block, err := aes.NewCipher(key) - if err != nil { - return nil, err - } - return cipher.NewGCM(block) - case AEAD_ChaCha20Poly1305: - return chacha20poly1305.New(key) - default: - panic(ErrInvalidAEAD) - } -} - -func (a AEAD) IsValid() bool { - switch a { - case AEAD_AES128GCM, - AEAD_AES256GCM, - AEAD_ChaCha20Poly1305: - return true - default: - return false - } -} - -// KeySize returns the size in bytes of the keys used by the AEAD cipher. -func (a AEAD) KeySize() uint { - switch a { - case AEAD_AES128GCM: - return 16 - case AEAD_AES256GCM: - return 32 - case AEAD_ChaCha20Poly1305: - return chacha20poly1305.KeySize - default: - panic(ErrInvalidAEAD) - } -} - -// NonceSize returns the size in bytes of the nonce used by the AEAD cipher. -func (a AEAD) NonceSize() uint { - switch a { - case AEAD_AES128GCM, - AEAD_AES256GCM, - AEAD_ChaCha20Poly1305: - return 12 - default: - panic(ErrInvalidAEAD) - } -} - -// CipherLen returns the length of a ciphertext corresponding to a message of -// length mLen. -func (a AEAD) CipherLen(mLen uint) uint { - switch a { - case AEAD_AES128GCM, AEAD_AES256GCM, AEAD_ChaCha20Poly1305: - return mLen + 16 - default: - panic(ErrInvalidAEAD) - } -} - -var ( - dhkemp256hkdfsha256, dhkemp384hkdfsha384, dhkemp521hkdfsha512 shortKEM - dhkemx25519hkdfsha256, dhkemx448hkdfsha512 xKEM - hybridkemX25519Kyber768 hybridKEM - kemXwing genericNoAuthKEM -) - -func init() { - dhkemp256hkdfsha256.Curve = ecdh.P256() - dhkemp256hkdfsha256.dhKemBase.id = KEM_P256_HKDF_SHA256 - dhkemp256hkdfsha256.dhKemBase.name = "HPKE_KEM_P256_HKDF_SHA256" - dhkemp256hkdfsha256.dhKemBase.Hash = crypto.SHA256 - dhkemp256hkdfsha256.dhKemBase.dhKEM = dhkemp256hkdfsha256 - - dhkemp384hkdfsha384.Curve = ecdh.P384() - dhkemp384hkdfsha384.dhKemBase.id = KEM_P384_HKDF_SHA384 - dhkemp384hkdfsha384.dhKemBase.name = "HPKE_KEM_P384_HKDF_SHA384" - dhkemp384hkdfsha384.dhKemBase.Hash = crypto.SHA384 - dhkemp384hkdfsha384.dhKemBase.dhKEM = dhkemp384hkdfsha384 - - dhkemp521hkdfsha512.Curve = ecdh.P521() - dhkemp521hkdfsha512.dhKemBase.id = KEM_P521_HKDF_SHA512 - dhkemp521hkdfsha512.dhKemBase.name = "HPKE_KEM_P521_HKDF_SHA512" - dhkemp521hkdfsha512.dhKemBase.Hash = crypto.SHA512 - dhkemp521hkdfsha512.dhKemBase.dhKEM = dhkemp521hkdfsha512 - - dhkemx25519hkdfsha256.size = x25519.Size - dhkemx25519hkdfsha256.dhKemBase.id = KEM_X25519_HKDF_SHA256 - dhkemx25519hkdfsha256.dhKemBase.name = "HPKE_KEM_X25519_HKDF_SHA256" - dhkemx25519hkdfsha256.dhKemBase.Hash = crypto.SHA256 - dhkemx25519hkdfsha256.dhKemBase.dhKEM = dhkemx25519hkdfsha256 - - dhkemx448hkdfsha512.size = x448.Size - dhkemx448hkdfsha512.dhKemBase.id = KEM_X448_HKDF_SHA512 - dhkemx448hkdfsha512.dhKemBase.name = "HPKE_KEM_X448_HKDF_SHA512" - dhkemx448hkdfsha512.dhKemBase.Hash = crypto.SHA512 - dhkemx448hkdfsha512.dhKemBase.dhKEM = dhkemx448hkdfsha512 - - hybridkemX25519Kyber768.kemBase.id = KEM_X25519_KYBER768_DRAFT00 - hybridkemX25519Kyber768.kemBase.name = "HPKE_KEM_X25519_KYBER768_HKDF_SHA256" - hybridkemX25519Kyber768.kemBase.Hash = crypto.SHA256 - hybridkemX25519Kyber768.kemA = dhkemx25519hkdfsha256 - hybridkemX25519Kyber768.kemB = kyber768.Scheme() - - kemXwing.Scheme = xwing.Scheme() - kemXwing.name = "HPKE_KEM_XWING" -} diff --git a/backend/vendor/github.com/cloudflare/circl/hpke/genericnoauthkem.go b/backend/vendor/github.com/cloudflare/circl/hpke/genericnoauthkem.go deleted file mode 100644 index 88e1235..0000000 --- a/backend/vendor/github.com/cloudflare/circl/hpke/genericnoauthkem.go +++ /dev/null @@ -1,27 +0,0 @@ -package hpke - -// Shim to use generic KEM (kem.Scheme) as HPKE KEM. - -import ( - "github.com/cloudflare/circl/internal/sha3" - "github.com/cloudflare/circl/kem" -) - -// genericNoAuthKEM wraps a generic KEM (kem.Scheme) to be used as a HPKE KEM. -type genericNoAuthKEM struct { - kem.Scheme - name string -} - -func (h genericNoAuthKEM) Name() string { return h.name } - -// HPKE requires DeriveKeyPair() to take any seed larger than the private key -// size, whereas typical KEMs expect a specific seed size. We'll just use -// SHAKE256 to hash it to the right size as in X-Wing. -func (h genericNoAuthKEM) DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) { - seed2 := make([]byte, h.Scheme.SeedSize()) - hh := sha3.NewShake256() - _, _ = hh.Write(seed) - _, _ = hh.Read(seed2) - return h.Scheme.DeriveKeyPair(seed2) -} diff --git a/backend/vendor/github.com/cloudflare/circl/hpke/hpke.go b/backend/vendor/github.com/cloudflare/circl/hpke/hpke.go deleted file mode 100644 index ac70dc7..0000000 --- a/backend/vendor/github.com/cloudflare/circl/hpke/hpke.go +++ /dev/null @@ -1,283 +0,0 @@ -// Package hpke implements the Hybrid Public Key Encryption (HPKE) standard -// specified by draft-irtf-cfrg-hpke-07. -// -// HPKE works for any combination of a public-key encapsulation mechanism -// (KEM), a key derivation function (KDF), and an authenticated encryption -// scheme with additional data (AEAD). -// -// Specification in -// https://datatracker.ietf.org/doc/draft-irtf-cfrg-hpke -// -// BUG(cjpatton): This package does not implement the "Export-Only" mode of the -// HPKE context. In particular, it does not recognize the AEAD codepoint -// reserved for this purpose (0xFFFF). -package hpke - -import ( - "crypto/rand" - "encoding" - "errors" - "io" - - "github.com/cloudflare/circl/kem" -) - -const versionLabel = "HPKE-v1" - -// Context defines the capabilities of an HPKE context. -type Context interface { - encoding.BinaryMarshaler - // Export takes a context string exporterContext and a desired length (in - // bytes), and produces a secret derived from the internal exporter secret - // using the corresponding KDF Expand function. It panics if length is - // greater than 255*N bytes, where N is the size (in bytes) of the KDF's - // output. - Export(exporterContext []byte, length uint) []byte - // Suite returns the cipher suite corresponding to this context. - Suite() Suite -} - -// Sealer encrypts a plaintext using an AEAD encryption. -type Sealer interface { - Context - // Seal takes a plaintext and associated data to produce a ciphertext. - // The nonce is handled by the Sealer and incremented after each call. - Seal(pt, aad []byte) (ct []byte, err error) -} - -// Opener decrypts a ciphertext using an AEAD encryption. -type Opener interface { - Context - // Open takes a ciphertext and associated data to recover, if successful, - // the plaintext. The nonce is handled by the Opener and incremented after - // each call. - Open(ct, aad []byte) (pt []byte, err error) -} - -// modeID represents an HPKE variant. -type modeID = uint8 - -const ( - // modeBase to enable encryption to the holder of a given KEM private key. - modeBase modeID = 0x00 - // modePSK extends the base mode by allowing the Receiver to authenticate - // that the sender possessed a given pre-shared key (PSK). - modePSK modeID = 0x01 - // modeAuth extends the base mode by allowing the Receiver to authenticate - // that the sender possessed a given KEM private key. - modeAuth modeID = 0x02 - // modeAuthPSK provides a combination of the PSK and Auth modes. - modeAuthPSK modeID = 0x03 -) - -// Suite is an HPKE cipher suite consisting of a KEM, KDF, and AEAD algorithm. -type Suite struct { - kemID KEM - kdfID KDF - aeadID AEAD -} - -// NewSuite builds a Suite from a specified set of algorithms. Panics -// if an algorithm identifier is not valid. -func NewSuite(kemID KEM, kdfID KDF, aeadID AEAD) Suite { - s := Suite{kemID, kdfID, aeadID} - if !s.isValid() { - panic(ErrInvalidHPKESuite) - } - return s -} - -type state struct { - Suite - modeID modeID - skS kem.PrivateKey - pkS kem.PublicKey - psk []byte - pskID []byte - info []byte -} - -// Sender performs hybrid public-key encryption. -type Sender struct { - state - pkR kem.PublicKey -} - -// NewSender creates a Sender with knowledge of the receiver's public-key. -func (suite Suite) NewSender(pkR kem.PublicKey, info []byte) (*Sender, error) { - return &Sender{ - state: state{Suite: suite, info: info}, - pkR: pkR, - }, nil -} - -// Setup generates a new HPKE context used for Base Mode encryption. -// Returns the Sealer and corresponding encapsulated key. -func (s *Sender) Setup(rnd io.Reader) (enc []byte, seal Sealer, err error) { - s.modeID = modeBase - return s.allSetup(rnd) -} - -// SetupAuth generates a new HPKE context used for Auth Mode encryption. -// Returns the Sealer and corresponding encapsulated key. -func (s *Sender) SetupAuth(rnd io.Reader, skS kem.PrivateKey) ( - enc []byte, seal Sealer, err error, -) { - s.modeID = modeAuth - s.state.skS = skS - return s.allSetup(rnd) -} - -// SetupPSK generates a new HPKE context used for PSK Mode encryption. -// Returns the Sealer and corresponding encapsulated key. -func (s *Sender) SetupPSK(rnd io.Reader, psk, pskID []byte) ( - enc []byte, seal Sealer, err error, -) { - s.modeID = modePSK - s.state.psk = psk - s.state.pskID = pskID - return s.allSetup(rnd) -} - -// SetupAuthPSK generates a new HPKE context used for Auth-PSK Mode encryption. -// Returns the Sealer and corresponding encapsulated key. -func (s *Sender) SetupAuthPSK(rnd io.Reader, skS kem.PrivateKey, psk, pskID []byte) ( - enc []byte, seal Sealer, err error, -) { - s.modeID = modeAuthPSK - s.state.skS = skS - s.state.psk = psk - s.state.pskID = pskID - return s.allSetup(rnd) -} - -// Receiver performs hybrid public-key decryption. -type Receiver struct { - state - skR kem.PrivateKey - enc []byte -} - -// NewReceiver creates a Receiver with knowledge of a private key. -func (suite Suite) NewReceiver(skR kem.PrivateKey, info []byte) ( - *Receiver, error, -) { - return &Receiver{state: state{Suite: suite, info: info}, skR: skR}, nil -} - -// Setup generates a new HPKE context used for Base Mode encryption. -// Setup takes an encapsulated key and returns an Opener. -func (r *Receiver) Setup(enc []byte) (Opener, error) { - r.modeID = modeBase - r.enc = enc - return r.allSetup() -} - -// SetupAuth generates a new HPKE context used for Auth Mode encryption. -// SetupAuth takes an encapsulated key and a public key, and returns an Opener. -func (r *Receiver) SetupAuth(enc []byte, pkS kem.PublicKey) (Opener, error) { - r.modeID = modeAuth - r.enc = enc - r.state.pkS = pkS - return r.allSetup() -} - -// SetupPSK generates a new HPKE context used for PSK Mode encryption. -// SetupPSK takes an encapsulated key, and a pre-shared key; and returns an -// Opener. -func (r *Receiver) SetupPSK(enc, psk, pskID []byte) (Opener, error) { - r.modeID = modePSK - r.enc = enc - r.state.psk = psk - r.state.pskID = pskID - return r.allSetup() -} - -// SetupAuthPSK generates a new HPKE context used for Auth-PSK Mode encryption. -// SetupAuthPSK takes an encapsulated key, a public key, and a pre-shared key; -// and returns an Opener. -func (r *Receiver) SetupAuthPSK( - enc, psk, pskID []byte, pkS kem.PublicKey, -) (Opener, error) { - r.modeID = modeAuthPSK - r.enc = enc - r.state.psk = psk - r.state.pskID = pskID - r.state.pkS = pkS - return r.allSetup() -} - -func (s *Sender) allSetup(rnd io.Reader) ([]byte, Sealer, error) { - scheme := s.kemID.Scheme() - - if rnd == nil { - rnd = rand.Reader - } - seed := make([]byte, scheme.EncapsulationSeedSize()) - _, err := io.ReadFull(rnd, seed) - if err != nil { - return nil, nil, err - } - - var enc, ss []byte - switch s.modeID { - case modeBase, modePSK: - enc, ss, err = scheme.EncapsulateDeterministically(s.pkR, seed) - case modeAuth, modeAuthPSK: - authScheme, ok := scheme.(kem.AuthScheme) - if !ok { - return nil, nil, ErrInvalidAuthKEM - } - - enc, ss, err = authScheme.AuthEncapsulateDeterministically(s.pkR, s.skS, seed) - } - if err != nil { - return nil, nil, err - } - - ctx, err := s.keySchedule(ss, s.info, s.psk, s.pskID) - if err != nil { - return nil, nil, err - } - - return enc, &sealContext{ctx}, nil -} - -func (r *Receiver) allSetup() (Opener, error) { - var err error - var ss []byte - scheme := r.kemID.Scheme() - switch r.modeID { - case modeBase, modePSK: - ss, err = scheme.Decapsulate(r.skR, r.enc) - case modeAuth, modeAuthPSK: - authScheme, ok := scheme.(kem.AuthScheme) - if !ok { - return nil, ErrInvalidAuthKEM - } - - ss, err = authScheme.AuthDecapsulate(r.skR, r.enc, r.pkS) - } - if err != nil { - return nil, err - } - - ctx, err := r.keySchedule(ss, r.info, r.psk, r.pskID) - if err != nil { - return nil, err - } - return &openContext{ctx}, nil -} - -var ( - ErrInvalidHPKESuite = errors.New("hpke: invalid HPKE suite") - ErrInvalidKDF = errors.New("hpke: invalid KDF identifier") - ErrInvalidKEM = errors.New("hpke: invalid KEM identifier") - ErrInvalidAuthKEM = errors.New("hpke: KEM does not support Auth mode") - ErrInvalidAEAD = errors.New("hpke: invalid AEAD identifier") - ErrInvalidKEMPublicKey = errors.New("hpke: invalid KEM public key") - ErrInvalidKEMPrivateKey = errors.New("hpke: invalid KEM private key") - ErrInvalidKEMSharedSecret = errors.New("hpke: invalid KEM shared secret") - ErrInvalidKEMDeriveKey = errors.New("hpke: too many tries to derive KEM key") - ErrAEADSeqOverflows = errors.New("hpke: AEAD sequence number overflows") -) diff --git a/backend/vendor/github.com/cloudflare/circl/hpke/hybridkem.go b/backend/vendor/github.com/cloudflare/circl/hpke/hybridkem.go deleted file mode 100644 index 74e1ea6..0000000 --- a/backend/vendor/github.com/cloudflare/circl/hpke/hybridkem.go +++ /dev/null @@ -1,232 +0,0 @@ -package hpke - -// This file implements a hybrid KEM for HPKE using a simple concatenation -// combiner. -// -// WARNING It is not safe to combine arbitrary KEMs using this combiner. -// See the draft specification for more details: -// https://bwesterb.github.io/draft-westerbaan-cfrg-hpke-xyber768d00/draft-westerbaan-cfrg-hpke-xyber768d00.html#name-security-considerations - -import ( - "crypto/rand" - - "github.com/cloudflare/circl/kem" -) - -type hybridKEM struct { - kemBase - kemA kem.Scheme - kemB kem.Scheme -} - -func (h hybridKEM) PrivateKeySize() int { return h.kemA.PrivateKeySize() + h.kemB.PrivateKeySize() } -func (h hybridKEM) SeedSize() int { return 32 } -func (h hybridKEM) CiphertextSize() int { return h.kemA.CiphertextSize() + h.kemB.CiphertextSize() } -func (h hybridKEM) PublicKeySize() int { return h.kemA.PublicKeySize() + h.kemB.PublicKeySize() } -func (h hybridKEM) EncapsulationSeedSize() int { - return h.kemA.EncapsulationSeedSize() + h.kemB.EncapsulationSeedSize() -} -func (h hybridKEM) SharedKeySize() int { return h.kemA.SharedKeySize() + h.kemB.SharedKeySize() } -func (h hybridKEM) Name() string { return h.name } - -func (h hybridKEM) AuthDecapsulate(skR kem.PrivateKey, - ct []byte, - pkS kem.PublicKey, -) ([]byte, error) { - panic("AuthDecapsulate is not supported for this KEM") -} - -func (h hybridKEM) AuthEncapsulate(pkr kem.PublicKey, sks kem.PrivateKey) ( - ct []byte, ss []byte, err error, -) { - panic("AuthEncapsulate is not supported for this KEM") -} - -func (h hybridKEM) AuthEncapsulateDeterministically(pkr kem.PublicKey, sks kem.PrivateKey, seed []byte) (ct, ss []byte, err error) { - panic("AuthEncapsulateDeterministically is not supported for this KEM") -} - -func (h hybridKEM) Encapsulate(pkr kem.PublicKey) ( - ct []byte, ss []byte, err error, -) { - panic("Encapsulate is not implemented") -} - -func (h hybridKEM) Decapsulate(skr kem.PrivateKey, ct []byte) ([]byte, error) { - hybridSk := skr.(*hybridKEMPrivKey) - ssA, err := h.kemA.Decapsulate(hybridSk.privA, ct[0:h.kemA.CiphertextSize()]) - if err != nil { - return nil, err - } - ssB, err := h.kemB.Decapsulate(hybridSk.privB, ct[h.kemA.CiphertextSize():]) - if err != nil { - return nil, err - } - - ss := append(ssA, ssB...) - - return ss, nil -} - -func (h hybridKEM) EncapsulateDeterministically( - pkr kem.PublicKey, seed []byte, -) (ct, ss []byte, err error) { - hybridPk := pkr.(*hybridKEMPubKey) - encA, ssA, err := h.kemA.EncapsulateDeterministically(hybridPk.pubA, seed[0:h.kemA.EncapsulationSeedSize()]) - if err != nil { - return nil, nil, err - } - encB, ssB, err := h.kemB.EncapsulateDeterministically(hybridPk.pubB, seed[h.kemA.EncapsulationSeedSize():]) - if err != nil { - return nil, nil, err - } - - ct = append(encA, encB...) - ss = append(ssA, ssB...) - - return ct, ss, nil -} - -type hybridKEMPrivKey struct { - scheme kem.Scheme - privA kem.PrivateKey - privB kem.PrivateKey -} - -func (k *hybridKEMPrivKey) Scheme() kem.Scheme { - return k.scheme -} - -func (k *hybridKEMPrivKey) MarshalBinary() ([]byte, error) { - skA, err := k.privA.MarshalBinary() - if err != nil { - return nil, err - } - skB, err := k.privB.MarshalBinary() - if err != nil { - return nil, err - } - return append(skA, skB...), nil -} - -func (k *hybridKEMPrivKey) Equal(sk kem.PrivateKey) bool { - k1, ok := sk.(*hybridKEMPrivKey) - return ok && - k.privA.Equal(k1.privA) && - k.privB.Equal(k1.privB) -} - -func (k *hybridKEMPrivKey) Public() kem.PublicKey { - return &hybridKEMPubKey{ - scheme: k.scheme, - pubA: k.privA.Public(), - pubB: k.privB.Public(), - } -} - -type hybridKEMPubKey struct { - scheme kem.Scheme - pubA kem.PublicKey - pubB kem.PublicKey -} - -func (k *hybridKEMPubKey) Scheme() kem.Scheme { - return k.scheme -} - -func (k hybridKEMPubKey) MarshalBinary() ([]byte, error) { - pkA, err := k.pubA.MarshalBinary() - if err != nil { - return nil, err - } - pkB, err := k.pubB.MarshalBinary() - if err != nil { - return nil, err - } - return append(pkA, pkB...), nil -} - -func (k *hybridKEMPubKey) Equal(pk kem.PublicKey) bool { - k1, ok := pk.(*hybridKEMPubKey) - return ok && - k.pubA.Equal(k1.pubA) && - k.pubB.Equal(k1.pubB) -} - -// Deterministically derives a keypair from a seed. If you're unsure, -// you're better off using GenerateKey(). -// -// Panics if seed is not of length SeedSize(). -func (h hybridKEM) DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) { - // Implementation based on - // https://www.ietf.org/archive/id/draft-irtf-cfrg-hpke-07.html#name-derivekeypair - if len(seed) != h.SeedSize() { - panic(kem.ErrSeedSize) - } - - outputSeedSize := h.kemA.SeedSize() + h.kemB.SeedSize() - dkpPrk := h.labeledExtract([]byte(""), []byte("dkp_prk"), seed) - bytes := h.labeledExpand( - dkpPrk, - []byte("sk"), - nil, - uint16(outputSeedSize), - ) - seedA := bytes[0:h.kemA.SeedSize()] - seedB := bytes[h.kemA.SeedSize():] - pubA, privA := h.kemA.DeriveKeyPair(seedA) - pubB, privB := h.kemB.DeriveKeyPair(seedB) - - privKey := &hybridKEMPrivKey{ - privA: privA, - privB: privB, - } - pubKey := &hybridKEMPubKey{ - pubA: pubA, - pubB: pubB, - } - - return pubKey, privKey -} - -func (h hybridKEM) GenerateKeyPair() (kem.PublicKey, kem.PrivateKey, error) { - seed := make([]byte, h.SeedSize()) - _, err := rand.Read(seed) - if err != nil { - return nil, nil, err - } - pk, sk := h.DeriveKeyPair(seed) - return pk, sk, nil -} - -func (h hybridKEM) UnmarshalBinaryPrivateKey(data []byte) (kem.PrivateKey, error) { - skA, err := h.kemA.UnmarshalBinaryPrivateKey(data[0:h.kemA.PrivateKeySize()]) - if err != nil { - return nil, err - } - skB, err := h.kemB.UnmarshalBinaryPrivateKey(data[h.kemA.PrivateKeySize():]) - if err != nil { - return nil, err - } - - return &hybridKEMPrivKey{ - privA: skA, - privB: skB, - }, nil -} - -func (h hybridKEM) UnmarshalBinaryPublicKey(data []byte) (kem.PublicKey, error) { - pkA, err := h.kemA.UnmarshalBinaryPublicKey(data[0:h.kemA.PublicKeySize()]) - if err != nil { - return nil, err - } - pkB, err := h.kemB.UnmarshalBinaryPublicKey(data[h.kemA.PublicKeySize():]) - if err != nil { - return nil, err - } - - return &hybridKEMPubKey{ - pubA: pkA, - pubB: pkB, - }, nil -} diff --git a/backend/vendor/github.com/cloudflare/circl/hpke/kembase.go b/backend/vendor/github.com/cloudflare/circl/hpke/kembase.go deleted file mode 100644 index a15765f..0000000 --- a/backend/vendor/github.com/cloudflare/circl/hpke/kembase.go +++ /dev/null @@ -1,241 +0,0 @@ -package hpke - -import ( - "crypto" - "crypto/rand" - "encoding/binary" - "io" - - "github.com/cloudflare/circl/kem" - "golang.org/x/crypto/hkdf" -) - -type dhKEM interface { - sizeDH() int - calcDH(dh []byte, sk kem.PrivateKey, pk kem.PublicKey) error - SeedSize() int - DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) - UnmarshalBinaryPrivateKey(data []byte) (kem.PrivateKey, error) - UnmarshalBinaryPublicKey(data []byte) (kem.PublicKey, error) -} - -type kemBase struct { - id KEM - name string - crypto.Hash -} - -type dhKemBase struct { - kemBase - dhKEM -} - -func (k kemBase) Name() string { return k.name } -func (k kemBase) SharedKeySize() int { return k.Hash.Size() } - -func (k kemBase) getSuiteID() (sid [5]byte) { - sid[0], sid[1], sid[2] = 'K', 'E', 'M' - binary.BigEndian.PutUint16(sid[3:5], uint16(k.id)) - return -} - -func (k kemBase) extractExpand(dh, kemCtx []byte) []byte { - eaePkr := k.labeledExtract([]byte(""), []byte("eae_prk"), dh) - return k.labeledExpand( - eaePkr, - []byte("shared_secret"), - kemCtx, - uint16(k.Size()), - ) -} - -func (k kemBase) labeledExtract(salt, label, info []byte) []byte { - suiteID := k.getSuiteID() - labeledIKM := append(append(append(append( - make([]byte, 0, len(versionLabel)+len(suiteID)+len(label)+len(info)), - versionLabel...), - suiteID[:]...), - label...), - info...) - return hkdf.Extract(k.New, labeledIKM, salt) -} - -func (k kemBase) labeledExpand(prk, label, info []byte, l uint16) []byte { - suiteID := k.getSuiteID() - labeledInfo := make( - []byte, - 2, - 2+len(versionLabel)+len(suiteID)+len(label)+len(info), - ) - binary.BigEndian.PutUint16(labeledInfo[0:2], l) - labeledInfo = append(append(append(append(labeledInfo, - versionLabel...), - suiteID[:]...), - label...), - info...) - b := make([]byte, l) - rd := hkdf.Expand(k.New, prk, labeledInfo) - if _, err := io.ReadFull(rd, b); err != nil { - panic(err) - } - return b -} - -func (k dhKemBase) AuthEncapsulate(pkr kem.PublicKey, sks kem.PrivateKey) ( - ct []byte, ss []byte, err error, -) { - seed := make([]byte, k.SeedSize()) - _, err = io.ReadFull(rand.Reader, seed) - if err != nil { - return nil, nil, err - } - - return k.authEncap(pkr, sks, seed) -} - -func (k dhKemBase) Encapsulate(pkr kem.PublicKey) ( - ct []byte, ss []byte, err error, -) { - seed := make([]byte, k.SeedSize()) - _, err = io.ReadFull(rand.Reader, seed) - if err != nil { - return nil, nil, err - } - - return k.encap(pkr, seed) -} - -func (k dhKemBase) AuthEncapsulateDeterministically( - pkr kem.PublicKey, sks kem.PrivateKey, seed []byte, -) (ct, ss []byte, err error) { - return k.authEncap(pkr, sks, seed) -} - -func (k dhKemBase) EncapsulateDeterministically( - pkr kem.PublicKey, seed []byte, -) (ct, ss []byte, err error) { - return k.encap(pkr, seed) -} - -func (k dhKemBase) encap( - pkR kem.PublicKey, - seed []byte, -) (ct []byte, ss []byte, err error) { - dh := make([]byte, k.sizeDH()) - enc, kemCtx, err := k.coreEncap(dh, pkR, seed) - if err != nil { - return nil, nil, err - } - ss = k.extractExpand(dh, kemCtx) - return enc, ss, nil -} - -func (k dhKemBase) authEncap( - pkR kem.PublicKey, - skS kem.PrivateKey, - seed []byte, -) (ct []byte, ss []byte, err error) { - dhLen := k.sizeDH() - dh := make([]byte, 2*dhLen) - enc, kemCtx, err := k.coreEncap(dh[:dhLen], pkR, seed) - if err != nil { - return nil, nil, err - } - - err = k.calcDH(dh[dhLen:], skS, pkR) - if err != nil { - return nil, nil, err - } - - pkS := skS.Public() - pkSm, err := pkS.MarshalBinary() - if err != nil { - return nil, nil, err - } - kemCtx = append(kemCtx, pkSm...) - - ss = k.extractExpand(dh, kemCtx) - return enc, ss, nil -} - -func (k dhKemBase) coreEncap( - dh []byte, - pkR kem.PublicKey, - seed []byte, -) (enc []byte, kemCtx []byte, err error) { - pkE, skE := k.DeriveKeyPair(seed) - err = k.calcDH(dh, skE, pkR) - if err != nil { - return nil, nil, err - } - - enc, err = pkE.MarshalBinary() - if err != nil { - return nil, nil, err - } - pkRm, err := pkR.MarshalBinary() - if err != nil { - return nil, nil, err - } - kemCtx = append(append([]byte{}, enc...), pkRm...) - - return enc, kemCtx, nil -} - -func (k dhKemBase) Decapsulate(skr kem.PrivateKey, ct []byte) ([]byte, error) { - dh := make([]byte, k.sizeDH()) - kemCtx, err := k.coreDecap(dh, skr, ct) - if err != nil { - return nil, err - } - return k.extractExpand(dh, kemCtx), nil -} - -func (k dhKemBase) AuthDecapsulate( - skR kem.PrivateKey, - ct []byte, - pkS kem.PublicKey, -) ([]byte, error) { - dhLen := k.sizeDH() - dh := make([]byte, 2*dhLen) - kemCtx, err := k.coreDecap(dh[:dhLen], skR, ct) - if err != nil { - return nil, err - } - - err = k.calcDH(dh[dhLen:], skR, pkS) - if err != nil { - return nil, err - } - - pkSm, err := pkS.MarshalBinary() - if err != nil { - return nil, err - } - kemCtx = append(kemCtx, pkSm...) - return k.extractExpand(dh, kemCtx), nil -} - -func (k dhKemBase) coreDecap( - dh []byte, - skR kem.PrivateKey, - ct []byte, -) ([]byte, error) { - pkE, err := k.UnmarshalBinaryPublicKey(ct) - if err != nil { - return nil, err - } - - err = k.calcDH(dh, skR, pkE) - if err != nil { - return nil, err - } - - pkR := skR.Public() - pkRm, err := pkR.MarshalBinary() - if err != nil { - return nil, err - } - - return append(append([]byte{}, ct...), pkRm...), nil -} diff --git a/backend/vendor/github.com/cloudflare/circl/hpke/marshal.go b/backend/vendor/github.com/cloudflare/circl/hpke/marshal.go deleted file mode 100644 index 4ce02ee..0000000 --- a/backend/vendor/github.com/cloudflare/circl/hpke/marshal.go +++ /dev/null @@ -1,151 +0,0 @@ -package hpke - -import ( - "errors" - - "golang.org/x/crypto/cryptobyte" -) - -// marshal serializes an HPKE context. -func (c *encdecContext) marshal() ([]byte, error) { - var b cryptobyte.Builder - b.AddUint16(uint16(c.suite.kemID)) - b.AddUint16(uint16(c.suite.kdfID)) - b.AddUint16(uint16(c.suite.aeadID)) - b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { - b.AddBytes(c.exporterSecret) - }) - b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { - b.AddBytes(c.key) - }) - b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { - b.AddBytes(c.baseNonce) - }) - b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) { - b.AddBytes(c.sequenceNumber) - }) - return b.Bytes() -} - -// unmarshalContext parses an HPKE context. -func unmarshalContext(raw []byte) (*encdecContext, error) { - var ( - err error - t cryptobyte.String - ) - - c := new(encdecContext) - s := cryptobyte.String(raw) - if !s.ReadUint16((*uint16)(&c.suite.kemID)) || - !s.ReadUint16((*uint16)(&c.suite.kdfID)) || - !s.ReadUint16((*uint16)(&c.suite.aeadID)) || - !s.ReadUint8LengthPrefixed(&t) || - !t.ReadBytes(&c.exporterSecret, len(t)) || - !s.ReadUint8LengthPrefixed(&t) || - !t.ReadBytes(&c.key, len(t)) || - !s.ReadUint8LengthPrefixed(&t) || - !t.ReadBytes(&c.baseNonce, len(t)) || - !s.ReadUint8LengthPrefixed(&t) || - !t.ReadBytes(&c.sequenceNumber, len(t)) { - return nil, errors.New("failed to parse context") - } - - if !c.suite.isValid() { - return nil, ErrInvalidHPKESuite - } - - Nh := c.suite.kdfID.ExtractSize() - if len(c.exporterSecret) != Nh { - return nil, errors.New("invalid exporter secret length") - } - - Nk := int(c.suite.aeadID.KeySize()) - if len(c.key) != Nk { - return nil, errors.New("invalid key length") - } - - c.AEAD, err = c.suite.aeadID.New(c.key) - if err != nil { - return nil, err - } - - Nn := int(c.suite.aeadID.NonceSize()) - if len(c.baseNonce) != Nn { - return nil, errors.New("invalid base nonce length") - } - if len(c.sequenceNumber) != Nn { - return nil, errors.New("invalid sequence number length") - } - c.nonce = make([]byte, Nn) - - return c, nil -} - -// MarshalBinary serializes an HPKE sealer according to the format specified -// below. (Expressed in TLS syntax.) Note that this format is not defined by -// the HPKE standard. -// -// enum { sealer(0), opener(1) } HpkeRole; -// -// struct { -// HpkeKemId kem_id; // draft-irtf-cfrg-hpke-07 -// HpkeKdfId kdf_id; // draft-irtf-cfrg-hpke-07 -// HpkeAeadId aead_id; // draft-irtf-cfrg-hpke-07 -// opaque exporter_secret<0..255>; -// opaque key<0..255>; -// opaque base_nonce<0..255>; -// opaque seq<0..255>; -// } HpkeContext; -// -// struct { -// HpkeRole role = 0; // sealer -// HpkeContext context; -// } HpkeSealer; -func (c *sealContext) MarshalBinary() ([]byte, error) { - rawContext, err := c.encdecContext.marshal() - if err != nil { - return nil, err - } - return append([]byte{0}, rawContext...), nil -} - -// UnmarshalSealer parses an HPKE sealer. -func UnmarshalSealer(raw []byte) (Sealer, error) { - if raw[0] != 0 { - return nil, errors.New("incorrect role") - } - context, err := unmarshalContext(raw[1:]) - if err != nil { - return nil, err - } - return &sealContext{context}, nil -} - -// MarshalBinary serializes an HPKE opener according to the format specified -// below. (Expressed in TLS syntax.) Note that this format is not defined by the -// HPKE standard. -// -// struct { -// HpkeRole role = 1; // opener -// HpkeContext context; -// } HpkeOpener; -func (c *openContext) MarshalBinary() ([]byte, error) { - rawContext, err := c.encdecContext.marshal() - if err != nil { - return nil, err - } - return append([]byte{1}, rawContext...), nil -} - -// UnmarshalOpener parses a serialized HPKE opener and returns the corresponding -// Opener. -func UnmarshalOpener(raw []byte) (Opener, error) { - if raw[0] != 1 { - return nil, errors.New("incorrect role") - } - context, err := unmarshalContext(raw[1:]) - if err != nil { - return nil, err - } - return &openContext{context}, nil -} diff --git a/backend/vendor/github.com/cloudflare/circl/hpke/shortkem.go b/backend/vendor/github.com/cloudflare/circl/hpke/shortkem.go deleted file mode 100644 index 2a0787e..0000000 --- a/backend/vendor/github.com/cloudflare/circl/hpke/shortkem.go +++ /dev/null @@ -1,151 +0,0 @@ -package hpke - -import ( - "crypto/ecdh" - "crypto/rand" - "fmt" - - "github.com/cloudflare/circl/kem" -) - -type shortKEM struct { - dhKemBase - ecdh.Curve -} - -func (s shortKEM) PrivateKeySize() int { return s.byteSize() } -func (s shortKEM) SeedSize() int { return s.byteSize() } -func (s shortKEM) CiphertextSize() int { return 1 + 2*s.byteSize() } -func (s shortKEM) PublicKeySize() int { return 1 + 2*s.byteSize() } -func (s shortKEM) EncapsulationSeedSize() int { return s.byteSize() } - -func (s shortKEM) byteSize() int { - var bits int - switch s.Curve { - case ecdh.P256(): - bits = 256 - case ecdh.P384(): - bits = 384 - case ecdh.P521(): - bits = 521 - default: - panic(ErrInvalidKEM) - } - - return (bits + 7) / 8 -} - -func (s shortKEM) sizeDH() int { return s.byteSize() } -func (s shortKEM) calcDH(dh []byte, sk kem.PrivateKey, pk kem.PublicKey) error { - PK, ok := pk.(*shortKEMPubKey) - if !ok { - return ErrInvalidKEMPublicKey - } - - SK, ok := sk.(*shortKEMPrivKey) - if !ok { - return ErrInvalidKEMPrivateKey - } - - x, err := SK.priv.ECDH(&PK.pub) - if err != nil { - return err - } - - copy(dh, x) - return nil -} - -// Deterministically derives a keypair from a seed. If you're unsure, -// you're better off using GenerateKey(). -// -// Panics if seed is not of length SeedSize(). -func (s shortKEM) DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) { - // Implementation based on - // https://www.ietf.org/archive/id/draft-irtf-cfrg-hpke-07.html#name-derivekeypair - if len(seed) != s.SeedSize() { - panic(kem.ErrSeedSize) - } - - bitmask := byte(0xFF) - if s.Curve == ecdh.P521() { - bitmask = 0x01 - } - - dkpPrk := s.labeledExtract([]byte(""), []byte("dkp_prk"), seed) - for ctr := 0; ctr <= 255; ctr++ { - bytes := s.labeledExpand( - dkpPrk, - []byte("candidate"), - []byte{byte(ctr)}, - uint16(s.byteSize()), - ) - bytes[0] &= bitmask - sk, err := s.UnmarshalBinaryPrivateKey(bytes) - if err == nil { - return sk.Public(), sk - } - } - - panic(ErrInvalidKEMDeriveKey) -} - -func (s shortKEM) GenerateKeyPair() (kem.PublicKey, kem.PrivateKey, error) { - key, err := s.Curve.GenerateKey(rand.Reader) - if err != nil { - return nil, nil, err - } - - sk := &shortKEMPrivKey{s, key} - return sk.Public(), sk, err -} - -func (s shortKEM) UnmarshalBinaryPrivateKey(data []byte) (kem.PrivateKey, error) { - key, err := s.Curve.NewPrivateKey(data) - if err != nil { - return nil, err - } - - return &shortKEMPrivKey{s, key}, nil -} - -func (s shortKEM) UnmarshalBinaryPublicKey(data []byte) (kem.PublicKey, error) { - key, err := s.Curve.NewPublicKey(data) - if err != nil { - return nil, err - } - - return &shortKEMPubKey{s, *key}, nil -} - -type shortKEMPubKey struct { - scheme shortKEM - pub ecdh.PublicKey -} - -func (k *shortKEMPubKey) String() string { return fmt.Sprintf("%x", k.pub.Bytes()) } -func (k *shortKEMPubKey) Scheme() kem.Scheme { return k.scheme } -func (k *shortKEMPubKey) MarshalBinary() ([]byte, error) { return k.pub.Bytes(), nil } - -func (k *shortKEMPubKey) Equal(pk kem.PublicKey) bool { - k1, ok := pk.(*shortKEMPubKey) - return ok && k.scheme == k1.scheme && k.pub.Equal(&k1.pub) -} - -type shortKEMPrivKey struct { - scheme shortKEM - priv *ecdh.PrivateKey -} - -func (k *shortKEMPrivKey) String() string { return fmt.Sprintf("%x", k.priv.Bytes()) } -func (k *shortKEMPrivKey) Scheme() kem.Scheme { return k.scheme } -func (k *shortKEMPrivKey) MarshalBinary() ([]byte, error) { return k.priv.Bytes(), nil } - -func (k *shortKEMPrivKey) Equal(pk kem.PrivateKey) bool { - k1, ok := pk.(*shortKEMPrivKey) - return ok && k.scheme == k1.scheme && k.priv.Equal(k1.priv) -} - -func (k *shortKEMPrivKey) Public() kem.PublicKey { - return &shortKEMPubKey{k.scheme, *k.priv.PublicKey()} -} diff --git a/backend/vendor/github.com/cloudflare/circl/hpke/util.go b/backend/vendor/github.com/cloudflare/circl/hpke/util.go deleted file mode 100644 index c9fed4f..0000000 --- a/backend/vendor/github.com/cloudflare/circl/hpke/util.go +++ /dev/null @@ -1,121 +0,0 @@ -package hpke - -import ( - "encoding/binary" - "errors" - "fmt" -) - -func (st state) keySchedule(ss, info, psk, pskID []byte) (*encdecContext, error) { - if err := st.verifyPSKInputs(psk, pskID); err != nil { - return nil, err - } - - pskIDHash := st.labeledExtract(nil, []byte("psk_id_hash"), pskID) - infoHash := st.labeledExtract(nil, []byte("info_hash"), info) - keySchCtx := append(append( - []byte{st.modeID}, - pskIDHash...), - infoHash...) - - secret := st.labeledExtract(ss, []byte("secret"), psk) - - Nk := uint16(st.aeadID.KeySize()) - key := st.labeledExpand(secret, []byte("key"), keySchCtx, Nk) - - aead, err := st.aeadID.New(key) - if err != nil { - return nil, err - } - - Nn := uint16(aead.NonceSize()) - baseNonce := st.labeledExpand(secret, []byte("base_nonce"), keySchCtx, Nn) - exporterSecret := st.labeledExpand( - secret, - []byte("exp"), - keySchCtx, - uint16(st.kdfID.ExtractSize()), - ) - - return &encdecContext{ - st.Suite, - ss, - secret, - keySchCtx, - exporterSecret, - key, - baseNonce, - make([]byte, Nn), - aead, - make([]byte, Nn), - }, nil -} - -func (st state) verifyPSKInputs(psk, pskID []byte) error { - gotPSK := psk != nil - gotPSKID := pskID != nil - if gotPSK != gotPSKID { - return errors.New("inconsistent PSK inputs") - } - switch st.modeID { - case modeBase | modeAuth: - if gotPSK { - return errors.New("PSK input provided when not needed") - } - case modePSK | modeAuthPSK: - if !gotPSK { - return errors.New("missing required PSK input") - } - } - return nil -} - -// Params returns the codepoints for the algorithms comprising the suite. -func (suite Suite) Params() (KEM, KDF, AEAD) { - return suite.kemID, suite.kdfID, suite.aeadID -} - -func (suite Suite) String() string { - return fmt.Sprintf( - "kem_id: %v kdf_id: %v aead_id: %v", - suite.kemID, suite.kdfID, suite.aeadID, - ) -} - -func (suite Suite) getSuiteID() (id [10]byte) { - id[0], id[1], id[2], id[3] = 'H', 'P', 'K', 'E' - binary.BigEndian.PutUint16(id[4:6], uint16(suite.kemID)) - binary.BigEndian.PutUint16(id[6:8], uint16(suite.kdfID)) - binary.BigEndian.PutUint16(id[8:10], uint16(suite.aeadID)) - return -} - -func (suite Suite) isValid() bool { - return suite.kemID.IsValid() && - suite.kdfID.IsValid() && - suite.aeadID.IsValid() -} - -func (suite Suite) labeledExtract(salt, label, ikm []byte) []byte { - suiteID := suite.getSuiteID() - labeledIKM := append(append(append(append( - make([]byte, 0, len(versionLabel)+len(suiteID)+len(label)+len(ikm)), - versionLabel...), - suiteID[:]...), - label...), - ikm...) - return suite.kdfID.Extract(labeledIKM, salt) -} - -func (suite Suite) labeledExpand(prk, label, info []byte, l uint16) []byte { - suiteID := suite.getSuiteID() - labeledInfo := make([]byte, - 2, 2+len(versionLabel)+len(suiteID)+len(label)+len(info)) - binary.BigEndian.PutUint16(labeledInfo[0:2], l) - labeledInfo = append(append(append(append(labeledInfo, - versionLabel...), - suiteID[:]...), - label...), - info...) - return suite.kdfID.Expand(prk, labeledInfo, uint(l)) -} diff --git a/backend/vendor/github.com/cloudflare/circl/hpke/xkem.go b/backend/vendor/github.com/cloudflare/circl/hpke/xkem.go deleted file mode 100644 index f11ab6b..0000000 --- a/backend/vendor/github.com/cloudflare/circl/hpke/xkem.go +++ /dev/null @@ -1,164 +0,0 @@ -package hpke - -import ( - "bytes" - "crypto/rand" - "crypto/subtle" - "fmt" - "io" - - "github.com/cloudflare/circl/dh/x25519" - "github.com/cloudflare/circl/dh/x448" - "github.com/cloudflare/circl/kem" -) - -type xKEM struct { - dhKemBase - size int -} - -func (x xKEM) PrivateKeySize() int { return x.size } -func (x xKEM) SeedSize() int { return x.size } -func (x xKEM) CiphertextSize() int { return x.size } -func (x xKEM) PublicKeySize() int { return x.size } -func (x xKEM) EncapsulationSeedSize() int { return x.size } - -func (x xKEM) sizeDH() int { return x.size } -func (x xKEM) calcDH(dh []byte, sk kem.PrivateKey, pk kem.PublicKey) error { - PK := pk.(*xKEMPubKey) - SK := sk.(*xKEMPrivKey) - switch x.size { - case x25519.Size: - var ss, sKey, pKey x25519.Key - copy(sKey[:], SK.priv) - copy(pKey[:], PK.pub) - if !x25519.Shared(&ss, &sKey, &pKey) { - return ErrInvalidKEMSharedSecret - } - copy(dh, ss[:]) - case x448.Size: - var ss, sKey, pKey x448.Key - copy(sKey[:], SK.priv) - copy(pKey[:], PK.pub) - if !x448.Shared(&ss, &sKey, &pKey) { - return ErrInvalidKEMSharedSecret - } - copy(dh, ss[:]) - } - return nil -} - -// Deterministically derives a keypair from a seed. If you're unsure, -// you're better off using GenerateKey(). -// -// Panics if seed is not of length SeedSize(). -func (x xKEM) DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) { - // Implementation based on - // https://www.ietf.org/archive/id/draft-irtf-cfrg-hpke-07.html#name-derivekeypair - if len(seed) != x.SeedSize() { - panic(kem.ErrSeedSize) - } - sk := &xKEMPrivKey{scheme: x, priv: make([]byte, x.size)} - dkpPrk := x.labeledExtract([]byte(""), []byte("dkp_prk"), seed) - bytes := x.labeledExpand( - dkpPrk, - []byte("sk"), - nil, - uint16(x.PrivateKeySize()), - ) - copy(sk.priv, bytes) - return sk.Public(), sk -} - -func (x xKEM) GenerateKeyPair() (kem.PublicKey, kem.PrivateKey, error) { - sk := &xKEMPrivKey{scheme: x, priv: make([]byte, x.PrivateKeySize())} - _, err := io.ReadFull(rand.Reader, sk.priv) - if err != nil { - return nil, nil, err - } - return sk.Public(), sk, nil -} - -func (x xKEM) UnmarshalBinaryPrivateKey(data []byte) (kem.PrivateKey, error) { - l := x.PrivateKeySize() - if len(data) < l { - return nil, ErrInvalidKEMPrivateKey - } - sk := &xKEMPrivKey{x, make([]byte, l), nil} - copy(sk.priv, data[:l]) - if !sk.validate() { - return nil, ErrInvalidKEMPrivateKey - } - return sk, nil -} - -func (x xKEM) UnmarshalBinaryPublicKey(data []byte) (kem.PublicKey, error) { - l := x.PublicKeySize() - if len(data) < l { - return nil, ErrInvalidKEMPublicKey - } - pk := &xKEMPubKey{x, make([]byte, l)} - copy(pk.pub, data[:l]) - if !pk.validate() { - return nil, ErrInvalidKEMPublicKey - } - return pk, nil -} - -type xKEMPubKey struct { - scheme xKEM - pub []byte -} - -func (k *xKEMPubKey) String() string { return fmt.Sprintf("%x", k.pub) } -func (k *xKEMPubKey) Scheme() kem.Scheme { return k.scheme } -func (k *xKEMPubKey) MarshalBinary() ([]byte, error) { - return append(make([]byte, 0, k.scheme.PublicKeySize()), k.pub...), nil -} - -func (k *xKEMPubKey) Equal(pk kem.PublicKey) bool { - k1, ok := pk.(*xKEMPubKey) - return ok && - k.scheme.id == k1.scheme.id && - bytes.Equal(k.pub, k1.pub) -} -func (k *xKEMPubKey) validate() bool { return len(k.pub) == k.scheme.PublicKeySize() } - -type xKEMPrivKey struct { - scheme xKEM - priv []byte - pub *xKEMPubKey -} - -func (k *xKEMPrivKey) String() string { return fmt.Sprintf("%x", k.priv) } -func (k *xKEMPrivKey) Scheme() kem.Scheme { return k.scheme } -func (k *xKEMPrivKey) MarshalBinary() ([]byte, error) { - return append(make([]byte, 0, k.scheme.PrivateKeySize()), k.priv...), nil -} - -func (k *xKEMPrivKey) Equal(pk kem.PrivateKey) bool { - k1, ok := pk.(*xKEMPrivKey) - return ok && - k.scheme.id == k1.scheme.id && - subtle.ConstantTimeCompare(k.priv, k1.priv) == 1 -} - -func (k *xKEMPrivKey) Public() kem.PublicKey { - if k.pub == nil { - k.pub = &xKEMPubKey{scheme: k.scheme, pub: make([]byte, k.scheme.size)} - switch k.scheme.size { - case x25519.Size: - var sk, pk x25519.Key - copy(sk[:], k.priv) - x25519.KeyGen(&pk, &sk) - copy(k.pub.pub, pk[:]) - case x448.Size: - var sk, pk x448.Key - copy(sk[:], k.priv) - x448.KeyGen(&pk, &sk) - copy(k.pub.pub, pk[:]) - } - } - return k.pub -} -func (k *xKEMPrivKey) validate() bool { return len(k.priv) == k.scheme.PrivateKeySize() } diff --git a/backend/vendor/github.com/cloudflare/circl/internal/conv/conv.go b/backend/vendor/github.com/cloudflare/circl/internal/conv/conv.go deleted file mode 100644 index 3fd0df4..0000000 --- a/backend/vendor/github.com/cloudflare/circl/internal/conv/conv.go +++ /dev/null @@ -1,173 +0,0 @@ -package conv - -import ( - "encoding/binary" - "fmt" - "math/big" - "strings" - - "golang.org/x/crypto/cryptobyte" -) - -// BytesLe2Hex returns an hexadecimal string of a number stored in a -// little-endian order slice x. -func BytesLe2Hex(x []byte) string { - b := &strings.Builder{} - b.Grow(2*len(x) + 2) - fmt.Fprint(b, "0x") - if len(x) == 0 { - fmt.Fprint(b, "00") - } - for i := len(x) - 1; i >= 0; i-- { - fmt.Fprintf(b, "%02x", x[i]) - } - return b.String() -} - -// BytesLe2BigInt converts a little-endian slice x into a big-endian -// math/big.Int. -func BytesLe2BigInt(x []byte) *big.Int { - n := len(x) - b := new(big.Int) - if len(x) > 0 { - y := make([]byte, n) - for i := 0; i < n; i++ { - y[n-1-i] = x[i] - } - b.SetBytes(y) - } - return b -} - -// BytesBe2Uint64Le converts a big-endian slice x to a little-endian slice of uint64. -func BytesBe2Uint64Le(x []byte) []uint64 { - l := len(x) - z := make([]uint64, (l+7)/8) - blocks := l / 8 - for i := 0; i < blocks; i++ { - z[i] = binary.BigEndian.Uint64(x[l-8*(i+1):]) - } - remBytes := l % 8 - for i := 0; i < remBytes; i++ { - z[blocks] |= uint64(x[l-1-8*blocks-i]) << uint(8*i) - } - return z -} - -// BigInt2BytesLe stores a positive big.Int number x into a little-endian slice z. -// The slice is modified if the bitlength of x <= 8*len(z) (padding with zeros). -// If x does not fit in the slice or is negative, z is not modified. -func BigInt2BytesLe(z []byte, x *big.Int) { - xLen := (x.BitLen() + 7) >> 3 - zLen := len(z) - if zLen >= xLen && x.Sign() >= 0 { - y := x.Bytes() - for i := 0; i < xLen; i++ { - z[i] = y[xLen-1-i] - } - for i := xLen; i < zLen; i++ { - z[i] = 0 - } - } -} - -// Uint64Le2BigInt converts a little-endian slice x into a big number. -func Uint64Le2BigInt(x []uint64) *big.Int { - n := len(x) - b := new(big.Int) - var bi big.Int - for i := n - 1; i >= 0; i-- { - bi.SetUint64(x[i]) - b.Lsh(b, 64) - b.Add(b, &bi) - } - return b -} - -// Uint64Le2BytesLe converts a little-endian slice x to a little-endian slice of bytes. -func Uint64Le2BytesLe(x []uint64) []byte { - b := make([]byte, 8*len(x)) - n := len(x) - for i := 0; i < n; i++ { - binary.LittleEndian.PutUint64(b[i*8:], x[i]) - } - return b -} - -// Uint64Le2BytesBe converts a little-endian slice x to a big-endian slice of bytes. -func Uint64Le2BytesBe(x []uint64) []byte { - b := make([]byte, 8*len(x)) - n := len(x) - for i := 0; i < n; i++ { - binary.BigEndian.PutUint64(b[i*8:], x[n-1-i]) - } - return b -} - -// Uint64Le2Hex returns an hexadecimal string of a number stored in a -// little-endian order slice x. -func Uint64Le2Hex(x []uint64) string { - b := new(strings.Builder) - b.Grow(16*len(x) + 2) - fmt.Fprint(b, "0x") - if len(x) == 0 { - fmt.Fprint(b, "00") - } - for i := len(x) - 1; i >= 0; i-- { - fmt.Fprintf(b, "%016x", x[i]) - } - return b.String() -} - -// BigInt2Uint64Le stores a positive big.Int number x into a little-endian slice z. -// The slice is modified if the bitlength of x <= 8*len(z) (padding with zeros). -// If x does not fit in the slice or is negative, z is not modified. -func BigInt2Uint64Le(z []uint64, x *big.Int) { - xLen := (x.BitLen() + 63) >> 6 // number of 64-bit words - zLen := len(z) - if zLen >= xLen && x.Sign() > 0 { - var y, yi big.Int - y.Set(x) - two64 := big.NewInt(1) - two64.Lsh(two64, 64).Sub(two64, big.NewInt(1)) - for i := 0; i < xLen; i++ { - yi.And(&y, two64) - z[i] = yi.Uint64() - y.Rsh(&y, 64) - } - } - for i := xLen; i < zLen; i++ { - z[i] = 0 - } -} - -// MarshalBinary encodes a value into a byte array in a format readable by UnmarshalBinary. -func MarshalBinary(v cryptobyte.MarshalingValue) ([]byte, error) { - const DefaultSize = 32 - b := cryptobyte.NewBuilder(make([]byte, 0, DefaultSize)) - b.AddValue(v) - return b.Bytes() -} - -// MarshalBinaryLen encodes a value into an array of n bytes in a format readable by UnmarshalBinary. -func MarshalBinaryLen(v cryptobyte.MarshalingValue, length uint) ([]byte, error) { - b := cryptobyte.NewFixedBuilder(make([]byte, 0, length)) - b.AddValue(v) - return b.Bytes() -} - -// A UnmarshalingValue decodes itself from a cryptobyte.String and advances the pointer. -// It reports whether the read was successful. -type UnmarshalingValue interface { - Unmarshal(*cryptobyte.String) bool -} - -// UnmarshalBinary recovers a value from a byte array. -// It returns an error if the read was unsuccessful. -func UnmarshalBinary(v UnmarshalingValue, data []byte) (err error) { - s := cryptobyte.String(data) - if data == nil || !v.Unmarshal(&s) || !s.Empty() { - err = fmt.Errorf("cannot read %T from input string", v) - } - return -} diff --git a/backend/vendor/github.com/cloudflare/circl/internal/sha3/doc.go b/backend/vendor/github.com/cloudflare/circl/internal/sha3/doc.go deleted file mode 100644 index 7e02309..0000000 --- a/backend/vendor/github.com/cloudflare/circl/internal/sha3/doc.go +++ /dev/null @@ -1,62 +0,0 @@ -// Copyright 2014 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -// Package sha3 implements the SHA-3 fixed-output-length hash functions and -// the SHAKE variable-output-length hash functions defined by FIPS-202. -// -// Both types of hash function use the "sponge" construction and the Keccak -// permutation. For a detailed specification see http://keccak.noekeon.org/ -// -// # Guidance -// -// If you aren't sure what function you need, use SHAKE256 with at least 64 -// bytes of output. The SHAKE instances are faster than the SHA3 instances; -// the latter have to allocate memory to conform to the hash.Hash interface. -// -// If you need a secret-key MAC (message authentication code), prepend the -// secret key to the input, hash with SHAKE256 and read at least 32 bytes of -// output. -// -// # Security strengths -// -// The SHA3-x (x equals 224, 256, 384, or 512) functions have a security -// strength against preimage attacks of x bits. Since they only produce "x" -// bits of output, their collision-resistance is only "x/2" bits. -// -// The SHAKE-256 and -128 functions have a generic security strength of 256 and -// 128 bits against all attacks, provided that at least 2x bits of their output -// is used. Requesting more than 64 or 32 bytes of output, respectively, does -// not increase the collision-resistance of the SHAKE functions. -// -// # The sponge construction -// -// A sponge builds a pseudo-random function from a public pseudo-random -// permutation, by applying the permutation to a state of "rate + capacity" -// bytes, but hiding "capacity" of the bytes. -// -// A sponge starts out with a zero state. To hash an input using a sponge, up -// to "rate" bytes of the input are XORed into the sponge's state. The sponge -// is then "full" and the permutation is applied to "empty" it. This process is -// repeated until all the input has been "absorbed". The input is then padded. -// The digest is "squeezed" from the sponge in the same way, except that output -// is copied out instead of input being XORed in. -// -// A sponge is parameterized by its generic security strength, which is equal -// to half its capacity; capacity + rate is equal to the permutation's width. -// Since the KeccakF-1600 permutation is 1600 bits (200 bytes) wide, this means -// that the security strength of a sponge instance is equal to (1600 - bitrate) / 2. -// -// # Recommendations -// -// The SHAKE functions are recommended for most new uses. They can produce -// output of arbitrary length. SHAKE256, with an output length of at least -// 64 bytes, provides 256-bit security against all attacks. The Keccak team -// recommends it for most applications upgrading from SHA2-512. (NIST chose a -// much stronger, but much slower, sponge instance for SHA3-512.) -// -// The SHA-3 functions are "drop-in" replacements for the SHA-2 functions. -// They produce output of the same length, with the same security strengths -// against all attacks. This means, in particular, that SHA3-256 only has -// 128-bit collision resistance, because its output length is 32 bytes. -package sha3 diff --git a/backend/vendor/github.com/cloudflare/circl/internal/sha3/hashes.go b/backend/vendor/github.com/cloudflare/circl/internal/sha3/hashes.go deleted file mode 100644 index 7d2365a..0000000 --- a/backend/vendor/github.com/cloudflare/circl/internal/sha3/hashes.go +++ /dev/null @@ -1,69 +0,0 @@ -// Copyright 2014 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package sha3 - -// This file provides functions for creating instances of the SHA-3 -// and SHAKE hash functions, as well as utility functions for hashing -// bytes. - -// New224 creates a new SHA3-224 hash. -// Its generic security strength is 224 bits against preimage attacks, -// and 112 bits against collision attacks. -func New224() State { - return State{rate: 144, outputLen: 28, dsbyte: 0x06} -} - -// New256 creates a new SHA3-256 hash. -// Its generic security strength is 256 bits against preimage attacks, -// and 128 bits against collision attacks. -func New256() State { - return State{rate: 136, outputLen: 32, dsbyte: 0x06} -} - -// New384 creates a new SHA3-384 hash. -// Its generic security strength is 384 bits against preimage attacks, -// and 192 bits against collision attacks. -func New384() State { - return State{rate: 104, outputLen: 48, dsbyte: 0x06} -} - -// New512 creates a new SHA3-512 hash. -// Its generic security strength is 512 bits against preimage attacks, -// and 256 bits against collision attacks. -func New512() State { - return State{rate: 72, outputLen: 64, dsbyte: 0x06} -} - -// Sum224 returns the SHA3-224 digest of the data. -func Sum224(data []byte) (digest [28]byte) { - h := New224() - _, _ = h.Write(data) - h.Sum(digest[:0]) - return -} - -// Sum256 returns the SHA3-256 digest of the data. -func Sum256(data []byte) (digest [32]byte) { - h := New256() - _, _ = h.Write(data) - h.Sum(digest[:0]) - return -} - -// Sum384 returns the SHA3-384 digest of the data. -func Sum384(data []byte) (digest [48]byte) { - h := New384() - _, _ = h.Write(data) - h.Sum(digest[:0]) - return -} - -// Sum512 returns the SHA3-512 digest of the data. -func Sum512(data []byte) (digest [64]byte) { - h := New512() - _, _ = h.Write(data) - h.Sum(digest[:0]) - return -} diff --git a/backend/vendor/github.com/cloudflare/circl/internal/sha3/keccakf.go b/backend/vendor/github.com/cloudflare/circl/internal/sha3/keccakf.go deleted file mode 100644 index 1755fd1..0000000 --- a/backend/vendor/github.com/cloudflare/circl/internal/sha3/keccakf.go +++ /dev/null @@ -1,391 +0,0 @@ -// Copyright 2014 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package sha3 - -// KeccakF1600 applies the Keccak permutation to a 1600b-wide -// state represented as a slice of 25 uint64s. -// If turbo is true, applies the 12-round variant instead of the -// regular 24-round variant. -// nolint:funlen -func KeccakF1600(a *[25]uint64, turbo bool) { - // Implementation translated from Keccak-inplace.c - // in the keccak reference code. - var t, bc0, bc1, bc2, bc3, bc4, d0, d1, d2, d3, d4 uint64 - - i := 0 - - if turbo { - i = 12 - } - - for ; i < 24; i += 4 { - // Combines the 5 steps in each round into 2 steps. - // Unrolls 4 rounds per loop and spreads some steps across rounds. - - // Round 1 - bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20] - bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21] - bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22] - bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23] - bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24] - d0 = bc4 ^ (bc1<<1 | bc1>>63) - d1 = bc0 ^ (bc2<<1 | bc2>>63) - d2 = bc1 ^ (bc3<<1 | bc3>>63) - d3 = bc2 ^ (bc4<<1 | bc4>>63) - d4 = bc3 ^ (bc0<<1 | bc0>>63) - - bc0 = a[0] ^ d0 - t = a[6] ^ d1 - bc1 = t<<44 | t>>(64-44) - t = a[12] ^ d2 - bc2 = t<<43 | t>>(64-43) - t = a[18] ^ d3 - bc3 = t<<21 | t>>(64-21) - t = a[24] ^ d4 - bc4 = t<<14 | t>>(64-14) - a[0] = bc0 ^ (bc2 &^ bc1) ^ RC[i] - a[6] = bc1 ^ (bc3 &^ bc2) - a[12] = bc2 ^ (bc4 &^ bc3) - a[18] = bc3 ^ (bc0 &^ bc4) - a[24] = bc4 ^ (bc1 &^ bc0) - - t = a[10] ^ d0 - bc2 = t<<3 | t>>(64-3) - t = a[16] ^ d1 - bc3 = t<<45 | t>>(64-45) - t = a[22] ^ d2 - bc4 = t<<61 | t>>(64-61) - t = a[3] ^ d3 - bc0 = t<<28 | t>>(64-28) - t = a[9] ^ d4 - bc1 = t<<20 | t>>(64-20) - a[10] = bc0 ^ (bc2 &^ bc1) - a[16] = bc1 ^ (bc3 &^ bc2) - a[22] = bc2 ^ (bc4 &^ bc3) - a[3] = bc3 ^ (bc0 &^ bc4) - a[9] = bc4 ^ (bc1 &^ bc0) - - t = a[20] ^ d0 - bc4 = t<<18 | t>>(64-18) - t = a[1] ^ d1 - bc0 = t<<1 | t>>(64-1) - t = a[7] ^ d2 - bc1 = t<<6 | t>>(64-6) - t = a[13] ^ d3 - bc2 = t<<25 | t>>(64-25) - t = a[19] ^ d4 - bc3 = t<<8 | t>>(64-8) - a[20] = bc0 ^ (bc2 &^ bc1) - a[1] = bc1 ^ (bc3 &^ bc2) - a[7] = bc2 ^ (bc4 &^ bc3) - a[13] = bc3 ^ (bc0 &^ bc4) - a[19] = bc4 ^ (bc1 &^ bc0) - - t = a[5] ^ d0 - bc1 = t<<36 | t>>(64-36) - t = a[11] ^ d1 - bc2 = t<<10 | t>>(64-10) - t = a[17] ^ d2 - bc3 = t<<15 | t>>(64-15) - t = a[23] ^ d3 - bc4 = t<<56 | t>>(64-56) - t = a[4] ^ d4 - bc0 = t<<27 | t>>(64-27) - a[5] = bc0 ^ (bc2 &^ bc1) - a[11] = bc1 ^ (bc3 &^ bc2) - a[17] = bc2 ^ (bc4 &^ bc3) - a[23] = bc3 ^ (bc0 &^ bc4) - a[4] = bc4 ^ (bc1 &^ bc0) - - t = a[15] ^ d0 - bc3 = t<<41 | t>>(64-41) - t = a[21] ^ d1 - bc4 = t<<2 | t>>(64-2) - t = a[2] ^ d2 - bc0 = t<<62 | t>>(64-62) - t = a[8] ^ d3 - bc1 = t<<55 | t>>(64-55) - t = a[14] ^ d4 - bc2 = t<<39 | t>>(64-39) - a[15] = bc0 ^ (bc2 &^ bc1) - a[21] = bc1 ^ (bc3 &^ bc2) - a[2] = bc2 ^ (bc4 &^ bc3) - a[8] = bc3 ^ (bc0 &^ bc4) - a[14] = bc4 ^ (bc1 &^ bc0) - - // Round 2 - bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20] - bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21] - bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22] - bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23] - bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24] - d0 = bc4 ^ (bc1<<1 | bc1>>63) - d1 = bc0 ^ (bc2<<1 | bc2>>63) - d2 = bc1 ^ (bc3<<1 | bc3>>63) - d3 = bc2 ^ (bc4<<1 | bc4>>63) - d4 = bc3 ^ (bc0<<1 | bc0>>63) - - bc0 = a[0] ^ d0 - t = a[16] ^ d1 - bc1 = t<<44 | t>>(64-44) - t = a[7] ^ d2 - bc2 = t<<43 | t>>(64-43) - t = a[23] ^ d3 - bc3 = t<<21 | t>>(64-21) - t = a[14] ^ d4 - bc4 = t<<14 | t>>(64-14) - a[0] = bc0 ^ (bc2 &^ bc1) ^ RC[i+1] - a[16] = bc1 ^ (bc3 &^ bc2) - a[7] = bc2 ^ (bc4 &^ bc3) - a[23] = bc3 ^ (bc0 &^ bc4) - a[14] = bc4 ^ (bc1 &^ bc0) - - t = a[20] ^ d0 - bc2 = t<<3 | t>>(64-3) - t = a[11] ^ d1 - bc3 = t<<45 | t>>(64-45) - t = a[2] ^ d2 - bc4 = t<<61 | t>>(64-61) - t = a[18] ^ d3 - bc0 = t<<28 | t>>(64-28) - t = a[9] ^ d4 - bc1 = t<<20 | t>>(64-20) - a[20] = bc0 ^ (bc2 &^ bc1) - a[11] = bc1 ^ (bc3 &^ bc2) - a[2] = bc2 ^ (bc4 &^ bc3) - a[18] = bc3 ^ (bc0 &^ bc4) - a[9] = bc4 ^ (bc1 &^ bc0) - - t = a[15] ^ d0 - bc4 = t<<18 | t>>(64-18) - t = a[6] ^ d1 - bc0 = t<<1 | t>>(64-1) - t = a[22] ^ d2 - bc1 = t<<6 | t>>(64-6) - t = a[13] ^ d3 - bc2 = t<<25 | t>>(64-25) - t = a[4] ^ d4 - bc3 = t<<8 | t>>(64-8) - a[15] = bc0 ^ (bc2 &^ bc1) - a[6] = bc1 ^ (bc3 &^ bc2) - a[22] = bc2 ^ (bc4 &^ bc3) - a[13] = bc3 ^ (bc0 &^ bc4) - a[4] = bc4 ^ (bc1 &^ bc0) - - t = a[10] ^ d0 - bc1 = t<<36 | t>>(64-36) - t = a[1] ^ d1 - bc2 = t<<10 | t>>(64-10) - t = a[17] ^ d2 - bc3 = t<<15 | t>>(64-15) - t = a[8] ^ d3 - bc4 = t<<56 | t>>(64-56) - t = a[24] ^ d4 - bc0 = t<<27 | t>>(64-27) - a[10] = bc0 ^ (bc2 &^ bc1) - a[1] = bc1 ^ (bc3 &^ bc2) - a[17] = bc2 ^ (bc4 &^ bc3) - a[8] = bc3 ^ (bc0 &^ bc4) - a[24] = bc4 ^ (bc1 &^ bc0) - - t = a[5] ^ d0 - bc3 = t<<41 | t>>(64-41) - t = a[21] ^ d1 - bc4 = t<<2 | t>>(64-2) - t = a[12] ^ d2 - bc0 = t<<62 | t>>(64-62) - t = a[3] ^ d3 - bc1 = t<<55 | t>>(64-55) - t = a[19] ^ d4 - bc2 = t<<39 | t>>(64-39) - a[5] = bc0 ^ (bc2 &^ bc1) - a[21] = bc1 ^ (bc3 &^ bc2) - a[12] = bc2 ^ (bc4 &^ bc3) - a[3] = bc3 ^ (bc0 &^ bc4) - a[19] = bc4 ^ (bc1 &^ bc0) - - // Round 3 - bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20] - bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21] - bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22] - bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23] - bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24] - d0 = bc4 ^ (bc1<<1 | bc1>>63) - d1 = bc0 ^ (bc2<<1 | bc2>>63) - d2 = bc1 ^ (bc3<<1 | bc3>>63) - d3 = bc2 ^ (bc4<<1 | bc4>>63) - d4 = bc3 ^ (bc0<<1 | bc0>>63) - - bc0 = a[0] ^ d0 - t = a[11] ^ d1 - bc1 = t<<44 | t>>(64-44) - t = a[22] ^ d2 - bc2 = t<<43 | t>>(64-43) - t = a[8] ^ d3 - bc3 = t<<21 | t>>(64-21) - t = a[19] ^ d4 - bc4 = t<<14 | t>>(64-14) - a[0] = bc0 ^ (bc2 &^ bc1) ^ RC[i+2] - a[11] = bc1 ^ (bc3 &^ bc2) - a[22] = bc2 ^ (bc4 &^ bc3) - a[8] = bc3 ^ (bc0 &^ bc4) - a[19] = bc4 ^ (bc1 &^ bc0) - - t = a[15] ^ d0 - bc2 = t<<3 | t>>(64-3) - t = a[1] ^ d1 - bc3 = t<<45 | t>>(64-45) - t = a[12] ^ d2 - bc4 = t<<61 | t>>(64-61) - t = a[23] ^ d3 - bc0 = t<<28 | t>>(64-28) - t = a[9] ^ d4 - bc1 = t<<20 | t>>(64-20) - a[15] = bc0 ^ (bc2 &^ bc1) - a[1] = bc1 ^ (bc3 &^ bc2) - a[12] = bc2 ^ (bc4 &^ bc3) - a[23] = bc3 ^ (bc0 &^ bc4) - a[9] = bc4 ^ (bc1 &^ bc0) - - t = a[5] ^ d0 - bc4 = t<<18 | t>>(64-18) - t = a[16] ^ d1 - bc0 = t<<1 | t>>(64-1) - t = a[2] ^ d2 - bc1 = t<<6 | t>>(64-6) - t = a[13] ^ d3 - bc2 = t<<25 | t>>(64-25) - t = a[24] ^ d4 - bc3 = t<<8 | t>>(64-8) - a[5] = bc0 ^ (bc2 &^ bc1) - a[16] = bc1 ^ (bc3 &^ bc2) - a[2] = bc2 ^ (bc4 &^ bc3) - a[13] = bc3 ^ (bc0 &^ bc4) - a[24] = bc4 ^ (bc1 &^ bc0) - - t = a[20] ^ d0 - bc1 = t<<36 | t>>(64-36) - t = a[6] ^ d1 - bc2 = t<<10 | t>>(64-10) - t = a[17] ^ d2 - bc3 = t<<15 | t>>(64-15) - t = a[3] ^ d3 - bc4 = t<<56 | t>>(64-56) - t = a[14] ^ d4 - bc0 = t<<27 | t>>(64-27) - a[20] = bc0 ^ (bc2 &^ bc1) - a[6] = bc1 ^ (bc3 &^ bc2) - a[17] = bc2 ^ (bc4 &^ bc3) - a[3] = bc3 ^ (bc0 &^ bc4) - a[14] = bc4 ^ (bc1 &^ bc0) - - t = a[10] ^ d0 - bc3 = t<<41 | t>>(64-41) - t = a[21] ^ d1 - bc4 = t<<2 | t>>(64-2) - t = a[7] ^ d2 - bc0 = t<<62 | t>>(64-62) - t = a[18] ^ d3 - bc1 = t<<55 | t>>(64-55) - t = a[4] ^ d4 - bc2 = t<<39 | t>>(64-39) - a[10] = bc0 ^ (bc2 &^ bc1) - a[21] = bc1 ^ (bc3 &^ bc2) - a[7] = bc2 ^ (bc4 &^ bc3) - a[18] = bc3 ^ (bc0 &^ bc4) - a[4] = bc4 ^ (bc1 &^ bc0) - - // Round 4 - bc0 = a[0] ^ a[5] ^ a[10] ^ a[15] ^ a[20] - bc1 = a[1] ^ a[6] ^ a[11] ^ a[16] ^ a[21] - bc2 = a[2] ^ a[7] ^ a[12] ^ a[17] ^ a[22] - bc3 = a[3] ^ a[8] ^ a[13] ^ a[18] ^ a[23] - bc4 = a[4] ^ a[9] ^ a[14] ^ a[19] ^ a[24] - d0 = bc4 ^ (bc1<<1 | bc1>>63) - d1 = bc0 ^ (bc2<<1 | bc2>>63) - d2 = bc1 ^ (bc3<<1 | bc3>>63) - d3 = bc2 ^ (bc4<<1 | bc4>>63) - d4 = bc3 ^ (bc0<<1 | bc0>>63) - - bc0 = a[0] ^ d0 - t = a[1] ^ d1 - bc1 = t<<44 | t>>(64-44) - t = a[2] ^ d2 - bc2 = t<<43 | t>>(64-43) - t = a[3] ^ d3 - bc3 = t<<21 | t>>(64-21) - t = a[4] ^ d4 - bc4 = t<<14 | t>>(64-14) - a[0] = bc0 ^ (bc2 &^ bc1) ^ RC[i+3] - a[1] = bc1 ^ (bc3 &^ bc2) - a[2] = bc2 ^ (bc4 &^ bc3) - a[3] = bc3 ^ (bc0 &^ bc4) - a[4] = bc4 ^ (bc1 &^ bc0) - - t = a[5] ^ d0 - bc2 = t<<3 | t>>(64-3) - t = a[6] ^ d1 - bc3 = t<<45 | t>>(64-45) - t = a[7] ^ d2 - bc4 = t<<61 | t>>(64-61) - t = a[8] ^ d3 - bc0 = t<<28 | t>>(64-28) - t = a[9] ^ d4 - bc1 = t<<20 | t>>(64-20) - a[5] = bc0 ^ (bc2 &^ bc1) - a[6] = bc1 ^ (bc3 &^ bc2) - a[7] = bc2 ^ (bc4 &^ bc3) - a[8] = bc3 ^ (bc0 &^ bc4) - a[9] = bc4 ^ (bc1 &^ bc0) - - t = a[10] ^ d0 - bc4 = t<<18 | t>>(64-18) - t = a[11] ^ d1 - bc0 = t<<1 | t>>(64-1) - t = a[12] ^ d2 - bc1 = t<<6 | t>>(64-6) - t = a[13] ^ d3 - bc2 = t<<25 | t>>(64-25) - t = a[14] ^ d4 - bc3 = t<<8 | t>>(64-8) - a[10] = bc0 ^ (bc2 &^ bc1) - a[11] = bc1 ^ (bc3 &^ bc2) - a[12] = bc2 ^ (bc4 &^ bc3) - a[13] = bc3 ^ (bc0 &^ bc4) - a[14] = bc4 ^ (bc1 &^ bc0) - - t = a[15] ^ d0 - bc1 = t<<36 | t>>(64-36) - t = a[16] ^ d1 - bc2 = t<<10 | t>>(64-10) - t = a[17] ^ d2 - bc3 = t<<15 | t>>(64-15) - t = a[18] ^ d3 - bc4 = t<<56 | t>>(64-56) - t = a[19] ^ d4 - bc0 = t<<27 | t>>(64-27) - a[15] = bc0 ^ (bc2 &^ bc1) - a[16] = bc1 ^ (bc3 &^ bc2) - a[17] = bc2 ^ (bc4 &^ bc3) - a[18] = bc3 ^ (bc0 &^ bc4) - a[19] = bc4 ^ (bc1 &^ bc0) - - t = a[20] ^ d0 - bc3 = t<<41 | t>>(64-41) - t = a[21] ^ d1 - bc4 = t<<2 | t>>(64-2) - t = a[22] ^ d2 - bc0 = t<<62 | t>>(64-62) - t = a[23] ^ d3 - bc1 = t<<55 | t>>(64-55) - t = a[24] ^ d4 - bc2 = t<<39 | t>>(64-39) - a[20] = bc0 ^ (bc2 &^ bc1) - a[21] = bc1 ^ (bc3 &^ bc2) - a[22] = bc2 ^ (bc4 &^ bc3) - a[23] = bc3 ^ (bc0 &^ bc4) - a[24] = bc4 ^ (bc1 &^ bc0) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/internal/sha3/rc.go b/backend/vendor/github.com/cloudflare/circl/internal/sha3/rc.go deleted file mode 100644 index 6a3df42..0000000 --- a/backend/vendor/github.com/cloudflare/circl/internal/sha3/rc.go +++ /dev/null @@ -1,29 +0,0 @@ -package sha3 - -// RC stores the round constants for use in the ι step. -var RC = [24]uint64{ - 0x0000000000000001, - 0x0000000000008082, - 0x800000000000808A, - 0x8000000080008000, - 0x000000000000808B, - 0x0000000080000001, - 0x8000000080008081, - 0x8000000000008009, - 0x000000000000008A, - 0x0000000000000088, - 0x0000000080008009, - 0x000000008000000A, - 0x000000008000808B, - 0x800000000000008B, - 0x8000000000008089, - 0x8000000000008003, - 0x8000000000008002, - 0x8000000000000080, - 0x000000000000800A, - 0x800000008000000A, - 0x8000000080008081, - 0x8000000000008080, - 0x0000000080000001, - 0x8000000080008008, -} diff --git a/backend/vendor/github.com/cloudflare/circl/internal/sha3/sha3.go b/backend/vendor/github.com/cloudflare/circl/internal/sha3/sha3.go deleted file mode 100644 index a0df5aa..0000000 --- a/backend/vendor/github.com/cloudflare/circl/internal/sha3/sha3.go +++ /dev/null @@ -1,200 +0,0 @@ -// Copyright 2014 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package sha3 - -// spongeDirection indicates the direction bytes are flowing through the sponge. -type spongeDirection int - -const ( - // spongeAbsorbing indicates that the sponge is absorbing input. - spongeAbsorbing spongeDirection = iota - // spongeSqueezing indicates that the sponge is being squeezed. - spongeSqueezing -) - -const ( - // maxRate is the maximum size of the internal buffer. SHAKE-256 - // currently needs the largest buffer. - maxRate = 168 -) - -func (d *State) buf() []byte { - return d.storage.asBytes()[d.bufo:d.bufe] -} - -type State struct { - // Generic sponge components. - a [25]uint64 // main state of the hash - rate int // the number of bytes of state to use - - bufo int // offset of buffer in storage - bufe int // end of buffer in storage - - // dsbyte contains the "domain separation" bits and the first bit of - // the padding. Sections 6.1 and 6.2 of [1] separate the outputs of the - // SHA-3 and SHAKE functions by appending bitstrings to the message. - // Using a little-endian bit-ordering convention, these are "01" for SHA-3 - // and "1111" for SHAKE, or 00000010b and 00001111b, respectively. Then the - // padding rule from section 5.1 is applied to pad the message to a multiple - // of the rate, which involves adding a "1" bit, zero or more "0" bits, and - // a final "1" bit. We merge the first "1" bit from the padding into dsbyte, - // giving 00000110b (0x06) and 00011111b (0x1f). - // [1] http://csrc.nist.gov/publications/drafts/fips-202/fips_202_draft.pdf - // "Draft FIPS 202: SHA-3 Standard: Permutation-Based Hash and - // Extendable-Output Functions (May 2014)" - dsbyte byte - - storage storageBuf - - // Specific to SHA-3 and SHAKE. - outputLen int // the default output size in bytes - state spongeDirection // whether the sponge is absorbing or squeezing - turbo bool // Whether we're using 12 rounds instead of 24 -} - -// BlockSize returns the rate of sponge underlying this hash function. -func (d *State) BlockSize() int { return d.rate } - -// Size returns the output size of the hash function in bytes. -func (d *State) Size() int { return d.outputLen } - -// Reset clears the internal state by zeroing the sponge state and -// the byte buffer, and setting Sponge.state to absorbing. -func (d *State) Reset() { - // Zero the permutation's state. - for i := range d.a { - d.a[i] = 0 - } - d.state = spongeAbsorbing - d.bufo = 0 - d.bufe = 0 -} - -func (d *State) clone() *State { - ret := *d - return &ret -} - -// permute applies the KeccakF-1600 permutation. It handles -// any input-output buffering. -func (d *State) permute() { - switch d.state { - case spongeAbsorbing: - // If we're absorbing, we need to xor the input into the state - // before applying the permutation. - xorIn(d, d.buf()) - d.bufe = 0 - d.bufo = 0 - KeccakF1600(&d.a, d.turbo) - case spongeSqueezing: - // If we're squeezing, we need to apply the permutation before - // copying more output. - KeccakF1600(&d.a, d.turbo) - d.bufe = d.rate - d.bufo = 0 - copyOut(d, d.buf()) - } -} - -// pads appends the domain separation bits in dsbyte, applies -// the multi-bitrate 10..1 padding rule, and permutes the state. -func (d *State) padAndPermute(dsbyte byte) { - // Pad with this instance's domain-separator bits. We know that there's - // at least one byte of space in d.buf() because, if it were full, - // permute would have been called to empty it. dsbyte also contains the - // first one bit for the padding. See the comment in the state struct. - zerosStart := d.bufe + 1 - d.bufe = d.rate - buf := d.buf() - buf[zerosStart-1] = dsbyte - for i := zerosStart; i < d.rate; i++ { - buf[i] = 0 - } - // This adds the final one bit for the padding. Because of the way that - // bits are numbered from the LSB upwards, the final bit is the MSB of - // the last byte. - buf[d.rate-1] ^= 0x80 - // Apply the permutation - d.permute() - d.state = spongeSqueezing - d.bufe = d.rate - copyOut(d, buf) -} - -// Write absorbs more data into the hash's state. It produces an error -// if more data is written to the ShakeHash after writing -func (d *State) Write(p []byte) (written int, err error) { - if d.state != spongeAbsorbing { - panic("sha3: write to sponge after read") - } - written = len(p) - - for len(p) > 0 { - bufl := d.bufe - d.bufo - if bufl == 0 && len(p) >= d.rate { - // The fast path; absorb a full "rate" bytes of input and apply the permutation. - xorIn(d, p[:d.rate]) - p = p[d.rate:] - KeccakF1600(&d.a, d.turbo) - } else { - // The slow path; buffer the input until we can fill the sponge, and then xor it in. - todo := d.rate - bufl - if todo > len(p) { - todo = len(p) - } - d.bufe += todo - buf := d.buf() - copy(buf[bufl:], p[:todo]) - p = p[todo:] - - // If the sponge is full, apply the permutation. - if d.bufe == d.rate { - d.permute() - } - } - } - - return written, nil -} - -// Read squeezes an arbitrary number of bytes from the sponge. -func (d *State) Read(out []byte) (n int, err error) { - // If we're still absorbing, pad and apply the permutation. - if d.state == spongeAbsorbing { - d.padAndPermute(d.dsbyte) - } - - n = len(out) - - // Now, do the squeezing. - for len(out) > 0 { - buf := d.buf() - n := copy(out, buf) - d.bufo += n - out = out[n:] - - // Apply the permutation if we've squeezed the sponge dry. - if d.bufo == d.bufe { - d.permute() - } - } - - return -} - -// Sum applies padding to the hash state and then squeezes out the desired -// number of output bytes. -func (d *State) Sum(in []byte) []byte { - // Make a copy of the original hash so that caller can keep writing - // and summing. - dup := d.clone() - hash := make([]byte, dup.outputLen) - _, _ = dup.Read(hash) - return append(in, hash...) -} - -func (d *State) IsAbsorbing() bool { - return d.state == spongeAbsorbing -} diff --git a/backend/vendor/github.com/cloudflare/circl/internal/sha3/sha3_s390x.s b/backend/vendor/github.com/cloudflare/circl/internal/sha3/sha3_s390x.s deleted file mode 100644 index 8a4458f..0000000 --- a/backend/vendor/github.com/cloudflare/circl/internal/sha3/sha3_s390x.s +++ /dev/null @@ -1,33 +0,0 @@ -// Copyright 2017 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -// +build !gccgo,!appengine - -#include "textflag.h" - -// func kimd(function code, chain *[200]byte, src []byte) -TEXT ·kimd(SB), NOFRAME|NOSPLIT, $0-40 - MOVD function+0(FP), R0 - MOVD chain+8(FP), R1 - LMG src+16(FP), R2, R3 // R2=base, R3=len - -continue: - WORD $0xB93E0002 // KIMD --, R2 - BVS continue // continue if interrupted - MOVD $0, R0 // reset R0 for pre-go1.8 compilers - RET - -// func klmd(function code, chain *[200]byte, dst, src []byte) -TEXT ·klmd(SB), NOFRAME|NOSPLIT, $0-64 - // TODO: SHAKE support - MOVD function+0(FP), R0 - MOVD chain+8(FP), R1 - LMG dst+16(FP), R2, R3 // R2=base, R3=len - LMG src+40(FP), R4, R5 // R4=base, R5=len - -continue: - WORD $0xB93F0024 // KLMD R2, R4 - BVS continue // continue if interrupted - MOVD $0, R0 // reset R0 for pre-go1.8 compilers - RET diff --git a/backend/vendor/github.com/cloudflare/circl/internal/sha3/shake.go b/backend/vendor/github.com/cloudflare/circl/internal/sha3/shake.go deleted file mode 100644 index 77817f7..0000000 --- a/backend/vendor/github.com/cloudflare/circl/internal/sha3/shake.go +++ /dev/null @@ -1,119 +0,0 @@ -// Copyright 2014 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package sha3 - -// This file defines the ShakeHash interface, and provides -// functions for creating SHAKE and cSHAKE instances, as well as utility -// functions for hashing bytes to arbitrary-length output. -// -// -// SHAKE implementation is based on FIPS PUB 202 [1] -// cSHAKE implementations is based on NIST SP 800-185 [2] -// -// [1] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf -// [2] https://doi.org/10.6028/NIST.SP.800-185 - -import ( - "io" -) - -// ShakeHash defines the interface to hash functions that -// support arbitrary-length output. -type ShakeHash interface { - // Write absorbs more data into the hash's state. It panics if input is - // written to it after output has been read from it. - io.Writer - - // Read reads more output from the hash; reading affects the hash's - // state. (ShakeHash.Read is thus very different from Hash.Sum) - // It never returns an error. - io.Reader - - // Clone returns a copy of the ShakeHash in its current state. - Clone() ShakeHash - - // Reset resets the ShakeHash to its initial state. - Reset() -} - -// Consts for configuring initial SHA-3 state -const ( - dsbyteShake = 0x1f - rate128 = 168 - rate256 = 136 -) - -// Clone returns copy of SHAKE context within its current state. -func (d *State) Clone() ShakeHash { - return d.clone() -} - -// NewShake128 creates a new SHAKE128 variable-output-length ShakeHash. -// Its generic security strength is 128 bits against all attacks if at -// least 32 bytes of its output are used. -func NewShake128() State { - return State{rate: rate128, dsbyte: dsbyteShake} -} - -// NewTurboShake128 creates a new TurboSHAKE128 variable-output-length ShakeHash. -// Its generic security strength is 128 bits against all attacks if at -// least 32 bytes of its output are used. -// D is the domain separation byte and must be between 0x01 and 0x7f inclusive. -func NewTurboShake128(D byte) State { - if D == 0 || D > 0x7f { - panic("turboshake: D out of range") - } - return State{rate: rate128, dsbyte: D, turbo: true} -} - -// NewShake256 creates a new SHAKE256 variable-output-length ShakeHash. -// Its generic security strength is 256 bits against all attacks if -// at least 64 bytes of its output are used. -func NewShake256() State { - return State{rate: rate256, dsbyte: dsbyteShake} -} - -// NewTurboShake256 creates a new TurboSHAKE256 variable-output-length ShakeHash. -// Its generic security strength is 256 bits against all attacks if -// at least 64 bytes of its output are used. -// D is the domain separation byte and must be between 0x01 and 0x7f inclusive. -func NewTurboShake256(D byte) State { - if D == 0 || D > 0x7f { - panic("turboshake: D out of range") - } - return State{rate: rate256, dsbyte: D, turbo: true} -} - -// ShakeSum128 writes an arbitrary-length digest of data into hash. -func ShakeSum128(hash, data []byte) { - h := NewShake128() - _, _ = h.Write(data) - _, _ = h.Read(hash) -} - -// ShakeSum256 writes an arbitrary-length digest of data into hash. -func ShakeSum256(hash, data []byte) { - h := NewShake256() - _, _ = h.Write(data) - _, _ = h.Read(hash) -} - -// TurboShakeSum128 writes an arbitrary-length digest of data into hash. -func TurboShakeSum128(hash, data []byte, D byte) { - h := NewTurboShake128(D) - _, _ = h.Write(data) - _, _ = h.Read(hash) -} - -// TurboShakeSum256 writes an arbitrary-length digest of data into hash. -func TurboShakeSum256(hash, data []byte, D byte) { - h := NewTurboShake256(D) - _, _ = h.Write(data) - _, _ = h.Read(hash) -} - -func (d *State) SwitchDS(D byte) { - d.dsbyte = D -} diff --git a/backend/vendor/github.com/cloudflare/circl/internal/sha3/xor.go b/backend/vendor/github.com/cloudflare/circl/internal/sha3/xor.go deleted file mode 100644 index 1e21337..0000000 --- a/backend/vendor/github.com/cloudflare/circl/internal/sha3/xor.go +++ /dev/null @@ -1,15 +0,0 @@ -// Copyright 2015 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -//go:build (!amd64 && !386 && !ppc64le) || appengine -// +build !amd64,!386,!ppc64le appengine - -package sha3 - -// A storageBuf is an aligned array of maxRate bytes. -type storageBuf [maxRate]byte - -func (b *storageBuf) asBytes() *[maxRate]byte { - return (*[maxRate]byte)(b) -} diff --git a/backend/vendor/github.com/cloudflare/circl/internal/sha3/xor_generic.go b/backend/vendor/github.com/cloudflare/circl/internal/sha3/xor_generic.go deleted file mode 100644 index 2b0c661..0000000 --- a/backend/vendor/github.com/cloudflare/circl/internal/sha3/xor_generic.go +++ /dev/null @@ -1,33 +0,0 @@ -// Copyright 2015 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -//go:build (!amd64 || appengine) && (!386 || appengine) && (!ppc64le || appengine) -// +build !amd64 appengine -// +build !386 appengine -// +build !ppc64le appengine - -package sha3 - -import "encoding/binary" - -// xorIn xors the bytes in buf into the state; it -// makes no non-portable assumptions about memory layout -// or alignment. -func xorIn(d *State, buf []byte) { - n := len(buf) / 8 - - for i := 0; i < n; i++ { - a := binary.LittleEndian.Uint64(buf) - d.a[i] ^= a - buf = buf[8:] - } -} - -// copyOut copies ulint64s to a byte buffer. -func copyOut(d *State, b []byte) { - for i := 0; len(b) >= 8; i++ { - binary.LittleEndian.PutUint64(b, d.a[i]) - b = b[8:] - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.go b/backend/vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.go deleted file mode 100644 index 052fc8d..0000000 --- a/backend/vendor/github.com/cloudflare/circl/internal/sha3/xor_unaligned.go +++ /dev/null @@ -1,61 +0,0 @@ -// Copyright 2015 The Go Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -//go:build (amd64 || 386 || ppc64le) && !appengine -// +build amd64 386 ppc64le -// +build !appengine - -package sha3 - -import "unsafe" - -// A storageBuf is an aligned array of maxRate bytes. -type storageBuf [maxRate / 8]uint64 - -func (b *storageBuf) asBytes() *[maxRate]byte { - return (*[maxRate]byte)(unsafe.Pointer(b)) -} - -// xorInuses unaligned reads and writes to update d.a to contain d.a -// XOR buf. -func xorIn(d *State, buf []byte) { - n := len(buf) - bw := (*[maxRate / 8]uint64)(unsafe.Pointer(&buf[0]))[: n/8 : n/8] - if n >= 72 { - d.a[0] ^= bw[0] - d.a[1] ^= bw[1] - d.a[2] ^= bw[2] - d.a[3] ^= bw[3] - d.a[4] ^= bw[4] - d.a[5] ^= bw[5] - d.a[6] ^= bw[6] - d.a[7] ^= bw[7] - d.a[8] ^= bw[8] - } - if n >= 104 { - d.a[9] ^= bw[9] - d.a[10] ^= bw[10] - d.a[11] ^= bw[11] - d.a[12] ^= bw[12] - } - if n >= 136 { - d.a[13] ^= bw[13] - d.a[14] ^= bw[14] - d.a[15] ^= bw[15] - d.a[16] ^= bw[16] - } - if n >= 144 { - d.a[17] ^= bw[17] - } - if n >= 168 { - d.a[18] ^= bw[18] - d.a[19] ^= bw[19] - d.a[20] ^= bw[20] - } -} - -func copyOut(d *State, buf []byte) { - ab := (*[maxRate]uint8)(unsafe.Pointer(&d.a[0])) - copy(buf, ab[:]) -} diff --git a/backend/vendor/github.com/cloudflare/circl/kem/kem.go b/backend/vendor/github.com/cloudflare/circl/kem/kem.go deleted file mode 100644 index a2f6a2a..0000000 --- a/backend/vendor/github.com/cloudflare/circl/kem/kem.go +++ /dev/null @@ -1,121 +0,0 @@ -// Package kem provides a unified interface for KEM schemes. -// -// A register of schemes is available in the package -// -// github.com/cloudflare/circl/kem/schemes -package kem - -import ( - "encoding" - "errors" -) - -// A KEM public key -type PublicKey interface { - // Returns the scheme for this public key - Scheme() Scheme - - encoding.BinaryMarshaler - Equal(PublicKey) bool -} - -// A KEM private key -type PrivateKey interface { - // Returns the scheme for this private key - Scheme() Scheme - - encoding.BinaryMarshaler - Equal(PrivateKey) bool - Public() PublicKey -} - -// A Scheme represents a specific instance of a KEM. -type Scheme interface { - // Name of the scheme - Name() string - - // GenerateKeyPair creates a new key pair. - GenerateKeyPair() (PublicKey, PrivateKey, error) - - // Encapsulate generates a shared key ss for the public key and - // encapsulates it into a ciphertext ct. - Encapsulate(pk PublicKey) (ct, ss []byte, err error) - - // Returns the shared key encapsulated in ciphertext ct for the - // private key sk. - Decapsulate(sk PrivateKey, ct []byte) ([]byte, error) - - // Unmarshals a PublicKey from the provided buffer. - UnmarshalBinaryPublicKey([]byte) (PublicKey, error) - - // Unmarshals a PrivateKey from the provided buffer. - UnmarshalBinaryPrivateKey([]byte) (PrivateKey, error) - - // Size of encapsulated keys. - CiphertextSize() int - - // Size of established shared keys. - SharedKeySize() int - - // Size of packed private keys. - PrivateKeySize() int - - // Size of packed public keys. - PublicKeySize() int - - // DeriveKeyPair deterministically derives a pair of keys from a seed. - // Panics if the length of seed is not equal to the value returned by - // SeedSize. - DeriveKeyPair(seed []byte) (PublicKey, PrivateKey) - - // Size of seed used in DeriveKey - SeedSize() int - - // EncapsulateDeterministically generates a shared key ss for the public - // key deterministically from the given seed and encapsulates it into - // a ciphertext ct. If unsure, you're better off using Encapsulate(). - EncapsulateDeterministically(pk PublicKey, seed []byte) ( - ct, ss []byte, err error) - - // Size of seed used in EncapsulateDeterministically(). - EncapsulationSeedSize() int -} - -// AuthScheme represents a KEM that supports authenticated key encapsulation. -type AuthScheme interface { - Scheme - AuthEncapsulate(pkr PublicKey, sks PrivateKey) (ct, ss []byte, err error) - AuthEncapsulateDeterministically(pkr PublicKey, sks PrivateKey, seed []byte) (ct, ss []byte, err error) - AuthDecapsulate(skr PrivateKey, ct []byte, pks PublicKey) ([]byte, error) -} - -var ( - // ErrTypeMismatch is the error used if types of, for instance, private - // and public keys don't match - ErrTypeMismatch = errors.New("types mismatch") - - // ErrSeedSize is the error used if the provided seed is of the wrong - // size. - ErrSeedSize = errors.New("wrong seed size") - - // ErrPubKeySize is the error used if the provided public key is of - // the wrong size. - ErrPubKeySize = errors.New("wrong size for public key") - - // ErrCiphertextSize is the error used if the provided ciphertext - // is of the wrong size. - ErrCiphertextSize = errors.New("wrong size for ciphertext") - - // ErrPrivKeySize is the error used if the provided private key is of - // the wrong size. - ErrPrivKeySize = errors.New("wrong size for private key") - - // ErrPubKey is the error used if the provided public key is invalid. - ErrPubKey = errors.New("invalid public key") - - // ErrPrivKey is the error used if the provided private key is invalid. - ErrPrivKey = errors.New("invalid private key") - - // ErrCipherText is the error used if the provided ciphertext is invalid. - ErrCipherText = errors.New("invalid ciphertext") -) diff --git a/backend/vendor/github.com/cloudflare/circl/kem/kyber/kyber768/kyber.go b/backend/vendor/github.com/cloudflare/circl/kem/kyber/kyber768/kyber.go deleted file mode 100644 index 0e03c40..0000000 --- a/backend/vendor/github.com/cloudflare/circl/kem/kyber/kyber768/kyber.go +++ /dev/null @@ -1,405 +0,0 @@ -// Code generated from pkg.templ.go. DO NOT EDIT. - -// Package kyber768 implements the IND-CCA2 secure key encapsulation mechanism -// Kyber768.CCAKEM as submitted to round 3 of the NIST PQC competition and -// described in -// -// https://pq-crystals.org/kyber/data/kyber-specification-round3.pdf -package kyber768 - -import ( - "bytes" - "crypto/subtle" - "io" - - cryptoRand "crypto/rand" - "github.com/cloudflare/circl/internal/sha3" - "github.com/cloudflare/circl/kem" - cpapke "github.com/cloudflare/circl/pke/kyber/kyber768" -) - -const ( - // Size of seed for NewKeyFromSeed - KeySeedSize = cpapke.KeySeedSize + 32 - - // Size of seed for EncapsulateTo. - EncapsulationSeedSize = 32 - - // Size of the established shared key. - SharedKeySize = 32 - - // Size of the encapsulated shared key. - CiphertextSize = cpapke.CiphertextSize - - // Size of a packed public key. - PublicKeySize = cpapke.PublicKeySize - - // Size of a packed private key. - PrivateKeySize = cpapke.PrivateKeySize + cpapke.PublicKeySize + 64 -) - -// Type of a Kyber768.CCAKEM public key -type PublicKey struct { - pk *cpapke.PublicKey - - hpk [32]byte // H(pk) -} - -// Type of a Kyber768.CCAKEM private key -type PrivateKey struct { - sk *cpapke.PrivateKey - pk *cpapke.PublicKey - hpk [32]byte // H(pk) - z [32]byte -} - -// NewKeyFromSeed derives a public/private keypair deterministically -// from the given seed. -// -// Panics if seed is not of length KeySeedSize. -func NewKeyFromSeed(seed []byte) (*PublicKey, *PrivateKey) { - var sk PrivateKey - var pk PublicKey - - if len(seed) != KeySeedSize { - panic("seed must be of length KeySeedSize") - } - - pk.pk, sk.sk = cpapke.NewKeyFromSeed(seed[:cpapke.KeySeedSize]) - sk.pk = pk.pk - copy(sk.z[:], seed[cpapke.KeySeedSize:]) - - // Compute H(pk) - var ppk [cpapke.PublicKeySize]byte - sk.pk.Pack(ppk[:]) - h := sha3.New256() - h.Write(ppk[:]) - h.Read(sk.hpk[:]) - copy(pk.hpk[:], sk.hpk[:]) - - return &pk, &sk -} - -// GenerateKeyPair generates public and private keys using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKeyPair(rand io.Reader) (*PublicKey, *PrivateKey, error) { - var seed [KeySeedSize]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - pk, sk := NewKeyFromSeed(seed[:]) - return pk, sk, nil -} - -// EncapsulateTo generates a shared key and ciphertext that contains it -// for the public key using randomness from seed and writes the shared key -// to ss and ciphertext to ct. -// -// Panics if ss, ct or seed are not of length SharedKeySize, CiphertextSize -// and EncapsulationSeedSize respectively. -// -// seed may be nil, in which case crypto/rand.Reader is used to generate one. -func (pk *PublicKey) EncapsulateTo(ct, ss []byte, seed []byte) { - if seed == nil { - seed = make([]byte, EncapsulationSeedSize) - if _, err := cryptoRand.Read(seed[:]); err != nil { - panic(err) - } - } else { - if len(seed) != EncapsulationSeedSize { - panic("seed must be of length EncapsulationSeedSize") - } - } - - if len(ct) != CiphertextSize { - panic("ct must be of length CiphertextSize") - } - - if len(ss) != SharedKeySize { - panic("ss must be of length SharedKeySize") - } - - var m [32]byte - // m = H(seed), the hash of shame - h := sha3.New256() - h.Write(seed) - h.Read(m[:]) - - // (K', r) = G(m ‖ H(pk)) - var kr [64]byte - g := sha3.New512() - g.Write(m[:]) - g.Write(pk.hpk[:]) - g.Read(kr[:]) - - // c = Kyber.CPAPKE.Enc(pk, m, r) - pk.pk.EncryptTo(ct, m[:], kr[32:]) - - // Compute H(c) and put in second slot of kr, which will be (K', H(c)). - h.Reset() - h.Write(ct[:CiphertextSize]) - h.Read(kr[32:]) - - // K = KDF(K' ‖ H(c)) - kdf := sha3.NewShake256() - kdf.Write(kr[:]) - kdf.Read(ss[:SharedKeySize]) -} - -// DecapsulateTo computes the shared key which is encapsulated in ct -// for the private key. -// -// Panics if ct or ss are not of length CiphertextSize and SharedKeySize -// respectively. -func (sk *PrivateKey) DecapsulateTo(ss, ct []byte) { - if len(ct) != CiphertextSize { - panic("ct must be of length CiphertextSize") - } - - if len(ss) != SharedKeySize { - panic("ss must be of length SharedKeySize") - } - - // m' = Kyber.CPAPKE.Dec(sk, ct) - var m2 [32]byte - sk.sk.DecryptTo(m2[:], ct) - - // (K'', r') = G(m' ‖ H(pk)) - var kr2 [64]byte - g := sha3.New512() - g.Write(m2[:]) - g.Write(sk.hpk[:]) - g.Read(kr2[:]) - - // c' = Kyber.CPAPKE.Enc(pk, m', r') - var ct2 [CiphertextSize]byte - sk.pk.EncryptTo(ct2[:], m2[:], kr2[32:]) - - // Compute H(c) and put in second slot of kr2, which will be (K'', H(c)). - h := sha3.New256() - h.Write(ct[:CiphertextSize]) - h.Read(kr2[32:]) - - // Replace K'' by z in the first slot of kr2 if c ≠ c'. - subtle.ConstantTimeCopy( - 1-subtle.ConstantTimeCompare(ct, ct2[:]), - kr2[:32], - sk.z[:], - ) - - // K = KDF(K''/z, H(c)) - kdf := sha3.NewShake256() - kdf.Write(kr2[:]) - kdf.Read(ss) -} - -// Packs sk to buf. -// -// Panics if buf is not of size PrivateKeySize. -func (sk *PrivateKey) Pack(buf []byte) { - if len(buf) != PrivateKeySize { - panic("buf must be of length PrivateKeySize") - } - - sk.sk.Pack(buf[:cpapke.PrivateKeySize]) - buf = buf[cpapke.PrivateKeySize:] - sk.pk.Pack(buf[:cpapke.PublicKeySize]) - buf = buf[cpapke.PublicKeySize:] - copy(buf, sk.hpk[:]) - buf = buf[32:] - copy(buf, sk.z[:]) -} - -// Unpacks sk from buf. -// -// Panics if buf is not of size PrivateKeySize. -func (sk *PrivateKey) Unpack(buf []byte) { - if len(buf) != PrivateKeySize { - panic("buf must be of length PrivateKeySize") - } - - sk.sk = new(cpapke.PrivateKey) - sk.sk.Unpack(buf[:cpapke.PrivateKeySize]) - buf = buf[cpapke.PrivateKeySize:] - sk.pk = new(cpapke.PublicKey) - sk.pk.Unpack(buf[:cpapke.PublicKeySize]) - buf = buf[cpapke.PublicKeySize:] - copy(sk.hpk[:], buf[:32]) - copy(sk.z[:], buf[32:]) -} - -// Packs pk to buf. -// -// Panics if buf is not of size PublicKeySize. -func (pk *PublicKey) Pack(buf []byte) { - if len(buf) != PublicKeySize { - panic("buf must be of length PublicKeySize") - } - - pk.pk.Pack(buf) -} - -// Unpacks pk from buf. -// -// Panics if buf is not of size PublicKeySize. -func (pk *PublicKey) Unpack(buf []byte) { - if len(buf) != PublicKeySize { - panic("buf must be of length PublicKeySize") - } - - pk.pk = new(cpapke.PublicKey) - pk.pk.Unpack(buf) - - // Compute cached H(pk) - h := sha3.New256() - h.Write(buf) - h.Read(pk.hpk[:]) - -} - -// Boilerplate down below for the KEM scheme API. - -type scheme struct{} - -var sch kem.Scheme = &scheme{} - -// Scheme returns a KEM interface. -func Scheme() kem.Scheme { return sch } - -func (*scheme) Name() string { return "Kyber768" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SeedSize() int { return KeySeedSize } -func (*scheme) SharedKeySize() int { return SharedKeySize } -func (*scheme) CiphertextSize() int { return CiphertextSize } -func (*scheme) EncapsulationSeedSize() int { return EncapsulationSeedSize } - -func (sk *PrivateKey) Scheme() kem.Scheme { return sch } -func (pk *PublicKey) Scheme() kem.Scheme { return sch } - -func (sk *PrivateKey) MarshalBinary() ([]byte, error) { - var ret [PrivateKeySize]byte - sk.Pack(ret[:]) - return ret[:], nil -} - -func (sk *PrivateKey) Equal(other kem.PrivateKey) bool { - oth, ok := other.(*PrivateKey) - if !ok { - return false - } - if sk.pk == nil && oth.pk == nil { - return true - } - if sk.pk == nil || oth.pk == nil { - return false - } - if !bytes.Equal(sk.hpk[:], oth.hpk[:]) || - subtle.ConstantTimeCompare(sk.z[:], oth.z[:]) != 1 { - return false - } - return sk.sk.Equal(oth.sk) -} - -func (pk *PublicKey) Equal(other kem.PublicKey) bool { - oth, ok := other.(*PublicKey) - if !ok { - return false - } - if pk.pk == nil && oth.pk == nil { - return true - } - if pk.pk == nil || oth.pk == nil { - return false - } - return bytes.Equal(pk.hpk[:], oth.hpk[:]) -} - -func (sk *PrivateKey) Public() kem.PublicKey { - pk := new(PublicKey) - pk.pk = sk.pk - copy(pk.hpk[:], sk.hpk[:]) - return pk -} - -func (pk *PublicKey) MarshalBinary() ([]byte, error) { - var ret [PublicKeySize]byte - pk.Pack(ret[:]) - return ret[:], nil -} - -func (*scheme) GenerateKeyPair() (kem.PublicKey, kem.PrivateKey, error) { - return GenerateKeyPair(cryptoRand.Reader) -} - -func (*scheme) DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) { - if len(seed) != KeySeedSize { - panic(kem.ErrSeedSize) - } - return NewKeyFromSeed(seed[:]) -} - -func (*scheme) Encapsulate(pk kem.PublicKey) (ct, ss []byte, err error) { - ct = make([]byte, CiphertextSize) - ss = make([]byte, SharedKeySize) - - pub, ok := pk.(*PublicKey) - if !ok { - return nil, nil, kem.ErrTypeMismatch - } - pub.EncapsulateTo(ct, ss, nil) - return -} - -func (*scheme) EncapsulateDeterministically(pk kem.PublicKey, seed []byte) ( - ct, ss []byte, err error) { - if len(seed) != EncapsulationSeedSize { - return nil, nil, kem.ErrSeedSize - } - - ct = make([]byte, CiphertextSize) - ss = make([]byte, SharedKeySize) - - pub, ok := pk.(*PublicKey) - if !ok { - return nil, nil, kem.ErrTypeMismatch - } - pub.EncapsulateTo(ct, ss, seed) - return -} - -func (*scheme) Decapsulate(sk kem.PrivateKey, ct []byte) ([]byte, error) { - if len(ct) != CiphertextSize { - return nil, kem.ErrCiphertextSize - } - - priv, ok := sk.(*PrivateKey) - if !ok { - return nil, kem.ErrTypeMismatch - } - ss := make([]byte, SharedKeySize) - priv.DecapsulateTo(ss, ct) - return ss, nil -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (kem.PublicKey, error) { - var ret PublicKey - if len(buf) != PublicKeySize { - return nil, kem.ErrPubKeySize - } - ret.Unpack(buf) - return &ret, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (kem.PrivateKey, error) { - if len(buf) != PrivateKeySize { - return nil, kem.ErrPrivKeySize - } - var ret PrivateKey - ret.Unpack(buf) - return &ret, nil -} diff --git a/backend/vendor/github.com/cloudflare/circl/kem/mlkem/mlkem768/kyber.go b/backend/vendor/github.com/cloudflare/circl/kem/mlkem/mlkem768/kyber.go deleted file mode 100644 index afa4831..0000000 --- a/backend/vendor/github.com/cloudflare/circl/kem/mlkem/mlkem768/kyber.go +++ /dev/null @@ -1,407 +0,0 @@ -// Code generated from pkg.templ.go. DO NOT EDIT. - -// Package mlkem768 implements the IND-CCA2 secure key encapsulation mechanism -// ML-KEM-768 as defined in FIPS203. -package mlkem768 - -import ( - "bytes" - "crypto/subtle" - "io" - - cryptoRand "crypto/rand" - "github.com/cloudflare/circl/internal/sha3" - "github.com/cloudflare/circl/kem" - cpapke "github.com/cloudflare/circl/pke/kyber/kyber768" -) - -const ( - // Size of seed for NewKeyFromSeed - KeySeedSize = cpapke.KeySeedSize + 32 - - // Size of seed for EncapsulateTo. - EncapsulationSeedSize = 32 - - // Size of the established shared key. - SharedKeySize = 32 - - // Size of the encapsulated shared key. - CiphertextSize = cpapke.CiphertextSize - - // Size of a packed public key. - PublicKeySize = cpapke.PublicKeySize - - // Size of a packed private key. - PrivateKeySize = cpapke.PrivateKeySize + cpapke.PublicKeySize + 64 -) - -// Type of a ML-KEM-768 public key -type PublicKey struct { - pk *cpapke.PublicKey - - hpk [32]byte // H(pk) -} - -// Type of a ML-KEM-768 private key -type PrivateKey struct { - sk *cpapke.PrivateKey - pk *cpapke.PublicKey - hpk [32]byte // H(pk) - z [32]byte -} - -// NewKeyFromSeed derives a public/private keypair deterministically -// from the given seed. -// -// Panics if seed is not of length KeySeedSize. -func NewKeyFromSeed(seed []byte) (*PublicKey, *PrivateKey) { - var sk PrivateKey - var pk PublicKey - - if len(seed) != KeySeedSize { - panic("seed must be of length KeySeedSize") - } - - pk.pk, sk.sk = cpapke.NewKeyFromSeedMLKEM(seed[:cpapke.KeySeedSize]) - sk.pk = pk.pk - copy(sk.z[:], seed[cpapke.KeySeedSize:]) - - // Compute H(pk) - var ppk [cpapke.PublicKeySize]byte - sk.pk.Pack(ppk[:]) - h := sha3.New256() - h.Write(ppk[:]) - h.Read(sk.hpk[:]) - copy(pk.hpk[:], sk.hpk[:]) - - return &pk, &sk -} - -// GenerateKeyPair generates public and private keys using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKeyPair(rand io.Reader) (*PublicKey, *PrivateKey, error) { - var seed [KeySeedSize]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - pk, sk := NewKeyFromSeed(seed[:]) - return pk, sk, nil -} - -// EncapsulateTo generates a shared key and ciphertext that contains it -// for the public key using randomness from seed and writes the shared key -// to ss and ciphertext to ct. -// -// Panics if ss, ct or seed are not of length SharedKeySize, CiphertextSize -// and EncapsulationSeedSize respectively. -// -// seed may be nil, in which case crypto/rand.Reader is used to generate one. -func (pk *PublicKey) EncapsulateTo(ct, ss []byte, seed []byte) { - if seed == nil { - seed = make([]byte, EncapsulationSeedSize) - if _, err := cryptoRand.Read(seed[:]); err != nil { - panic(err) - } - } else { - if len(seed) != EncapsulationSeedSize { - panic("seed must be of length EncapsulationSeedSize") - } - } - - if len(ct) != CiphertextSize { - panic("ct must be of length CiphertextSize") - } - - if len(ss) != SharedKeySize { - panic("ss must be of length SharedKeySize") - } - - var m [32]byte - copy(m[:], seed) - - // (K', r) = G(m ‖ H(pk)) - var kr [64]byte - g := sha3.New512() - g.Write(m[:]) - g.Write(pk.hpk[:]) - g.Read(kr[:]) - - // c = Kyber.CPAPKE.Enc(pk, m, r) - pk.pk.EncryptTo(ct, m[:], kr[32:]) - - copy(ss, kr[:SharedKeySize]) -} - -// DecapsulateTo computes the shared key which is encapsulated in ct -// for the private key. -// -// Panics if ct or ss are not of length CiphertextSize and SharedKeySize -// respectively. -func (sk *PrivateKey) DecapsulateTo(ss, ct []byte) { - if len(ct) != CiphertextSize { - panic("ct must be of length CiphertextSize") - } - - if len(ss) != SharedKeySize { - panic("ss must be of length SharedKeySize") - } - - // m' = Kyber.CPAPKE.Dec(sk, ct) - var m2 [32]byte - sk.sk.DecryptTo(m2[:], ct) - - // (K'', r') = G(m' ‖ H(pk)) - var kr2 [64]byte - g := sha3.New512() - g.Write(m2[:]) - g.Write(sk.hpk[:]) - g.Read(kr2[:]) - - // c' = Kyber.CPAPKE.Enc(pk, m', r') - var ct2 [CiphertextSize]byte - sk.pk.EncryptTo(ct2[:], m2[:], kr2[32:]) - - var ss2 [SharedKeySize]byte - - // Compute shared secret in case of rejection: ss₂ = PRF(z ‖ c) - prf := sha3.NewShake256() - prf.Write(sk.z[:]) - prf.Write(ct[:CiphertextSize]) - prf.Read(ss2[:]) - - // Set ss2 to the real shared secret if c = c'. - subtle.ConstantTimeCopy( - subtle.ConstantTimeCompare(ct, ct2[:]), - ss2[:], - kr2[:SharedKeySize], - ) - - copy(ss, ss2[:]) -} - -// Packs sk to buf. -// -// Panics if buf is not of size PrivateKeySize. -func (sk *PrivateKey) Pack(buf []byte) { - if len(buf) != PrivateKeySize { - panic("buf must be of length PrivateKeySize") - } - - sk.sk.Pack(buf[:cpapke.PrivateKeySize]) - buf = buf[cpapke.PrivateKeySize:] - sk.pk.Pack(buf[:cpapke.PublicKeySize]) - buf = buf[cpapke.PublicKeySize:] - copy(buf, sk.hpk[:]) - buf = buf[32:] - copy(buf, sk.z[:]) -} - -// Unpacks sk from buf. -// -// Panics if buf is not of size PrivateKeySize. -// -// Returns an error if buf is not of size PrivateKeySize, or private key -// doesn't pass the ML-KEM decapsulation key check. -func (sk *PrivateKey) Unpack(buf []byte) error { - if len(buf) != PrivateKeySize { - return kem.ErrPrivKeySize - } - - sk.sk = new(cpapke.PrivateKey) - sk.sk.Unpack(buf[:cpapke.PrivateKeySize]) - buf = buf[cpapke.PrivateKeySize:] - sk.pk = new(cpapke.PublicKey) - sk.pk.Unpack(buf[:cpapke.PublicKeySize]) - var hpk [32]byte - h := sha3.New256() - h.Write(buf[:cpapke.PublicKeySize]) - h.Read(hpk[:]) - buf = buf[cpapke.PublicKeySize:] - copy(sk.hpk[:], buf[:32]) - copy(sk.z[:], buf[32:]) - if !bytes.Equal(hpk[:], sk.hpk[:]) { - return kem.ErrPrivKey - } - return nil -} - -// Packs pk to buf. -// -// Panics if buf is not of size PublicKeySize. -func (pk *PublicKey) Pack(buf []byte) { - if len(buf) != PublicKeySize { - panic("buf must be of length PublicKeySize") - } - - pk.pk.Pack(buf) -} - -// Unpacks pk from buf. -// -// Returns an error if buf is not of size PublicKeySize, or the public key -// is not normalized. -func (pk *PublicKey) Unpack(buf []byte) error { - if len(buf) != PublicKeySize { - return kem.ErrPubKeySize - } - - pk.pk = new(cpapke.PublicKey) - if err := pk.pk.UnpackMLKEM(buf); err != nil { - return err - } - - // Compute cached H(pk) - h := sha3.New256() - h.Write(buf) - h.Read(pk.hpk[:]) - - return nil -} - -// Boilerplate down below for the KEM scheme API. - -type scheme struct{} - -var sch kem.Scheme = &scheme{} - -// Scheme returns a KEM interface. -func Scheme() kem.Scheme { return sch } - -func (*scheme) Name() string { return "ML-KEM-768" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SeedSize() int { return KeySeedSize } -func (*scheme) SharedKeySize() int { return SharedKeySize } -func (*scheme) CiphertextSize() int { return CiphertextSize } -func (*scheme) EncapsulationSeedSize() int { return EncapsulationSeedSize } - -func (sk *PrivateKey) Scheme() kem.Scheme { return sch } -func (pk *PublicKey) Scheme() kem.Scheme { return sch } - -func (sk *PrivateKey) MarshalBinary() ([]byte, error) { - var ret [PrivateKeySize]byte - sk.Pack(ret[:]) - return ret[:], nil -} - -func (sk *PrivateKey) Equal(other kem.PrivateKey) bool { - oth, ok := other.(*PrivateKey) - if !ok { - return false - } - if sk.pk == nil && oth.pk == nil { - return true - } - if sk.pk == nil || oth.pk == nil { - return false - } - if !bytes.Equal(sk.hpk[:], oth.hpk[:]) || - subtle.ConstantTimeCompare(sk.z[:], oth.z[:]) != 1 { - return false - } - return sk.sk.Equal(oth.sk) -} - -func (pk *PublicKey) Equal(other kem.PublicKey) bool { - oth, ok := other.(*PublicKey) - if !ok { - return false - } - if pk.pk == nil && oth.pk == nil { - return true - } - if pk.pk == nil || oth.pk == nil { - return false - } - return bytes.Equal(pk.hpk[:], oth.hpk[:]) -} - -func (sk *PrivateKey) Public() kem.PublicKey { - pk := new(PublicKey) - pk.pk = sk.pk - copy(pk.hpk[:], sk.hpk[:]) - return pk -} - -func (pk *PublicKey) MarshalBinary() ([]byte, error) { - var ret [PublicKeySize]byte - pk.Pack(ret[:]) - return ret[:], nil -} - -func (*scheme) GenerateKeyPair() (kem.PublicKey, kem.PrivateKey, error) { - return GenerateKeyPair(cryptoRand.Reader) -} - -func (*scheme) DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) { - if len(seed) != KeySeedSize { - panic(kem.ErrSeedSize) - } - return NewKeyFromSeed(seed[:]) -} - -func (*scheme) Encapsulate(pk kem.PublicKey) (ct, ss []byte, err error) { - ct = make([]byte, CiphertextSize) - ss = make([]byte, SharedKeySize) - - pub, ok := pk.(*PublicKey) - if !ok { - return nil, nil, kem.ErrTypeMismatch - } - pub.EncapsulateTo(ct, ss, nil) - return -} - -func (*scheme) EncapsulateDeterministically(pk kem.PublicKey, seed []byte) ( - ct, ss []byte, err error) { - if len(seed) != EncapsulationSeedSize { - return nil, nil, kem.ErrSeedSize - } - - ct = make([]byte, CiphertextSize) - ss = make([]byte, SharedKeySize) - - pub, ok := pk.(*PublicKey) - if !ok { - return nil, nil, kem.ErrTypeMismatch - } - pub.EncapsulateTo(ct, ss, seed) - return -} - -func (*scheme) Decapsulate(sk kem.PrivateKey, ct []byte) ([]byte, error) { - if len(ct) != CiphertextSize { - return nil, kem.ErrCiphertextSize - } - - priv, ok := sk.(*PrivateKey) - if !ok { - return nil, kem.ErrTypeMismatch - } - ss := make([]byte, SharedKeySize) - priv.DecapsulateTo(ss, ct) - return ss, nil -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (kem.PublicKey, error) { - var ret PublicKey - if err := ret.Unpack(buf); err != nil { - return nil, err - } - return &ret, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (kem.PrivateKey, error) { - if len(buf) != PrivateKeySize { - return nil, kem.ErrPrivKeySize - } - var ret PrivateKey - if err := ret.Unpack(buf); err != nil { - return nil, err - } - return &ret, nil -} diff --git a/backend/vendor/github.com/cloudflare/circl/kem/xwing/scheme.go b/backend/vendor/github.com/cloudflare/circl/kem/xwing/scheme.go deleted file mode 100644 index 6c01477..0000000 --- a/backend/vendor/github.com/cloudflare/circl/kem/xwing/scheme.go +++ /dev/null @@ -1,140 +0,0 @@ -package xwing - -import ( - "bytes" - cryptoRand "crypto/rand" - "crypto/subtle" - - "github.com/cloudflare/circl/kem" - "github.com/cloudflare/circl/kem/mlkem/mlkem768" -) - -// This file contains the boilerplate code to connect X-Wing to the -// generic KEM API. - -// Returns the generic KEM interface for X-Wing PQ/T hybrid KEM. -func Scheme() kem.Scheme { return scheme{} } - -type scheme struct{} - -func (scheme) Name() string { return "X-Wing" } -func (scheme) PublicKeySize() int { return PublicKeySize } -func (scheme) PrivateKeySize() int { return PrivateKeySize } -func (scheme) SeedSize() int { return SeedSize } -func (scheme) EncapsulationSeedSize() int { return EncapsulationSeedSize } -func (scheme) SharedKeySize() int { return SharedKeySize } -func (scheme) CiphertextSize() int { return CiphertextSize } -func (*PrivateKey) Scheme() kem.Scheme { return scheme{} } -func (*PublicKey) Scheme() kem.Scheme { return scheme{} } - -func (sch scheme) Encapsulate(pk kem.PublicKey) (ct, ss []byte, err error) { - var seed [EncapsulationSeedSize]byte - _, err = cryptoRand.Read(seed[:]) - if err != nil { - return - } - return sch.EncapsulateDeterministically(pk, seed[:]) -} - -func (scheme) EncapsulateDeterministically( - pk kem.PublicKey, seed []byte, -) ([]byte, []byte, error) { - if len(seed) != EncapsulationSeedSize { - return nil, nil, kem.ErrSeedSize - } - pub, ok := pk.(*PublicKey) - if !ok { - return nil, nil, kem.ErrTypeMismatch - } - var ( - ct [CiphertextSize]byte - ss [SharedKeySize]byte - ) - pub.EncapsulateTo(ct[:], ss[:], seed) - return ct[:], ss[:], nil -} - -func (scheme) UnmarshalBinaryPublicKey(buf []byte) (kem.PublicKey, error) { - var pk PublicKey - if len(buf) != PublicKeySize { - return nil, kem.ErrPubKeySize - } - - if err := pk.Unpack(buf); err != nil { - return nil, err - } - return &pk, nil -} - -func (scheme) UnmarshalBinaryPrivateKey(buf []byte) (kem.PrivateKey, error) { - var sk PrivateKey - if len(buf) != PrivateKeySize { - return nil, kem.ErrPrivKeySize - } - - sk.Unpack(buf) - return &sk, nil -} - -func (sk *PrivateKey) MarshalBinary() ([]byte, error) { - var ret [PrivateKeySize]byte - sk.Pack(ret[:]) - return ret[:], nil -} - -func (sk *PrivateKey) Equal(other kem.PrivateKey) bool { - oth, ok := other.(*PrivateKey) - if !ok { - return false - } - return sk.m.Equal(&oth.m) && - subtle.ConstantTimeCompare(oth.x[:], sk.x[:]) == 1 -} - -func (sk *PrivateKey) Public() kem.PublicKey { - var pk PublicKey - pk.m = *(sk.m.Public().(*mlkem768.PublicKey)) - pk.x = sk.xpk - return &pk -} - -func (pk *PublicKey) Equal(other kem.PublicKey) bool { - oth, ok := other.(*PublicKey) - if !ok { - return false - } - return pk.m.Equal(&oth.m) && bytes.Equal(pk.x[:], oth.x[:]) -} - -func (pk *PublicKey) MarshalBinary() ([]byte, error) { - var ret [PublicKeySize]byte - pk.Pack(ret[:]) - return ret[:], nil -} - -func (scheme) DeriveKeyPair(seed []byte) (kem.PublicKey, kem.PrivateKey) { - sk, pk := DeriveKeyPair(seed) - return pk, sk -} - -func (scheme) GenerateKeyPair() (kem.PublicKey, kem.PrivateKey, error) { - sk, pk, err := GenerateKeyPair(nil) - return pk, sk, err -} - -func (scheme) Decapsulate(sk kem.PrivateKey, ct []byte) ([]byte, error) { - if len(ct) != CiphertextSize { - return nil, kem.ErrCiphertextSize - } - - var ss [SharedKeySize]byte - - priv, ok := sk.(*PrivateKey) - if !ok { - return nil, kem.ErrTypeMismatch - } - - priv.DecapsulateTo(ss[:], ct[:]) - - return ss[:], nil -} diff --git a/backend/vendor/github.com/cloudflare/circl/kem/xwing/xwing.go b/backend/vendor/github.com/cloudflare/circl/kem/xwing/xwing.go deleted file mode 100644 index e882d50..0000000 --- a/backend/vendor/github.com/cloudflare/circl/kem/xwing/xwing.go +++ /dev/null @@ -1,316 +0,0 @@ -// Package xwing implements the X-Wing PQ/T hybrid KEM -// -// https://datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem -// -// Implements the final version (-05). -package xwing - -import ( - cryptoRand "crypto/rand" - "errors" - "io" - - "github.com/cloudflare/circl/dh/x25519" - "github.com/cloudflare/circl/internal/sha3" - "github.com/cloudflare/circl/kem" - "github.com/cloudflare/circl/kem/mlkem/mlkem768" -) - -// An X-Wing private key. -type PrivateKey struct { - seed [32]byte - m mlkem768.PrivateKey - x x25519.Key - xpk x25519.Key -} - -// An X-Wing public key. -type PublicKey struct { - m mlkem768.PublicKey - x x25519.Key -} - -const ( - // Size of a seed of a keypair - SeedSize = 32 - - // Size of an X-Wing public key - PublicKeySize = 1216 - - // Size of an X-Wing private key - PrivateKeySize = 32 - - // Size of the seed passed to EncapsulateTo - EncapsulationSeedSize = 64 - - // Size of the established shared key - SharedKeySize = 32 - - // Size of an X-Wing ciphertext. - CiphertextSize = 1120 -) - -func combiner( - out []byte, - ssm *[mlkem768.SharedKeySize]byte, - ssx *x25519.Key, - ctx *x25519.Key, - pkx *x25519.Key, -) { - h := sha3.New256() - _, _ = h.Write(ssm[:]) - _, _ = h.Write(ssx[:]) - _, _ = h.Write(ctx[:]) - _, _ = h.Write(pkx[:]) - - // \./ - // /^\ - _, _ = h.Write([]byte(`\.//^\`)) - - _, _ = h.Read(out[:]) -} - -// Packs sk to buf. -// -// Panics if buf is not of size PrivateKeySize -func (sk *PrivateKey) Pack(buf []byte) { - if len(buf) != PrivateKeySize { - panic(kem.ErrPrivKeySize) - } - copy(buf, sk.seed[:]) -} - -// Packs pk to buf. -// -// Panics if buf is not of size PublicKeySize. -func (pk *PublicKey) Pack(buf []byte) { - if len(buf) != PublicKeySize { - panic(kem.ErrPubKeySize) - } - pk.m.Pack(buf[:mlkem768.PublicKeySize]) - copy(buf[mlkem768.PublicKeySize:], pk.x[:]) -} - -// DeriveKeyPair derives a public/private keypair deterministically -// from the given seed. -// -// Panics if seed is not of length SeedSize. -func DeriveKeyPair(seed []byte) (*PrivateKey, *PublicKey) { - var ( - sk PrivateKey - pk PublicKey - ) - - deriveKeyPair(seed, &sk, &pk) - - return &sk, &pk -} - -func deriveKeyPair(seed []byte, sk *PrivateKey, pk *PublicKey) { - if len(seed) != SeedSize { - panic(kem.ErrSeedSize) - } - - var seedm [mlkem768.KeySeedSize]byte - - copy(sk.seed[:], seed) - - h := sha3.NewShake256() - _, _ = h.Write(seed) - _, _ = h.Read(seedm[:]) - _, _ = h.Read(sk.x[:]) - - pkm, skm := mlkem768.NewKeyFromSeed(seedm[:]) - sk.m = *skm - pk.m = *pkm - - x25519.KeyGen(&pk.x, &sk.x) - sk.xpk = pk.x -} - -// DeriveKeyPairPacked derives a keypair like DeriveKeyPair, and -// returns them packed. -func DeriveKeyPairPacked(seed []byte) ([]byte, []byte) { - sk, pk := DeriveKeyPair(seed) - var ( - ppk [PublicKeySize]byte - psk [PrivateKeySize]byte - ) - pk.Pack(ppk[:]) - sk.Pack(psk[:]) - return psk[:], ppk[:] -} - -// GenerateKeyPair generates public and private keys using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKeyPair(rand io.Reader) (*PrivateKey, *PublicKey, error) { - var seed [SeedSize]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - sk, pk := DeriveKeyPair(seed[:]) - return sk, pk, nil -} - -// GenerateKeyPairPacked generates a keypair like GenerateKeyPair, and -// returns them packed. -func GenerateKeyPairPacked(rand io.Reader) ([]byte, []byte, error) { - sk, pk, err := GenerateKeyPair(rand) - if err != nil { - return nil, nil, err - } - var ( - ppk [PublicKeySize]byte - psk [PrivateKeySize]byte - ) - pk.Pack(ppk[:]) - sk.Pack(psk[:]) - return psk[:], ppk[:], nil -} - -// Encapsulate generates a shared key and ciphertext that contains it -// for the public key pk using randomness from seed. -// -// seed may be nil, in which case crypto/rand.Reader is used. -// -// Warning: note that the order of the returned ss and ct matches the -// X-Wing standard, which is the reverse of the Circl KEM API. -// -// Returns ErrPubKey if ML-KEM encapsulation key check fails. -// -// Panics if pk is not of size PublicKeySize, or randomness could not -// be read from crypto/rand.Reader. -func Encapsulate(pk, seed []byte) (ss, ct []byte, err error) { - var pub PublicKey - if err := pub.Unpack(pk); err != nil { - return nil, nil, err - } - ct = make([]byte, CiphertextSize) - ss = make([]byte, SharedKeySize) - pub.EncapsulateTo(ct, ss, seed) - return ss, ct, nil -} - -// Decapsulate computes the shared key which is encapsulated in ct -// for the private key sk. -// -// Panics if sk or ct are not of length PrivateKeySize and CiphertextSize -// respectively. -func Decapsulate(ct, sk []byte) (ss []byte) { - var priv PrivateKey - priv.Unpack(sk) - ss = make([]byte, SharedKeySize) - priv.DecapsulateTo(ss, ct) - return ss -} - -// Raised when passing a byte slice of the wrong size for the shared -// secret to the EncapsulateTo or DecapsulateTo functions. -var ErrSharedKeySize = errors.New("wrong size for shared key") - -// EncapsulateTo generates a shared key and ciphertext that contains it -// for the public key using randomness from seed and writes the shared key -// to ss and ciphertext to ct. -// -// Panics if ss, ct or seed are not of length SharedKeySize, CiphertextSize -// and EncapsulationSeedSize respectively. -// -// seed may be nil, in which case crypto/rand.Reader is used to generate one. -func (pk *PublicKey) EncapsulateTo(ct, ss, seed []byte) { - if seed == nil { - seed = make([]byte, EncapsulationSeedSize) - if _, err := cryptoRand.Read(seed[:]); err != nil { - panic(err) - } - } else { - if len(seed) != EncapsulationSeedSize { - panic(kem.ErrSeedSize) - } - } - - if len(ct) != CiphertextSize { - panic(kem.ErrCiphertextSize) - } - - if len(ss) != SharedKeySize { - panic(ErrSharedKeySize) - } - - var ( - seedm [32]byte - ekx x25519.Key - ctx x25519.Key - ssx x25519.Key - ssm [mlkem768.SharedKeySize]byte - ) - - copy(seedm[:], seed[:32]) - copy(ekx[:], seed[32:]) - - x25519.KeyGen(&ctx, &ekx) - // A peer public key with low order points results in an all-zeroes - // shared secret. Ignored for now pending clarification in the spec, - // https://github.com/dconnolly/draft-connolly-cfrg-xwing-kem/issues/28 - x25519.Shared(&ssx, &ekx, &pk.x) - pk.m.EncapsulateTo(ct[:mlkem768.CiphertextSize], ssm[:], seedm[:]) - - combiner(ss, &ssm, &ssx, &ctx, &pk.x) - copy(ct[mlkem768.CiphertextSize:], ctx[:]) -} - -// DecapsulateTo computes the shared key which is encapsulated in ct -// for the private key. -// -// Panics if ct or ss are not of length CiphertextSize and SharedKeySize -// respectively. -func (sk *PrivateKey) DecapsulateTo(ss, ct []byte) { - if len(ct) != CiphertextSize { - panic(kem.ErrCiphertextSize) - } - if len(ss) != SharedKeySize { - panic(ErrSharedKeySize) - } - - ctm := ct[:mlkem768.CiphertextSize] - - var ( - ssm [mlkem768.SharedKeySize]byte - ssx x25519.Key - ctx x25519.Key - ) - - copy(ctx[:], ct[mlkem768.CiphertextSize:]) - - sk.m.DecapsulateTo(ssm[:], ctm) - // A peer public key with low order points results in an all-zeroes - // shared secret. Ignored for now pending clarification in the spec, - // https://github.com/dconnolly/draft-connolly-cfrg-xwing-kem/issues/28 - x25519.Shared(&ssx, &sk.x, &ctx) - combiner(ss, &ssm, &ssx, &ctx, &sk.xpk) -} - -// Unpacks pk from buf. -// -// Panics if buf is not of size PublicKeySize. -// -// Returns ErrPubKey if pk fails the ML-KEM encapsulation key check. -func (pk *PublicKey) Unpack(buf []byte) error { - if len(buf) != PublicKeySize { - panic(kem.ErrPubKeySize) - } - - copy(pk.x[:], buf[mlkem768.PublicKeySize:]) - return pk.m.Unpack(buf[:mlkem768.PublicKeySize]) -} - -// Unpacks sk from buf. -// -// Panics if buf is not of size PrivateKeySize. -func (sk *PrivateKey) Unpack(buf []byte) { - var pk PublicKey - deriveKeyPair(buf, sk, &pk) -} diff --git a/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp.go b/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp.go deleted file mode 100644 index 57a50ff..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp.go +++ /dev/null @@ -1,205 +0,0 @@ -// Package fp25519 provides prime field arithmetic over GF(2^255-19). -package fp25519 - -import ( - "errors" - - "github.com/cloudflare/circl/internal/conv" -) - -// Size in bytes of an element. -const Size = 32 - -// Elt is a prime field element. -type Elt [Size]byte - -func (e Elt) String() string { return conv.BytesLe2Hex(e[:]) } - -// p is the prime modulus 2^255-19. -var p = Elt{ - 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f, -} - -// P returns the prime modulus 2^255-19. -func P() Elt { return p } - -// ToBytes stores in b the little-endian byte representation of x. -func ToBytes(b []byte, x *Elt) error { - if len(b) != Size { - return errors.New("wrong size") - } - Modp(x) - copy(b, x[:]) - return nil -} - -// IsZero returns true if x is equal to 0. -func IsZero(x *Elt) bool { Modp(x); return *x == Elt{} } - -// SetOne assigns x=1. -func SetOne(x *Elt) { *x = Elt{}; x[0] = 1 } - -// Neg calculates z = -x. -func Neg(z, x *Elt) { Sub(z, &p, x) } - -// InvSqrt calculates z = sqrt(x/y) iff x/y is a quadratic-residue, which is -// indicated by returning isQR = true. Otherwise, when x/y is a quadratic -// non-residue, z will have an undetermined value and isQR = false. -func InvSqrt(z, x, y *Elt) (isQR bool) { - sqrtMinusOne := &Elt{ - 0xb0, 0xa0, 0x0e, 0x4a, 0x27, 0x1b, 0xee, 0xc4, - 0x78, 0xe4, 0x2f, 0xad, 0x06, 0x18, 0x43, 0x2f, - 0xa7, 0xd7, 0xfb, 0x3d, 0x99, 0x00, 0x4d, 0x2b, - 0x0b, 0xdf, 0xc1, 0x4f, 0x80, 0x24, 0x83, 0x2b, - } - t0, t1, t2, t3 := &Elt{}, &Elt{}, &Elt{}, &Elt{} - - Mul(t0, x, y) // t0 = u*v - Sqr(t1, y) // t1 = v^2 - Mul(t2, t0, t1) // t2 = u*v^3 - Sqr(t0, t1) // t0 = v^4 - Mul(t1, t0, t2) // t1 = u*v^7 - - var Tab [4]*Elt - Tab[0] = &Elt{} - Tab[1] = &Elt{} - Tab[2] = t3 - Tab[3] = t1 - - *Tab[0] = *t1 - Sqr(Tab[0], Tab[0]) - Sqr(Tab[1], Tab[0]) - Sqr(Tab[1], Tab[1]) - Mul(Tab[1], Tab[1], Tab[3]) - Mul(Tab[0], Tab[0], Tab[1]) - Sqr(Tab[0], Tab[0]) - Mul(Tab[0], Tab[0], Tab[1]) - Sqr(Tab[1], Tab[0]) - for i := 0; i < 4; i++ { - Sqr(Tab[1], Tab[1]) - } - Mul(Tab[1], Tab[1], Tab[0]) - Sqr(Tab[2], Tab[1]) - for i := 0; i < 4; i++ { - Sqr(Tab[2], Tab[2]) - } - Mul(Tab[2], Tab[2], Tab[0]) - Sqr(Tab[1], Tab[2]) - for i := 0; i < 14; i++ { - Sqr(Tab[1], Tab[1]) - } - Mul(Tab[1], Tab[1], Tab[2]) - Sqr(Tab[2], Tab[1]) - for i := 0; i < 29; i++ { - Sqr(Tab[2], Tab[2]) - } - Mul(Tab[2], Tab[2], Tab[1]) - Sqr(Tab[1], Tab[2]) - for i := 0; i < 59; i++ { - Sqr(Tab[1], Tab[1]) - } - Mul(Tab[1], Tab[1], Tab[2]) - for i := 0; i < 5; i++ { - Sqr(Tab[1], Tab[1]) - } - Mul(Tab[1], Tab[1], Tab[0]) - Sqr(Tab[2], Tab[1]) - for i := 0; i < 124; i++ { - Sqr(Tab[2], Tab[2]) - } - Mul(Tab[2], Tab[2], Tab[1]) - Sqr(Tab[2], Tab[2]) - Sqr(Tab[2], Tab[2]) - Mul(Tab[2], Tab[2], Tab[3]) - - Mul(z, t3, t2) // z = xy^(p+3)/8 = xy^3*(xy^7)^(p-5)/8 - // Checking whether y z^2 == x - Sqr(t0, z) // t0 = z^2 - Mul(t0, t0, y) // t0 = yz^2 - Sub(t1, t0, x) // t1 = t0-u - Add(t2, t0, x) // t2 = t0+u - if IsZero(t1) { - return true - } else if IsZero(t2) { - Mul(z, z, sqrtMinusOne) // z = z*sqrt(-1) - return true - } else { - return false - } -} - -// Inv calculates z = 1/x mod p. -func Inv(z, x *Elt) { - x0, x1, x2 := &Elt{}, &Elt{}, &Elt{} - Sqr(x1, x) - Sqr(x0, x1) - Sqr(x0, x0) - Mul(x0, x0, x) - Mul(z, x0, x1) - Sqr(x1, z) - Mul(x0, x0, x1) - Sqr(x1, x0) - for i := 0; i < 4; i++ { - Sqr(x1, x1) - } - Mul(x0, x0, x1) - Sqr(x1, x0) - for i := 0; i < 9; i++ { - Sqr(x1, x1) - } - Mul(x1, x1, x0) - Sqr(x2, x1) - for i := 0; i < 19; i++ { - Sqr(x2, x2) - } - Mul(x2, x2, x1) - for i := 0; i < 10; i++ { - Sqr(x2, x2) - } - Mul(x2, x2, x0) - Sqr(x0, x2) - for i := 0; i < 49; i++ { - Sqr(x0, x0) - } - Mul(x0, x0, x2) - Sqr(x1, x0) - for i := 0; i < 99; i++ { - Sqr(x1, x1) - } - Mul(x1, x1, x0) - for i := 0; i < 50; i++ { - Sqr(x1, x1) - } - Mul(x1, x1, x2) - for i := 0; i < 5; i++ { - Sqr(x1, x1) - } - Mul(z, z, x1) -} - -// Cmov assigns y to x if n is 1. -func Cmov(x, y *Elt, n uint) { cmov(x, y, n) } - -// Cswap interchanges x and y if n is 1. -func Cswap(x, y *Elt, n uint) { cswap(x, y, n) } - -// Add calculates z = x+y mod p. -func Add(z, x, y *Elt) { add(z, x, y) } - -// Sub calculates z = x-y mod p. -func Sub(z, x, y *Elt) { sub(z, x, y) } - -// AddSub calculates (x,y) = (x+y mod p, x-y mod p). -func AddSub(x, y *Elt) { addsub(x, y) } - -// Mul calculates z = x*y mod p. -func Mul(z, x, y *Elt) { mul(z, x, y) } - -// Sqr calculates z = x^2 mod p. -func Sqr(z, x *Elt) { sqr(z, x) } - -// Modp ensures that z is between [0,p-1]. -func Modp(z *Elt) { modp(z) } diff --git a/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.go b/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.go deleted file mode 100644 index 057f0d2..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.go +++ /dev/null @@ -1,45 +0,0 @@ -//go:build amd64 && !purego -// +build amd64,!purego - -package fp25519 - -import ( - "golang.org/x/sys/cpu" -) - -var hasBmi2Adx = cpu.X86.HasBMI2 && cpu.X86.HasADX - -var _ = hasBmi2Adx - -func cmov(x, y *Elt, n uint) { cmovAmd64(x, y, n) } -func cswap(x, y *Elt, n uint) { cswapAmd64(x, y, n) } -func add(z, x, y *Elt) { addAmd64(z, x, y) } -func sub(z, x, y *Elt) { subAmd64(z, x, y) } -func addsub(x, y *Elt) { addsubAmd64(x, y) } -func mul(z, x, y *Elt) { mulAmd64(z, x, y) } -func sqr(z, x *Elt) { sqrAmd64(z, x) } -func modp(z *Elt) { modpAmd64(z) } - -//go:noescape -func cmovAmd64(x, y *Elt, n uint) - -//go:noescape -func cswapAmd64(x, y *Elt, n uint) - -//go:noescape -func addAmd64(z, x, y *Elt) - -//go:noescape -func subAmd64(z, x, y *Elt) - -//go:noescape -func addsubAmd64(x, y *Elt) - -//go:noescape -func mulAmd64(z, x, y *Elt) - -//go:noescape -func sqrAmd64(z, x *Elt) - -//go:noescape -func modpAmd64(z *Elt) diff --git a/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.h b/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.h deleted file mode 100644 index b884b58..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp_amd64.h +++ /dev/null @@ -1,351 +0,0 @@ -// This code was imported from https://github.com/armfazh/rfc7748_precomputed - -// CHECK_BMI2ADX triggers bmi2adx if supported, -// otherwise it fallbacks to legacy code. -#define CHECK_BMI2ADX(label, legacy, bmi2adx) \ - CMPB ·hasBmi2Adx(SB), $0 \ - JE label \ - bmi2adx \ - RET \ - label: \ - legacy \ - RET - -// cselect is a conditional move -// if b=1: it copies y into x; -// if b=0: x remains with the same value; -// if b<> 0,1: undefined. -// Uses: AX, DX, FLAGS -// Instr: x86_64, cmov -#define cselect(x,y,b) \ - TESTQ b, b \ - MOVQ 0+x, AX; MOVQ 0+y, DX; CMOVQNE DX, AX; MOVQ AX, 0+x; \ - MOVQ 8+x, AX; MOVQ 8+y, DX; CMOVQNE DX, AX; MOVQ AX, 8+x; \ - MOVQ 16+x, AX; MOVQ 16+y, DX; CMOVQNE DX, AX; MOVQ AX, 16+x; \ - MOVQ 24+x, AX; MOVQ 24+y, DX; CMOVQNE DX, AX; MOVQ AX, 24+x; - -// cswap is a conditional swap -// if b=1: x,y <- y,x; -// if b=0: x,y remain with the same values; -// if b<> 0,1: undefined. -// Uses: AX, DX, R8, FLAGS -// Instr: x86_64, cmov -#define cswap(x,y,b) \ - TESTQ b, b \ - MOVQ 0+x, AX; MOVQ AX, R8; MOVQ 0+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 0+x; MOVQ DX, 0+y; \ - MOVQ 8+x, AX; MOVQ AX, R8; MOVQ 8+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 8+x; MOVQ DX, 8+y; \ - MOVQ 16+x, AX; MOVQ AX, R8; MOVQ 16+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 16+x; MOVQ DX, 16+y; \ - MOVQ 24+x, AX; MOVQ AX, R8; MOVQ 24+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 24+x; MOVQ DX, 24+y; - -// additionLeg adds x and y and stores in z -// Uses: AX, DX, R8-R11, FLAGS -// Instr: x86_64, cmov -#define additionLeg(z,x,y) \ - MOVL $38, AX; \ - MOVL $0, DX; \ - MOVQ 0+x, R8; ADDQ 0+y, R8; \ - MOVQ 8+x, R9; ADCQ 8+y, R9; \ - MOVQ 16+x, R10; ADCQ 16+y, R10; \ - MOVQ 24+x, R11; ADCQ 24+y, R11; \ - CMOVQCS AX, DX; \ - ADDQ DX, R8; \ - ADCQ $0, R9; MOVQ R9, 8+z; \ - ADCQ $0, R10; MOVQ R10, 16+z; \ - ADCQ $0, R11; MOVQ R11, 24+z; \ - MOVL $0, DX; \ - CMOVQCS AX, DX; \ - ADDQ DX, R8; MOVQ R8, 0+z; - -// additionAdx adds x and y and stores in z -// Uses: AX, DX, R8-R11, FLAGS -// Instr: x86_64, cmov, adx -#define additionAdx(z,x,y) \ - MOVL $38, AX; \ - XORL DX, DX; \ - MOVQ 0+x, R8; ADCXQ 0+y, R8; \ - MOVQ 8+x, R9; ADCXQ 8+y, R9; \ - MOVQ 16+x, R10; ADCXQ 16+y, R10; \ - MOVQ 24+x, R11; ADCXQ 24+y, R11; \ - CMOVQCS AX, DX ; \ - XORL AX, AX; \ - ADCXQ DX, R8; \ - ADCXQ AX, R9; MOVQ R9, 8+z; \ - ADCXQ AX, R10; MOVQ R10, 16+z; \ - ADCXQ AX, R11; MOVQ R11, 24+z; \ - MOVL $38, DX; \ - CMOVQCS DX, AX; \ - ADDQ AX, R8; MOVQ R8, 0+z; - -// subtraction subtracts y from x and stores in z -// Uses: AX, DX, R8-R11, FLAGS -// Instr: x86_64, cmov -#define subtraction(z,x,y) \ - MOVL $38, AX; \ - MOVQ 0+x, R8; SUBQ 0+y, R8; \ - MOVQ 8+x, R9; SBBQ 8+y, R9; \ - MOVQ 16+x, R10; SBBQ 16+y, R10; \ - MOVQ 24+x, R11; SBBQ 24+y, R11; \ - MOVL $0, DX; \ - CMOVQCS AX, DX; \ - SUBQ DX, R8; \ - SBBQ $0, R9; MOVQ R9, 8+z; \ - SBBQ $0, R10; MOVQ R10, 16+z; \ - SBBQ $0, R11; MOVQ R11, 24+z; \ - MOVL $0, DX; \ - CMOVQCS AX, DX; \ - SUBQ DX, R8; MOVQ R8, 0+z; - -// integerMulAdx multiplies x and y and stores in z -// Uses: AX, DX, R8-R15, FLAGS -// Instr: x86_64, bmi2, adx -#define integerMulAdx(z,x,y) \ - MOVL $0,R15; \ - MOVQ 0+y, DX; XORL AX, AX; \ - MULXQ 0+x, AX, R8; MOVQ AX, 0+z; \ - MULXQ 8+x, AX, R9; ADCXQ AX, R8; \ - MULXQ 16+x, AX, R10; ADCXQ AX, R9; \ - MULXQ 24+x, AX, R11; ADCXQ AX, R10; \ - MOVL $0, AX;;;;;;;;; ADCXQ AX, R11; \ - MOVQ 8+y, DX; XORL AX, AX; \ - MULXQ 0+x, AX, R12; ADCXQ R8, AX; MOVQ AX, 8+z; \ - MULXQ 8+x, AX, R13; ADCXQ R9, R12; ADOXQ AX, R12; \ - MULXQ 16+x, AX, R14; ADCXQ R10, R13; ADOXQ AX, R13; \ - MULXQ 24+x, AX, R15; ADCXQ R11, R14; ADOXQ AX, R14; \ - MOVL $0, AX;;;;;;;;; ADCXQ AX, R15; ADOXQ AX, R15; \ - MOVQ 16+y, DX; XORL AX, AX; \ - MULXQ 0+x, AX, R8; ADCXQ R12, AX; MOVQ AX, 16+z; \ - MULXQ 8+x, AX, R9; ADCXQ R13, R8; ADOXQ AX, R8; \ - MULXQ 16+x, AX, R10; ADCXQ R14, R9; ADOXQ AX, R9; \ - MULXQ 24+x, AX, R11; ADCXQ R15, R10; ADOXQ AX, R10; \ - MOVL $0, AX;;;;;;;;; ADCXQ AX, R11; ADOXQ AX, R11; \ - MOVQ 24+y, DX; XORL AX, AX; \ - MULXQ 0+x, AX, R12; ADCXQ R8, AX; MOVQ AX, 24+z; \ - MULXQ 8+x, AX, R13; ADCXQ R9, R12; ADOXQ AX, R12; MOVQ R12, 32+z; \ - MULXQ 16+x, AX, R14; ADCXQ R10, R13; ADOXQ AX, R13; MOVQ R13, 40+z; \ - MULXQ 24+x, AX, R15; ADCXQ R11, R14; ADOXQ AX, R14; MOVQ R14, 48+z; \ - MOVL $0, AX;;;;;;;;; ADCXQ AX, R15; ADOXQ AX, R15; MOVQ R15, 56+z; - -// integerMulLeg multiplies x and y and stores in z -// Uses: AX, DX, R8-R15, FLAGS -// Instr: x86_64 -#define integerMulLeg(z,x,y) \ - MOVQ 0+y, R8; \ - MOVQ 0+x, AX; MULQ R8; MOVQ AX, 0+z; MOVQ DX, R15; \ - MOVQ 8+x, AX; MULQ R8; MOVQ AX, R13; MOVQ DX, R10; \ - MOVQ 16+x, AX; MULQ R8; MOVQ AX, R14; MOVQ DX, R11; \ - MOVQ 24+x, AX; MULQ R8; \ - ADDQ R13, R15; \ - ADCQ R14, R10; MOVQ R10, 16+z; \ - ADCQ AX, R11; MOVQ R11, 24+z; \ - ADCQ $0, DX; MOVQ DX, 32+z; \ - MOVQ 8+y, R8; \ - MOVQ 0+x, AX; MULQ R8; MOVQ AX, R12; MOVQ DX, R9; \ - MOVQ 8+x, AX; MULQ R8; MOVQ AX, R13; MOVQ DX, R10; \ - MOVQ 16+x, AX; MULQ R8; MOVQ AX, R14; MOVQ DX, R11; \ - MOVQ 24+x, AX; MULQ R8; \ - ADDQ R12, R15; MOVQ R15, 8+z; \ - ADCQ R13, R9; \ - ADCQ R14, R10; \ - ADCQ AX, R11; \ - ADCQ $0, DX; \ - ADCQ 16+z, R9; MOVQ R9, R15; \ - ADCQ 24+z, R10; MOVQ R10, 24+z; \ - ADCQ 32+z, R11; MOVQ R11, 32+z; \ - ADCQ $0, DX; MOVQ DX, 40+z; \ - MOVQ 16+y, R8; \ - MOVQ 0+x, AX; MULQ R8; MOVQ AX, R12; MOVQ DX, R9; \ - MOVQ 8+x, AX; MULQ R8; MOVQ AX, R13; MOVQ DX, R10; \ - MOVQ 16+x, AX; MULQ R8; MOVQ AX, R14; MOVQ DX, R11; \ - MOVQ 24+x, AX; MULQ R8; \ - ADDQ R12, R15; MOVQ R15, 16+z; \ - ADCQ R13, R9; \ - ADCQ R14, R10; \ - ADCQ AX, R11; \ - ADCQ $0, DX; \ - ADCQ 24+z, R9; MOVQ R9, R15; \ - ADCQ 32+z, R10; MOVQ R10, 32+z; \ - ADCQ 40+z, R11; MOVQ R11, 40+z; \ - ADCQ $0, DX; MOVQ DX, 48+z; \ - MOVQ 24+y, R8; \ - MOVQ 0+x, AX; MULQ R8; MOVQ AX, R12; MOVQ DX, R9; \ - MOVQ 8+x, AX; MULQ R8; MOVQ AX, R13; MOVQ DX, R10; \ - MOVQ 16+x, AX; MULQ R8; MOVQ AX, R14; MOVQ DX, R11; \ - MOVQ 24+x, AX; MULQ R8; \ - ADDQ R12, R15; MOVQ R15, 24+z; \ - ADCQ R13, R9; \ - ADCQ R14, R10; \ - ADCQ AX, R11; \ - ADCQ $0, DX; \ - ADCQ 32+z, R9; MOVQ R9, 32+z; \ - ADCQ 40+z, R10; MOVQ R10, 40+z; \ - ADCQ 48+z, R11; MOVQ R11, 48+z; \ - ADCQ $0, DX; MOVQ DX, 56+z; - -// integerSqrLeg squares x and stores in z -// Uses: AX, CX, DX, R8-R15, FLAGS -// Instr: x86_64 -#define integerSqrLeg(z,x) \ - MOVQ 0+x, R8; \ - MOVQ 8+x, AX; MULQ R8; MOVQ AX, R9; MOVQ DX, R10; /* A[0]*A[1] */ \ - MOVQ 16+x, AX; MULQ R8; MOVQ AX, R14; MOVQ DX, R11; /* A[0]*A[2] */ \ - MOVQ 24+x, AX; MULQ R8; MOVQ AX, R15; MOVQ DX, R12; /* A[0]*A[3] */ \ - MOVQ 24+x, R8; \ - MOVQ 8+x, AX; MULQ R8; MOVQ AX, CX; MOVQ DX, R13; /* A[3]*A[1] */ \ - MOVQ 16+x, AX; MULQ R8; /* A[3]*A[2] */ \ - \ - ADDQ R14, R10;\ - ADCQ R15, R11; MOVL $0, R15;\ - ADCQ CX, R12;\ - ADCQ AX, R13;\ - ADCQ $0, DX; MOVQ DX, R14;\ - MOVQ 8+x, AX; MULQ 16+x;\ - \ - ADDQ AX, R11;\ - ADCQ DX, R12;\ - ADCQ $0, R13;\ - ADCQ $0, R14;\ - ADCQ $0, R15;\ - \ - SHLQ $1, R14, R15; MOVQ R15, 56+z;\ - SHLQ $1, R13, R14; MOVQ R14, 48+z;\ - SHLQ $1, R12, R13; MOVQ R13, 40+z;\ - SHLQ $1, R11, R12; MOVQ R12, 32+z;\ - SHLQ $1, R10, R11; MOVQ R11, 24+z;\ - SHLQ $1, R9, R10; MOVQ R10, 16+z;\ - SHLQ $1, R9; MOVQ R9, 8+z;\ - \ - MOVQ 0+x,AX; MULQ AX; MOVQ AX, 0+z; MOVQ DX, R9;\ - MOVQ 8+x,AX; MULQ AX; MOVQ AX, R10; MOVQ DX, R11;\ - MOVQ 16+x,AX; MULQ AX; MOVQ AX, R12; MOVQ DX, R13;\ - MOVQ 24+x,AX; MULQ AX; MOVQ AX, R14; MOVQ DX, R15;\ - \ - ADDQ 8+z, R9; MOVQ R9, 8+z;\ - ADCQ 16+z, R10; MOVQ R10, 16+z;\ - ADCQ 24+z, R11; MOVQ R11, 24+z;\ - ADCQ 32+z, R12; MOVQ R12, 32+z;\ - ADCQ 40+z, R13; MOVQ R13, 40+z;\ - ADCQ 48+z, R14; MOVQ R14, 48+z;\ - ADCQ 56+z, R15; MOVQ R15, 56+z; - -// integerSqrAdx squares x and stores in z -// Uses: AX, CX, DX, R8-R15, FLAGS -// Instr: x86_64, bmi2, adx -#define integerSqrAdx(z,x) \ - MOVQ 0+x, DX; /* A[0] */ \ - MULXQ 8+x, R8, R14; /* A[1]*A[0] */ XORL R15, R15; \ - MULXQ 16+x, R9, R10; /* A[2]*A[0] */ ADCXQ R14, R9; \ - MULXQ 24+x, AX, CX; /* A[3]*A[0] */ ADCXQ AX, R10; \ - MOVQ 24+x, DX; /* A[3] */ \ - MULXQ 8+x, R11, R12; /* A[1]*A[3] */ ADCXQ CX, R11; \ - MULXQ 16+x, AX, R13; /* A[2]*A[3] */ ADCXQ AX, R12; \ - MOVQ 8+x, DX; /* A[1] */ ADCXQ R15, R13; \ - MULXQ 16+x, AX, CX; /* A[2]*A[1] */ MOVL $0, R14; \ - ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ADCXQ R15, R14; \ - XORL R15, R15; \ - ADOXQ AX, R10; ADCXQ R8, R8; \ - ADOXQ CX, R11; ADCXQ R9, R9; \ - ADOXQ R15, R12; ADCXQ R10, R10; \ - ADOXQ R15, R13; ADCXQ R11, R11; \ - ADOXQ R15, R14; ADCXQ R12, R12; \ - ;;;;;;;;;;;;;;; ADCXQ R13, R13; \ - ;;;;;;;;;;;;;;; ADCXQ R14, R14; \ - MOVQ 0+x, DX; MULXQ DX, AX, CX; /* A[0]^2 */ \ - ;;;;;;;;;;;;;;; MOVQ AX, 0+z; \ - ADDQ CX, R8; MOVQ R8, 8+z; \ - MOVQ 8+x, DX; MULXQ DX, AX, CX; /* A[1]^2 */ \ - ADCQ AX, R9; MOVQ R9, 16+z; \ - ADCQ CX, R10; MOVQ R10, 24+z; \ - MOVQ 16+x, DX; MULXQ DX, AX, CX; /* A[2]^2 */ \ - ADCQ AX, R11; MOVQ R11, 32+z; \ - ADCQ CX, R12; MOVQ R12, 40+z; \ - MOVQ 24+x, DX; MULXQ DX, AX, CX; /* A[3]^2 */ \ - ADCQ AX, R13; MOVQ R13, 48+z; \ - ADCQ CX, R14; MOVQ R14, 56+z; - -// reduceFromDouble finds z congruent to x modulo p such that 0> 63) - // PUT BIT 255 IN CARRY FLAG AND CLEAR - x3 &^= 1 << 63 - - x0, c0 := bits.Add64(x0, cx, 0) - x1, c1 := bits.Add64(x1, 0, c0) - x2, c2 := bits.Add64(x2, 0, c1) - x3, _ = bits.Add64(x3, 0, c2) - - // TEST FOR BIT 255 AGAIN; ONLY TRIGGERED ON OVERFLOW MODULO 2^255-19 - // cx = C[255] ? 0 : 19 - cx = uint64(19) &^ (-(x3 >> 63)) - // CLEAR BIT 255 - x3 &^= 1 << 63 - - x0, c0 = bits.Sub64(x0, cx, 0) - x1, c1 = bits.Sub64(x1, 0, c0) - x2, c2 = bits.Sub64(x2, 0, c1) - x3, _ = bits.Sub64(x3, 0, c2) - - binary.LittleEndian.PutUint64(x[0*8:1*8], x0) - binary.LittleEndian.PutUint64(x[1*8:2*8], x1) - binary.LittleEndian.PutUint64(x[2*8:3*8], x2) - binary.LittleEndian.PutUint64(x[3*8:4*8], x3) -} - -func red64(z *Elt, x0, x1, x2, x3, x4, x5, x6, x7 uint64) { - h0, l0 := bits.Mul64(x4, 38) - h1, l1 := bits.Mul64(x5, 38) - h2, l2 := bits.Mul64(x6, 38) - h3, l3 := bits.Mul64(x7, 38) - - l1, c0 := bits.Add64(h0, l1, 0) - l2, c1 := bits.Add64(h1, l2, c0) - l3, c2 := bits.Add64(h2, l3, c1) - l4, _ := bits.Add64(h3, 0, c2) - - l0, c0 = bits.Add64(l0, x0, 0) - l1, c1 = bits.Add64(l1, x1, c0) - l2, c2 = bits.Add64(l2, x2, c1) - l3, c3 := bits.Add64(l3, x3, c2) - l4, _ = bits.Add64(l4, 0, c3) - - _, l4 = bits.Mul64(l4, 38) - l0, c0 = bits.Add64(l0, l4, 0) - z1, c1 := bits.Add64(l1, 0, c0) - z2, c2 := bits.Add64(l2, 0, c1) - z3, c3 := bits.Add64(l3, 0, c2) - z0, _ := bits.Add64(l0, (-c3)&38, 0) - - binary.LittleEndian.PutUint64(z[0*8:1*8], z0) - binary.LittleEndian.PutUint64(z[1*8:2*8], z1) - binary.LittleEndian.PutUint64(z[2*8:3*8], z2) - binary.LittleEndian.PutUint64(z[3*8:4*8], z3) -} diff --git a/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp_noasm.go b/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp_noasm.go deleted file mode 100644 index 26ca4d0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/fp25519/fp_noasm.go +++ /dev/null @@ -1,13 +0,0 @@ -//go:build !amd64 || purego -// +build !amd64 purego - -package fp25519 - -func cmov(x, y *Elt, n uint) { cmovGeneric(x, y, n) } -func cswap(x, y *Elt, n uint) { cswapGeneric(x, y, n) } -func add(z, x, y *Elt) { addGeneric(z, x, y) } -func sub(z, x, y *Elt) { subGeneric(z, x, y) } -func addsub(x, y *Elt) { addsubGeneric(x, y) } -func mul(z, x, y *Elt) { mulGeneric(z, x, y) } -func sqr(z, x *Elt) { sqrGeneric(z, x) } -func modp(z *Elt) { modpGeneric(z) } diff --git a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp.go b/backend/vendor/github.com/cloudflare/circl/math/fp448/fp.go deleted file mode 100644 index a5e3660..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp.go +++ /dev/null @@ -1,164 +0,0 @@ -// Package fp448 provides prime field arithmetic over GF(2^448-2^224-1). -package fp448 - -import ( - "errors" - - "github.com/cloudflare/circl/internal/conv" -) - -// Size in bytes of an element. -const Size = 56 - -// Elt is a prime field element. -type Elt [Size]byte - -func (e Elt) String() string { return conv.BytesLe2Hex(e[:]) } - -// p is the prime modulus 2^448-2^224-1. -var p = Elt{ - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, -} - -// P returns the prime modulus 2^448-2^224-1. -func P() Elt { return p } - -// ToBytes stores in b the little-endian byte representation of x. -func ToBytes(b []byte, x *Elt) error { - if len(b) != Size { - return errors.New("wrong size") - } - Modp(x) - copy(b, x[:]) - return nil -} - -// IsZero returns true if x is equal to 0. -func IsZero(x *Elt) bool { Modp(x); return *x == Elt{} } - -// IsOne returns true if x is equal to 1. -func IsOne(x *Elt) bool { Modp(x); return *x == Elt{1} } - -// SetOne assigns x=1. -func SetOne(x *Elt) { *x = Elt{1} } - -// One returns the 1 element. -func One() (x Elt) { x = Elt{1}; return } - -// Neg calculates z = -x. -func Neg(z, x *Elt) { Sub(z, &p, x) } - -// Modp ensures that z is between [0,p-1]. -func Modp(z *Elt) { Sub(z, z, &p) } - -// InvSqrt calculates z = sqrt(x/y) iff x/y is a quadratic-residue. If so, -// isQR = true; otherwise, isQR = false, since x/y is a quadratic non-residue, -// and z = sqrt(-x/y). -func InvSqrt(z, x, y *Elt) (isQR bool) { - // First note that x^(2(k+1)) = x^(p-1)/2 * x = legendre(x) * x - // so that's x if x is a quadratic residue and -x otherwise. - // Next, y^(6k+3) = y^(4k+2) * y^(2k+1) = y^(p-1) * y^((p-1)/2) = legendre(y). - // So the z we compute satisfies z^2 y = x^(2(k+1)) y^(6k+3) = legendre(x)*legendre(y). - // Thus if x and y are quadratic residues, then z is indeed sqrt(x/y). - t0, t1 := &Elt{}, &Elt{} - Mul(t0, x, y) // x*y - Sqr(t1, y) // y^2 - Mul(t1, t0, t1) // x*y^3 - powPminus3div4(z, t1) // (x*y^3)^k - Mul(z, z, t0) // z = x*y*(x*y^3)^k = x^(k+1) * y^(3k+1) - - // Check if x/y is a quadratic residue - Sqr(t0, z) // z^2 - Mul(t0, t0, y) // y*z^2 - Sub(t0, t0, x) // y*z^2-x - return IsZero(t0) -} - -// Inv calculates z = 1/x mod p. -func Inv(z, x *Elt) { - // Calculates z = x^(4k+1) = x^(p-3+1) = x^(p-2) = x^-1, where k = (p-3)/4. - t := &Elt{} - powPminus3div4(t, x) // t = x^k - Sqr(t, t) // t = x^2k - Sqr(t, t) // t = x^4k - Mul(z, t, x) // z = x^(4k+1) -} - -// powPminus3div4 calculates z = x^k mod p, where k = (p-3)/4. -func powPminus3div4(z, x *Elt) { - x0, x1 := &Elt{}, &Elt{} - Sqr(z, x) - Mul(z, z, x) - Sqr(x0, z) - Mul(x0, x0, x) - Sqr(z, x0) - Sqr(z, z) - Sqr(z, z) - Mul(z, z, x0) - Sqr(x1, z) - for i := 0; i < 5; i++ { - Sqr(x1, x1) - } - Mul(x1, x1, z) - Sqr(z, x1) - for i := 0; i < 11; i++ { - Sqr(z, z) - } - Mul(z, z, x1) - Sqr(z, z) - Sqr(z, z) - Sqr(z, z) - Mul(z, z, x0) - Sqr(x1, z) - for i := 0; i < 26; i++ { - Sqr(x1, x1) - } - Mul(x1, x1, z) - Sqr(z, x1) - for i := 0; i < 53; i++ { - Sqr(z, z) - } - Mul(z, z, x1) - Sqr(z, z) - Sqr(z, z) - Sqr(z, z) - Mul(z, z, x0) - Sqr(x1, z) - for i := 0; i < 110; i++ { - Sqr(x1, x1) - } - Mul(x1, x1, z) - Sqr(z, x1) - Mul(z, z, x) - for i := 0; i < 223; i++ { - Sqr(z, z) - } - Mul(z, z, x1) -} - -// Cmov assigns y to x if n is 1. -func Cmov(x, y *Elt, n uint) { cmov(x, y, n) } - -// Cswap interchanges x and y if n is 1. -func Cswap(x, y *Elt, n uint) { cswap(x, y, n) } - -// Add calculates z = x+y mod p. -func Add(z, x, y *Elt) { add(z, x, y) } - -// Sub calculates z = x-y mod p. -func Sub(z, x, y *Elt) { sub(z, x, y) } - -// AddSub calculates (x,y) = (x+y mod p, x-y mod p). -func AddSub(x, y *Elt) { addsub(x, y) } - -// Mul calculates z = x*y mod p. -func Mul(z, x, y *Elt) { mul(z, x, y) } - -// Sqr calculates z = x^2 mod p. -func Sqr(z, x *Elt) { sqr(z, x) } diff --git a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.go b/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.go deleted file mode 100644 index 6a12209..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.go +++ /dev/null @@ -1,43 +0,0 @@ -//go:build amd64 && !purego -// +build amd64,!purego - -package fp448 - -import ( - "golang.org/x/sys/cpu" -) - -var hasBmi2Adx = cpu.X86.HasBMI2 && cpu.X86.HasADX - -var _ = hasBmi2Adx - -func cmov(x, y *Elt, n uint) { cmovAmd64(x, y, n) } -func cswap(x, y *Elt, n uint) { cswapAmd64(x, y, n) } -func add(z, x, y *Elt) { addAmd64(z, x, y) } -func sub(z, x, y *Elt) { subAmd64(z, x, y) } -func addsub(x, y *Elt) { addsubAmd64(x, y) } -func mul(z, x, y *Elt) { mulAmd64(z, x, y) } -func sqr(z, x *Elt) { sqrAmd64(z, x) } - -/* Functions defined in fp_amd64.s */ - -//go:noescape -func cmovAmd64(x, y *Elt, n uint) - -//go:noescape -func cswapAmd64(x, y *Elt, n uint) - -//go:noescape -func addAmd64(z, x, y *Elt) - -//go:noescape -func subAmd64(z, x, y *Elt) - -//go:noescape -func addsubAmd64(x, y *Elt) - -//go:noescape -func mulAmd64(z, x, y *Elt) - -//go:noescape -func sqrAmd64(z, x *Elt) diff --git a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.h b/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.h deleted file mode 100644 index 536fe5b..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.h +++ /dev/null @@ -1,591 +0,0 @@ -// This code was imported from https://github.com/armfazh/rfc7748_precomputed - -// CHECK_BMI2ADX triggers bmi2adx if supported, -// otherwise it fallbacks to legacy code. -#define CHECK_BMI2ADX(label, legacy, bmi2adx) \ - CMPB ·hasBmi2Adx(SB), $0 \ - JE label \ - bmi2adx \ - RET \ - label: \ - legacy \ - RET - -// cselect is a conditional move -// if b=1: it copies y into x; -// if b=0: x remains with the same value; -// if b<> 0,1: undefined. -// Uses: AX, DX, FLAGS -// Instr: x86_64, cmov -#define cselect(x,y,b) \ - TESTQ b, b \ - MOVQ 0+x, AX; MOVQ 0+y, DX; CMOVQNE DX, AX; MOVQ AX, 0+x; \ - MOVQ 8+x, AX; MOVQ 8+y, DX; CMOVQNE DX, AX; MOVQ AX, 8+x; \ - MOVQ 16+x, AX; MOVQ 16+y, DX; CMOVQNE DX, AX; MOVQ AX, 16+x; \ - MOVQ 24+x, AX; MOVQ 24+y, DX; CMOVQNE DX, AX; MOVQ AX, 24+x; \ - MOVQ 32+x, AX; MOVQ 32+y, DX; CMOVQNE DX, AX; MOVQ AX, 32+x; \ - MOVQ 40+x, AX; MOVQ 40+y, DX; CMOVQNE DX, AX; MOVQ AX, 40+x; \ - MOVQ 48+x, AX; MOVQ 48+y, DX; CMOVQNE DX, AX; MOVQ AX, 48+x; - -// cswap is a conditional swap -// if b=1: x,y <- y,x; -// if b=0: x,y remain with the same values; -// if b<> 0,1: undefined. -// Uses: AX, DX, R8, FLAGS -// Instr: x86_64, cmov -#define cswap(x,y,b) \ - TESTQ b, b \ - MOVQ 0+x, AX; MOVQ AX, R8; MOVQ 0+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 0+x; MOVQ DX, 0+y; \ - MOVQ 8+x, AX; MOVQ AX, R8; MOVQ 8+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 8+x; MOVQ DX, 8+y; \ - MOVQ 16+x, AX; MOVQ AX, R8; MOVQ 16+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 16+x; MOVQ DX, 16+y; \ - MOVQ 24+x, AX; MOVQ AX, R8; MOVQ 24+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 24+x; MOVQ DX, 24+y; \ - MOVQ 32+x, AX; MOVQ AX, R8; MOVQ 32+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 32+x; MOVQ DX, 32+y; \ - MOVQ 40+x, AX; MOVQ AX, R8; MOVQ 40+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 40+x; MOVQ DX, 40+y; \ - MOVQ 48+x, AX; MOVQ AX, R8; MOVQ 48+y, DX; CMOVQNE DX, AX; CMOVQNE R8, DX; MOVQ AX, 48+x; MOVQ DX, 48+y; - -// additionLeg adds x and y and stores in z -// Uses: AX, DX, R8-R14, FLAGS -// Instr: x86_64 -#define additionLeg(z,x,y) \ - MOVQ 0+x, R8; ADDQ 0+y, R8; \ - MOVQ 8+x, R9; ADCQ 8+y, R9; \ - MOVQ 16+x, R10; ADCQ 16+y, R10; \ - MOVQ 24+x, R11; ADCQ 24+y, R11; \ - MOVQ 32+x, R12; ADCQ 32+y, R12; \ - MOVQ 40+x, R13; ADCQ 40+y, R13; \ - MOVQ 48+x, R14; ADCQ 48+y, R14; \ - MOVQ $0, AX; ADCQ $0, AX; \ - MOVQ AX, DX; \ - SHLQ $32, DX; \ - ADDQ AX, R8; MOVQ $0, AX; \ - ADCQ $0, R9; \ - ADCQ $0, R10; \ - ADCQ DX, R11; \ - ADCQ $0, R12; \ - ADCQ $0, R13; \ - ADCQ $0, R14; \ - ADCQ $0, AX; \ - MOVQ AX, DX; \ - SHLQ $32, DX; \ - ADDQ AX, R8; MOVQ R8, 0+z; \ - ADCQ $0, R9; MOVQ R9, 8+z; \ - ADCQ $0, R10; MOVQ R10, 16+z; \ - ADCQ DX, R11; MOVQ R11, 24+z; \ - ADCQ $0, R12; MOVQ R12, 32+z; \ - ADCQ $0, R13; MOVQ R13, 40+z; \ - ADCQ $0, R14; MOVQ R14, 48+z; - - -// additionAdx adds x and y and stores in z -// Uses: AX, DX, R8-R15, FLAGS -// Instr: x86_64, adx -#define additionAdx(z,x,y) \ - MOVL $32, R15; \ - XORL DX, DX; \ - MOVQ 0+x, R8; ADCXQ 0+y, R8; \ - MOVQ 8+x, R9; ADCXQ 8+y, R9; \ - MOVQ 16+x, R10; ADCXQ 16+y, R10; \ - MOVQ 24+x, R11; ADCXQ 24+y, R11; \ - MOVQ 32+x, R12; ADCXQ 32+y, R12; \ - MOVQ 40+x, R13; ADCXQ 40+y, R13; \ - MOVQ 48+x, R14; ADCXQ 48+y, R14; \ - ;;;;;;;;;;;;;;; ADCXQ DX, DX; \ - XORL AX, AX; \ - ADCXQ DX, R8; SHLXQ R15, DX, DX; \ - ADCXQ AX, R9; \ - ADCXQ AX, R10; \ - ADCXQ DX, R11; \ - ADCXQ AX, R12; \ - ADCXQ AX, R13; \ - ADCXQ AX, R14; \ - ADCXQ AX, AX; \ - XORL DX, DX; \ - ADCXQ AX, R8; MOVQ R8, 0+z; SHLXQ R15, AX, AX; \ - ADCXQ DX, R9; MOVQ R9, 8+z; \ - ADCXQ DX, R10; MOVQ R10, 16+z; \ - ADCXQ AX, R11; MOVQ R11, 24+z; \ - ADCXQ DX, R12; MOVQ R12, 32+z; \ - ADCXQ DX, R13; MOVQ R13, 40+z; \ - ADCXQ DX, R14; MOVQ R14, 48+z; - -// subtraction subtracts y from x and stores in z -// Uses: AX, DX, R8-R14, FLAGS -// Instr: x86_64 -#define subtraction(z,x,y) \ - MOVQ 0+x, R8; SUBQ 0+y, R8; \ - MOVQ 8+x, R9; SBBQ 8+y, R9; \ - MOVQ 16+x, R10; SBBQ 16+y, R10; \ - MOVQ 24+x, R11; SBBQ 24+y, R11; \ - MOVQ 32+x, R12; SBBQ 32+y, R12; \ - MOVQ 40+x, R13; SBBQ 40+y, R13; \ - MOVQ 48+x, R14; SBBQ 48+y, R14; \ - MOVQ $0, AX; SETCS AX; \ - MOVQ AX, DX; \ - SHLQ $32, DX; \ - SUBQ AX, R8; MOVQ $0, AX; \ - SBBQ $0, R9; \ - SBBQ $0, R10; \ - SBBQ DX, R11; \ - SBBQ $0, R12; \ - SBBQ $0, R13; \ - SBBQ $0, R14; \ - SETCS AX; \ - MOVQ AX, DX; \ - SHLQ $32, DX; \ - SUBQ AX, R8; MOVQ R8, 0+z; \ - SBBQ $0, R9; MOVQ R9, 8+z; \ - SBBQ $0, R10; MOVQ R10, 16+z; \ - SBBQ DX, R11; MOVQ R11, 24+z; \ - SBBQ $0, R12; MOVQ R12, 32+z; \ - SBBQ $0, R13; MOVQ R13, 40+z; \ - SBBQ $0, R14; MOVQ R14, 48+z; - -// maddBmi2Adx multiplies x and y and accumulates in z -// Uses: AX, DX, R15, FLAGS -// Instr: x86_64, bmi2, adx -#define maddBmi2Adx(z,x,y,i,r0,r1,r2,r3,r4,r5,r6) \ - MOVQ i+y, DX; XORL AX, AX; \ - MULXQ 0+x, AX, R8; ADOXQ AX, r0; ADCXQ R8, r1; MOVQ r0,i+z; \ - MULXQ 8+x, AX, r0; ADOXQ AX, r1; ADCXQ r0, r2; MOVQ $0, R8; \ - MULXQ 16+x, AX, r0; ADOXQ AX, r2; ADCXQ r0, r3; \ - MULXQ 24+x, AX, r0; ADOXQ AX, r3; ADCXQ r0, r4; \ - MULXQ 32+x, AX, r0; ADOXQ AX, r4; ADCXQ r0, r5; \ - MULXQ 40+x, AX, r0; ADOXQ AX, r5; ADCXQ r0, r6; \ - MULXQ 48+x, AX, r0; ADOXQ AX, r6; ADCXQ R8, r0; \ - ;;;;;;;;;;;;;;;;;;; ADOXQ R8, r0; - -// integerMulAdx multiplies x and y and stores in z -// Uses: AX, DX, R8-R15, FLAGS -// Instr: x86_64, bmi2, adx -#define integerMulAdx(z,x,y) \ - MOVL $0,R15; \ - MOVQ 0+y, DX; XORL AX, AX; MOVQ $0, R8; \ - MULXQ 0+x, AX, R9; MOVQ AX, 0+z; \ - MULXQ 8+x, AX, R10; ADCXQ AX, R9; \ - MULXQ 16+x, AX, R11; ADCXQ AX, R10; \ - MULXQ 24+x, AX, R12; ADCXQ AX, R11; \ - MULXQ 32+x, AX, R13; ADCXQ AX, R12; \ - MULXQ 40+x, AX, R14; ADCXQ AX, R13; \ - MULXQ 48+x, AX, R15; ADCXQ AX, R14; \ - ;;;;;;;;;;;;;;;;;;;; ADCXQ R8, R15; \ - maddBmi2Adx(z,x,y, 8, R9,R10,R11,R12,R13,R14,R15) \ - maddBmi2Adx(z,x,y,16,R10,R11,R12,R13,R14,R15, R9) \ - maddBmi2Adx(z,x,y,24,R11,R12,R13,R14,R15, R9,R10) \ - maddBmi2Adx(z,x,y,32,R12,R13,R14,R15, R9,R10,R11) \ - maddBmi2Adx(z,x,y,40,R13,R14,R15, R9,R10,R11,R12) \ - maddBmi2Adx(z,x,y,48,R14,R15, R9,R10,R11,R12,R13) \ - MOVQ R15, 56+z; \ - MOVQ R9, 64+z; \ - MOVQ R10, 72+z; \ - MOVQ R11, 80+z; \ - MOVQ R12, 88+z; \ - MOVQ R13, 96+z; \ - MOVQ R14, 104+z; - -// maddLegacy multiplies x and y and accumulates in z -// Uses: AX, DX, R15, FLAGS -// Instr: x86_64 -#define maddLegacy(z,x,y,i) \ - MOVQ i+y, R15; \ - MOVQ 0+x, AX; MULQ R15; MOVQ AX, R8; ;;;;;;;;;;;; MOVQ DX, R9; \ - MOVQ 8+x, AX; MULQ R15; ADDQ AX, R9; ADCQ $0, DX; MOVQ DX, R10; \ - MOVQ 16+x, AX; MULQ R15; ADDQ AX, R10; ADCQ $0, DX; MOVQ DX, R11; \ - MOVQ 24+x, AX; MULQ R15; ADDQ AX, R11; ADCQ $0, DX; MOVQ DX, R12; \ - MOVQ 32+x, AX; MULQ R15; ADDQ AX, R12; ADCQ $0, DX; MOVQ DX, R13; \ - MOVQ 40+x, AX; MULQ R15; ADDQ AX, R13; ADCQ $0, DX; MOVQ DX, R14; \ - MOVQ 48+x, AX; MULQ R15; ADDQ AX, R14; ADCQ $0, DX; \ - ADDQ 0+i+z, R8; MOVQ R8, 0+i+z; \ - ADCQ 8+i+z, R9; MOVQ R9, 8+i+z; \ - ADCQ 16+i+z, R10; MOVQ R10, 16+i+z; \ - ADCQ 24+i+z, R11; MOVQ R11, 24+i+z; \ - ADCQ 32+i+z, R12; MOVQ R12, 32+i+z; \ - ADCQ 40+i+z, R13; MOVQ R13, 40+i+z; \ - ADCQ 48+i+z, R14; MOVQ R14, 48+i+z; \ - ADCQ $0, DX; MOVQ DX, 56+i+z; - -// integerMulLeg multiplies x and y and stores in z -// Uses: AX, DX, R8-R15, FLAGS -// Instr: x86_64 -#define integerMulLeg(z,x,y) \ - MOVQ 0+y, R15; \ - MOVQ 0+x, AX; MULQ R15; MOVQ AX, 0+z; ;;;;;;;;;;;; MOVQ DX, R8; \ - MOVQ 8+x, AX; MULQ R15; ADDQ AX, R8; ADCQ $0, DX; MOVQ DX, R9; MOVQ R8, 8+z; \ - MOVQ 16+x, AX; MULQ R15; ADDQ AX, R9; ADCQ $0, DX; MOVQ DX, R10; MOVQ R9, 16+z; \ - MOVQ 24+x, AX; MULQ R15; ADDQ AX, R10; ADCQ $0, DX; MOVQ DX, R11; MOVQ R10, 24+z; \ - MOVQ 32+x, AX; MULQ R15; ADDQ AX, R11; ADCQ $0, DX; MOVQ DX, R12; MOVQ R11, 32+z; \ - MOVQ 40+x, AX; MULQ R15; ADDQ AX, R12; ADCQ $0, DX; MOVQ DX, R13; MOVQ R12, 40+z; \ - MOVQ 48+x, AX; MULQ R15; ADDQ AX, R13; ADCQ $0, DX; MOVQ DX,56+z; MOVQ R13, 48+z; \ - maddLegacy(z,x,y, 8) \ - maddLegacy(z,x,y,16) \ - maddLegacy(z,x,y,24) \ - maddLegacy(z,x,y,32) \ - maddLegacy(z,x,y,40) \ - maddLegacy(z,x,y,48) - -// integerSqrLeg squares x and stores in z -// Uses: AX, CX, DX, R8-R15, FLAGS -// Instr: x86_64 -#define integerSqrLeg(z,x) \ - XORL R15, R15; \ - MOVQ 0+x, CX; \ - MOVQ CX, AX; MULQ CX; MOVQ AX, 0+z; MOVQ DX, R8; \ - ADDQ CX, CX; ADCQ $0, R15; \ - MOVQ 8+x, AX; MULQ CX; ADDQ AX, R8; ADCQ $0, DX; MOVQ DX, R9; MOVQ R8, 8+z; \ - MOVQ 16+x, AX; MULQ CX; ADDQ AX, R9; ADCQ $0, DX; MOVQ DX, R10; \ - MOVQ 24+x, AX; MULQ CX; ADDQ AX, R10; ADCQ $0, DX; MOVQ DX, R11; \ - MOVQ 32+x, AX; MULQ CX; ADDQ AX, R11; ADCQ $0, DX; MOVQ DX, R12; \ - MOVQ 40+x, AX; MULQ CX; ADDQ AX, R12; ADCQ $0, DX; MOVQ DX, R13; \ - MOVQ 48+x, AX; MULQ CX; ADDQ AX, R13; ADCQ $0, DX; MOVQ DX, R14; \ - \ - MOVQ 8+x, CX; \ - MOVQ CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \ - ;;;;;;;;;;;;;; MULQ CX; ADDQ AX, R9; ADCQ $0, DX; MOVQ R9,16+z; \ - MOVQ R15, AX; NEGQ AX; ANDQ 8+x, AX; ADDQ AX, DX; ADCQ $0, R11; MOVQ DX, R8; \ - ADDQ 8+x, CX; ADCQ $0, R15; \ - MOVQ 16+x, AX; MULQ CX; ADDQ AX, R10; ADCQ $0, DX; ADDQ R8, R10; ADCQ $0, DX; MOVQ DX, R8; MOVQ R10, 24+z; \ - MOVQ 24+x, AX; MULQ CX; ADDQ AX, R11; ADCQ $0, DX; ADDQ R8, R11; ADCQ $0, DX; MOVQ DX, R8; \ - MOVQ 32+x, AX; MULQ CX; ADDQ AX, R12; ADCQ $0, DX; ADDQ R8, R12; ADCQ $0, DX; MOVQ DX, R8; \ - MOVQ 40+x, AX; MULQ CX; ADDQ AX, R13; ADCQ $0, DX; ADDQ R8, R13; ADCQ $0, DX; MOVQ DX, R8; \ - MOVQ 48+x, AX; MULQ CX; ADDQ AX, R14; ADCQ $0, DX; ADDQ R8, R14; ADCQ $0, DX; MOVQ DX, R9; \ - \ - MOVQ 16+x, CX; \ - MOVQ CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \ - ;;;;;;;;;;;;;; MULQ CX; ADDQ AX, R11; ADCQ $0, DX; MOVQ R11, 32+z; \ - MOVQ R15, AX; NEGQ AX; ANDQ 16+x,AX; ADDQ AX, DX; ADCQ $0, R13; MOVQ DX, R8; \ - ADDQ 16+x, CX; ADCQ $0, R15; \ - MOVQ 24+x, AX; MULQ CX; ADDQ AX, R12; ADCQ $0, DX; ADDQ R8, R12; ADCQ $0, DX; MOVQ DX, R8; MOVQ R12, 40+z; \ - MOVQ 32+x, AX; MULQ CX; ADDQ AX, R13; ADCQ $0, DX; ADDQ R8, R13; ADCQ $0, DX; MOVQ DX, R8; \ - MOVQ 40+x, AX; MULQ CX; ADDQ AX, R14; ADCQ $0, DX; ADDQ R8, R14; ADCQ $0, DX; MOVQ DX, R8; \ - MOVQ 48+x, AX; MULQ CX; ADDQ AX, R9; ADCQ $0, DX; ADDQ R8, R9; ADCQ $0, DX; MOVQ DX,R10; \ - \ - MOVQ 24+x, CX; \ - MOVQ CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \ - ;;;;;;;;;;;;;; MULQ CX; ADDQ AX, R13; ADCQ $0, DX; MOVQ R13, 48+z; \ - MOVQ R15, AX; NEGQ AX; ANDQ 24+x,AX; ADDQ AX, DX; ADCQ $0, R9; MOVQ DX, R8; \ - ADDQ 24+x, CX; ADCQ $0, R15; \ - MOVQ 32+x, AX; MULQ CX; ADDQ AX, R14; ADCQ $0, DX; ADDQ R8, R14; ADCQ $0, DX; MOVQ DX, R8; MOVQ R14, 56+z; \ - MOVQ 40+x, AX; MULQ CX; ADDQ AX, R9; ADCQ $0, DX; ADDQ R8, R9; ADCQ $0, DX; MOVQ DX, R8; \ - MOVQ 48+x, AX; MULQ CX; ADDQ AX, R10; ADCQ $0, DX; ADDQ R8, R10; ADCQ $0, DX; MOVQ DX,R11; \ - \ - MOVQ 32+x, CX; \ - MOVQ CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \ - ;;;;;;;;;;;;;; MULQ CX; ADDQ AX, R9; ADCQ $0, DX; MOVQ R9, 64+z; \ - MOVQ R15, AX; NEGQ AX; ANDQ 32+x,AX; ADDQ AX, DX; ADCQ $0, R11; MOVQ DX, R8; \ - ADDQ 32+x, CX; ADCQ $0, R15; \ - MOVQ 40+x, AX; MULQ CX; ADDQ AX, R10; ADCQ $0, DX; ADDQ R8, R10; ADCQ $0, DX; MOVQ DX, R8; MOVQ R10, 72+z; \ - MOVQ 48+x, AX; MULQ CX; ADDQ AX, R11; ADCQ $0, DX; ADDQ R8, R11; ADCQ $0, DX; MOVQ DX,R12; \ - \ - XORL R13, R13; \ - XORL R14, R14; \ - MOVQ 40+x, CX; \ - MOVQ CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \ - ;;;;;;;;;;;;;; MULQ CX; ADDQ AX, R11; ADCQ $0, DX; MOVQ R11, 80+z; \ - MOVQ R15, AX; NEGQ AX; ANDQ 40+x,AX; ADDQ AX, DX; ADCQ $0, R13; MOVQ DX, R8; \ - ADDQ 40+x, CX; ADCQ $0, R15; \ - MOVQ 48+x, AX; MULQ CX; ADDQ AX, R12; ADCQ $0, DX; ADDQ R8, R12; ADCQ $0, DX; MOVQ DX, R8; MOVQ R12, 88+z; \ - ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ADDQ R8, R13; ADCQ $0,R14; \ - \ - XORL R9, R9; \ - MOVQ 48+x, CX; \ - MOVQ CX, AX; ADDQ R15, CX; MOVQ $0, R15; ADCQ $0, R15; \ - ;;;;;;;;;;;;;; MULQ CX; ADDQ AX, R13; ADCQ $0, DX; MOVQ R13, 96+z; \ - MOVQ R15, AX; NEGQ AX; ANDQ 48+x,AX; ADDQ AX, DX; ADCQ $0, R9; MOVQ DX, R8; \ - ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ADDQ R8,R14; ADCQ $0, R9; MOVQ R14, 104+z; - - -// integerSqrAdx squares x and stores in z -// Uses: AX, CX, DX, R8-R15, FLAGS -// Instr: x86_64, bmi2, adx -#define integerSqrAdx(z,x) \ - XORL R15, R15; \ - MOVQ 0+x, DX; \ - ;;;;;;;;;;;;;; MULXQ DX, AX, R8; MOVQ AX, 0+z; \ - ADDQ DX, DX; ADCQ $0, R15; CLC; \ - MULXQ 8+x, AX, R9; ADCXQ AX, R8; MOVQ R8, 8+z; \ - MULXQ 16+x, AX, R10; ADCXQ AX, R9; MOVQ $0, R8;\ - MULXQ 24+x, AX, R11; ADCXQ AX, R10; \ - MULXQ 32+x, AX, R12; ADCXQ AX, R11; \ - MULXQ 40+x, AX, R13; ADCXQ AX, R12; \ - MULXQ 48+x, AX, R14; ADCXQ AX, R13; \ - ;;;;;;;;;;;;;;;;;;;; ADCXQ R8, R14; \ - \ - MOVQ 8+x, DX; \ - MOVQ DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ $0, R15; \ - MULXQ AX, AX, CX; \ - MOVQ R15, R8; NEGQ R8; ANDQ 8+x, R8; \ - ADDQ AX, R9; MOVQ R9, 16+z; \ - ADCQ CX, R8; \ - ADCQ $0, R11; \ - ADDQ 8+x, DX; \ - ADCQ $0, R15; \ - XORL R9, R9; ;;;;;;;;;;;;;;;;;;;;; ADOXQ R8, R10; \ - MULXQ 16+x, AX, CX; ADCXQ AX, R10; ADOXQ CX, R11; MOVQ R10, 24+z; \ - MULXQ 24+x, AX, CX; ADCXQ AX, R11; ADOXQ CX, R12; MOVQ $0, R10; \ - MULXQ 32+x, AX, CX; ADCXQ AX, R12; ADOXQ CX, R13; \ - MULXQ 40+x, AX, CX; ADCXQ AX, R13; ADOXQ CX, R14; \ - MULXQ 48+x, AX, CX; ADCXQ AX, R14; ADOXQ CX, R9; \ - ;;;;;;;;;;;;;;;;;;; ADCXQ R10, R9; \ - \ - MOVQ 16+x, DX; \ - MOVQ DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ $0, R15; \ - MULXQ AX, AX, CX; \ - MOVQ R15, R8; NEGQ R8; ANDQ 16+x, R8; \ - ADDQ AX, R11; MOVQ R11, 32+z; \ - ADCQ CX, R8; \ - ADCQ $0, R13; \ - ADDQ 16+x, DX; \ - ADCQ $0, R15; \ - XORL R11, R11; ;;;;;;;;;;;;;;;;;;; ADOXQ R8, R12; \ - MULXQ 24+x, AX, CX; ADCXQ AX, R12; ADOXQ CX, R13; MOVQ R12, 40+z; \ - MULXQ 32+x, AX, CX; ADCXQ AX, R13; ADOXQ CX, R14; MOVQ $0, R12; \ - MULXQ 40+x, AX, CX; ADCXQ AX, R14; ADOXQ CX, R9; \ - MULXQ 48+x, AX, CX; ADCXQ AX, R9; ADOXQ CX, R10; \ - ;;;;;;;;;;;;;;;;;;; ADCXQ R11,R10; \ - \ - MOVQ 24+x, DX; \ - MOVQ DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ $0, R15; \ - MULXQ AX, AX, CX; \ - MOVQ R15, R8; NEGQ R8; ANDQ 24+x, R8; \ - ADDQ AX, R13; MOVQ R13, 48+z; \ - ADCQ CX, R8; \ - ADCQ $0, R9; \ - ADDQ 24+x, DX; \ - ADCQ $0, R15; \ - XORL R13, R13; ;;;;;;;;;;;;;;;;;;; ADOXQ R8, R14; \ - MULXQ 32+x, AX, CX; ADCXQ AX, R14; ADOXQ CX, R9; MOVQ R14, 56+z; \ - MULXQ 40+x, AX, CX; ADCXQ AX, R9; ADOXQ CX, R10; MOVQ $0, R14; \ - MULXQ 48+x, AX, CX; ADCXQ AX, R10; ADOXQ CX, R11; \ - ;;;;;;;;;;;;;;;;;;; ADCXQ R12,R11; \ - \ - MOVQ 32+x, DX; \ - MOVQ DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ $0, R15; \ - MULXQ AX, AX, CX; \ - MOVQ R15, R8; NEGQ R8; ANDQ 32+x, R8; \ - ADDQ AX, R9; MOVQ R9, 64+z; \ - ADCQ CX, R8; \ - ADCQ $0, R11; \ - ADDQ 32+x, DX; \ - ADCQ $0, R15; \ - XORL R9, R9; ;;;;;;;;;;;;;;;;;;;;; ADOXQ R8, R10; \ - MULXQ 40+x, AX, CX; ADCXQ AX, R10; ADOXQ CX, R11; MOVQ R10, 72+z; \ - MULXQ 48+x, AX, CX; ADCXQ AX, R11; ADOXQ CX, R12; \ - ;;;;;;;;;;;;;;;;;;; ADCXQ R13,R12; \ - \ - MOVQ 40+x, DX; \ - MOVQ DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ $0, R15; \ - MULXQ AX, AX, CX; \ - MOVQ R15, R8; NEGQ R8; ANDQ 40+x, R8; \ - ADDQ AX, R11; MOVQ R11, 80+z; \ - ADCQ CX, R8; \ - ADCQ $0, R13; \ - ADDQ 40+x, DX; \ - ADCQ $0, R15; \ - XORL R11, R11; ;;;;;;;;;;;;;;;;;;; ADOXQ R8, R12; \ - MULXQ 48+x, AX, CX; ADCXQ AX, R12; ADOXQ CX, R13; MOVQ R12, 88+z; \ - ;;;;;;;;;;;;;;;;;;; ADCXQ R14,R13; \ - \ - MOVQ 48+x, DX; \ - MOVQ DX, AX; ADDQ R15, DX; MOVQ $0, R15; ADCQ $0, R15; \ - MULXQ AX, AX, CX; \ - MOVQ R15, R8; NEGQ R8; ANDQ 48+x, R8; \ - XORL R10, R10; ;;;;;;;;;;;;;; ADOXQ CX, R14; \ - ;;;;;;;;;;;;;; ADCXQ AX, R13; ;;;;;;;;;;;;;; MOVQ R13, 96+z; \ - ;;;;;;;;;;;;;; ADCXQ R8, R14; MOVQ R14, 104+z; - -// reduceFromDoubleLeg finds a z=x modulo p such that z<2^448 and stores in z -// Uses: AX, R8-R15, FLAGS -// Instr: x86_64 -#define reduceFromDoubleLeg(z,x) \ - /* ( ,2C13,2C12,2C11,2C10|C10,C9,C8, C7) + (C6,...,C0) */ \ - /* (r14, r13, r12, r11, r10,r9,r8,r15) */ \ - MOVQ 80+x,AX; MOVQ AX,R10; \ - MOVQ $0xFFFFFFFF00000000, R8; \ - ANDQ R8,R10; \ - \ - MOVQ $0,R14; \ - MOVQ 104+x,R13; SHLQ $1,R13,R14; \ - MOVQ 96+x,R12; SHLQ $1,R12,R13; \ - MOVQ 88+x,R11; SHLQ $1,R11,R12; \ - MOVQ 72+x, R9; SHLQ $1,R10,R11; \ - MOVQ 64+x, R8; SHLQ $1,R10; \ - MOVQ $0xFFFFFFFF,R15; ANDQ R15,AX; ORQ AX,R10; \ - MOVQ 56+x,R15; \ - \ - ADDQ 0+x,R15; MOVQ R15, 0+z; MOVQ 56+x,R15; \ - ADCQ 8+x, R8; MOVQ R8, 8+z; MOVQ 64+x, R8; \ - ADCQ 16+x, R9; MOVQ R9,16+z; MOVQ 72+x, R9; \ - ADCQ 24+x,R10; MOVQ R10,24+z; MOVQ 80+x,R10; \ - ADCQ 32+x,R11; MOVQ R11,32+z; MOVQ 88+x,R11; \ - ADCQ 40+x,R12; MOVQ R12,40+z; MOVQ 96+x,R12; \ - ADCQ 48+x,R13; MOVQ R13,48+z; MOVQ 104+x,R13; \ - ADCQ $0,R14; \ - /* (c10c9,c9c8,c8c7,c7c13,c13c12,c12c11,c11c10) + (c6,...,c0) */ \ - /* ( r9, r8, r15, r13, r12, r11, r10) */ \ - MOVQ R10, AX; \ - SHRQ $32,R11,R10; \ - SHRQ $32,R12,R11; \ - SHRQ $32,R13,R12; \ - SHRQ $32,R15,R13; \ - SHRQ $32, R8,R15; \ - SHRQ $32, R9, R8; \ - SHRQ $32, AX, R9; \ - \ - ADDQ 0+z,R10; \ - ADCQ 8+z,R11; \ - ADCQ 16+z,R12; \ - ADCQ 24+z,R13; \ - ADCQ 32+z,R15; \ - ADCQ 40+z, R8; \ - ADCQ 48+z, R9; \ - ADCQ $0,R14; \ - /* ( c7) + (c6,...,c0) */ \ - /* (r14) */ \ - MOVQ R14, AX; SHLQ $32, AX; \ - ADDQ R14,R10; MOVQ $0,R14; \ - ADCQ $0,R11; \ - ADCQ $0,R12; \ - ADCQ AX,R13; \ - ADCQ $0,R15; \ - ADCQ $0, R8; \ - ADCQ $0, R9; \ - ADCQ $0,R14; \ - /* ( c7) + (c6,...,c0) */ \ - /* (r14) */ \ - MOVQ R14, AX; SHLQ $32,AX; \ - ADDQ R14,R10; MOVQ R10, 0+z; \ - ADCQ $0,R11; MOVQ R11, 8+z; \ - ADCQ $0,R12; MOVQ R12,16+z; \ - ADCQ AX,R13; MOVQ R13,24+z; \ - ADCQ $0,R15; MOVQ R15,32+z; \ - ADCQ $0, R8; MOVQ R8,40+z; \ - ADCQ $0, R9; MOVQ R9,48+z; - -// reduceFromDoubleAdx finds a z=x modulo p such that z<2^448 and stores in z -// Uses: AX, R8-R15, FLAGS -// Instr: x86_64, adx -#define reduceFromDoubleAdx(z,x) \ - /* ( ,2C13,2C12,2C11,2C10|C10,C9,C8, C7) + (C6,...,C0) */ \ - /* (r14, r13, r12, r11, r10,r9,r8,r15) */ \ - MOVQ 80+x,AX; MOVQ AX,R10; \ - MOVQ $0xFFFFFFFF00000000, R8; \ - ANDQ R8,R10; \ - \ - MOVQ $0,R14; \ - MOVQ 104+x,R13; SHLQ $1,R13,R14; \ - MOVQ 96+x,R12; SHLQ $1,R12,R13; \ - MOVQ 88+x,R11; SHLQ $1,R11,R12; \ - MOVQ 72+x, R9; SHLQ $1,R10,R11; \ - MOVQ 64+x, R8; SHLQ $1,R10; \ - MOVQ $0xFFFFFFFF,R15; ANDQ R15,AX; ORQ AX,R10; \ - MOVQ 56+x,R15; \ - \ - XORL AX,AX; \ - ADCXQ 0+x,R15; MOVQ R15, 0+z; MOVQ 56+x,R15; \ - ADCXQ 8+x, R8; MOVQ R8, 8+z; MOVQ 64+x, R8; \ - ADCXQ 16+x, R9; MOVQ R9,16+z; MOVQ 72+x, R9; \ - ADCXQ 24+x,R10; MOVQ R10,24+z; MOVQ 80+x,R10; \ - ADCXQ 32+x,R11; MOVQ R11,32+z; MOVQ 88+x,R11; \ - ADCXQ 40+x,R12; MOVQ R12,40+z; MOVQ 96+x,R12; \ - ADCXQ 48+x,R13; MOVQ R13,48+z; MOVQ 104+x,R13; \ - ADCXQ AX,R14; \ - /* (c10c9,c9c8,c8c7,c7c13,c13c12,c12c11,c11c10) + (c6,...,c0) */ \ - /* ( r9, r8, r15, r13, r12, r11, r10) */ \ - MOVQ R10, AX; \ - SHRQ $32,R11,R10; \ - SHRQ $32,R12,R11; \ - SHRQ $32,R13,R12; \ - SHRQ $32,R15,R13; \ - SHRQ $32, R8,R15; \ - SHRQ $32, R9, R8; \ - SHRQ $32, AX, R9; \ - \ - XORL AX,AX; \ - ADCXQ 0+z,R10; \ - ADCXQ 8+z,R11; \ - ADCXQ 16+z,R12; \ - ADCXQ 24+z,R13; \ - ADCXQ 32+z,R15; \ - ADCXQ 40+z, R8; \ - ADCXQ 48+z, R9; \ - ADCXQ AX,R14; \ - /* ( c7) + (c6,...,c0) */ \ - /* (r14) */ \ - MOVQ R14, AX; SHLQ $32, AX; \ - CLC; \ - ADCXQ R14,R10; MOVQ $0,R14; \ - ADCXQ R14,R11; \ - ADCXQ R14,R12; \ - ADCXQ AX,R13; \ - ADCXQ R14,R15; \ - ADCXQ R14, R8; \ - ADCXQ R14, R9; \ - ADCXQ R14,R14; \ - /* ( c7) + (c6,...,c0) */ \ - /* (r14) */ \ - MOVQ R14, AX; SHLQ $32, AX; \ - CLC; \ - ADCXQ R14,R10; MOVQ R10, 0+z; MOVQ $0,R14; \ - ADCXQ R14,R11; MOVQ R11, 8+z; \ - ADCXQ R14,R12; MOVQ R12,16+z; \ - ADCXQ AX,R13; MOVQ R13,24+z; \ - ADCXQ R14,R15; MOVQ R15,32+z; \ - ADCXQ R14, R8; MOVQ R8,40+z; \ - ADCXQ R14, R9; MOVQ R9,48+z; - -// addSub calculates two operations: x,y = x+y,x-y -// Uses: AX, DX, R8-R15, FLAGS -#define addSub(x,y) \ - MOVQ 0+x, R8; ADDQ 0+y, R8; \ - MOVQ 8+x, R9; ADCQ 8+y, R9; \ - MOVQ 16+x, R10; ADCQ 16+y, R10; \ - MOVQ 24+x, R11; ADCQ 24+y, R11; \ - MOVQ 32+x, R12; ADCQ 32+y, R12; \ - MOVQ 40+x, R13; ADCQ 40+y, R13; \ - MOVQ 48+x, R14; ADCQ 48+y, R14; \ - MOVQ $0, AX; ADCQ $0, AX; \ - MOVQ AX, DX; \ - SHLQ $32, DX; \ - ADDQ AX, R8; MOVQ $0, AX; \ - ADCQ $0, R9; \ - ADCQ $0, R10; \ - ADCQ DX, R11; \ - ADCQ $0, R12; \ - ADCQ $0, R13; \ - ADCQ $0, R14; \ - ADCQ $0, AX; \ - MOVQ AX, DX; \ - SHLQ $32, DX; \ - ADDQ AX, R8; MOVQ 0+x,AX; MOVQ R8, 0+x; MOVQ AX, R8; \ - ADCQ $0, R9; MOVQ 8+x,AX; MOVQ R9, 8+x; MOVQ AX, R9; \ - ADCQ $0, R10; MOVQ 16+x,AX; MOVQ R10, 16+x; MOVQ AX, R10; \ - ADCQ DX, R11; MOVQ 24+x,AX; MOVQ R11, 24+x; MOVQ AX, R11; \ - ADCQ $0, R12; MOVQ 32+x,AX; MOVQ R12, 32+x; MOVQ AX, R12; \ - ADCQ $0, R13; MOVQ 40+x,AX; MOVQ R13, 40+x; MOVQ AX, R13; \ - ADCQ $0, R14; MOVQ 48+x,AX; MOVQ R14, 48+x; MOVQ AX, R14; \ - SUBQ 0+y, R8; \ - SBBQ 8+y, R9; \ - SBBQ 16+y, R10; \ - SBBQ 24+y, R11; \ - SBBQ 32+y, R12; \ - SBBQ 40+y, R13; \ - SBBQ 48+y, R14; \ - MOVQ $0, AX; SETCS AX; \ - MOVQ AX, DX; \ - SHLQ $32, DX; \ - SUBQ AX, R8; MOVQ $0, AX; \ - SBBQ $0, R9; \ - SBBQ $0, R10; \ - SBBQ DX, R11; \ - SBBQ $0, R12; \ - SBBQ $0, R13; \ - SBBQ $0, R14; \ - SETCS AX; \ - MOVQ AX, DX; \ - SHLQ $32, DX; \ - SUBQ AX, R8; MOVQ R8, 0+y; \ - SBBQ $0, R9; MOVQ R9, 8+y; \ - SBBQ $0, R10; MOVQ R10, 16+y; \ - SBBQ DX, R11; MOVQ R11, 24+y; \ - SBBQ $0, R12; MOVQ R12, 32+y; \ - SBBQ $0, R13; MOVQ R13, 40+y; \ - SBBQ $0, R14; MOVQ R14, 48+y; diff --git a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.s b/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.s deleted file mode 100644 index 3f1f07c..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_amd64.s +++ /dev/null @@ -1,75 +0,0 @@ -//go:build amd64 && !purego -// +build amd64,!purego - -#include "textflag.h" -#include "fp_amd64.h" - -// func cmovAmd64(x, y *Elt, n uint) -TEXT ·cmovAmd64(SB),NOSPLIT,$0-24 - MOVQ x+0(FP), DI - MOVQ y+8(FP), SI - MOVQ n+16(FP), BX - cselect(0(DI),0(SI),BX) - RET - -// func cswapAmd64(x, y *Elt, n uint) -TEXT ·cswapAmd64(SB),NOSPLIT,$0-24 - MOVQ x+0(FP), DI - MOVQ y+8(FP), SI - MOVQ n+16(FP), BX - cswap(0(DI),0(SI),BX) - RET - -// func subAmd64(z, x, y *Elt) -TEXT ·subAmd64(SB),NOSPLIT,$0-24 - MOVQ z+0(FP), DI - MOVQ x+8(FP), SI - MOVQ y+16(FP), BX - subtraction(0(DI),0(SI),0(BX)) - RET - -// func addsubAmd64(x, y *Elt) -TEXT ·addsubAmd64(SB),NOSPLIT,$0-16 - MOVQ x+0(FP), DI - MOVQ y+8(FP), SI - addSub(0(DI),0(SI)) - RET - -#define addLegacy \ - additionLeg(0(DI),0(SI),0(BX)) -#define addBmi2Adx \ - additionAdx(0(DI),0(SI),0(BX)) - -#define mulLegacy \ - integerMulLeg(0(SP),0(SI),0(BX)) \ - reduceFromDoubleLeg(0(DI),0(SP)) -#define mulBmi2Adx \ - integerMulAdx(0(SP),0(SI),0(BX)) \ - reduceFromDoubleAdx(0(DI),0(SP)) - -#define sqrLegacy \ - integerSqrLeg(0(SP),0(SI)) \ - reduceFromDoubleLeg(0(DI),0(SP)) -#define sqrBmi2Adx \ - integerSqrAdx(0(SP),0(SI)) \ - reduceFromDoubleAdx(0(DI),0(SP)) - -// func addAmd64(z, x, y *Elt) -TEXT ·addAmd64(SB),NOSPLIT,$0-24 - MOVQ z+0(FP), DI - MOVQ x+8(FP), SI - MOVQ y+16(FP), BX - CHECK_BMI2ADX(LADD, addLegacy, addBmi2Adx) - -// func mulAmd64(z, x, y *Elt) -TEXT ·mulAmd64(SB),NOSPLIT,$112-24 - MOVQ z+0(FP), DI - MOVQ x+8(FP), SI - MOVQ y+16(FP), BX - CHECK_BMI2ADX(LMUL, mulLegacy, mulBmi2Adx) - -// func sqrAmd64(z, x *Elt) -TEXT ·sqrAmd64(SB),NOSPLIT,$112-16 - MOVQ z+0(FP), DI - MOVQ x+8(FP), SI - CHECK_BMI2ADX(LSQR, sqrLegacy, sqrBmi2Adx) diff --git a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_generic.go b/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_generic.go deleted file mode 100644 index 47a0b63..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_generic.go +++ /dev/null @@ -1,339 +0,0 @@ -package fp448 - -import ( - "encoding/binary" - "math/bits" -) - -func cmovGeneric(x, y *Elt, n uint) { - m := -uint64(n & 0x1) - x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8]) - x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8]) - x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8]) - x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8]) - x4 := binary.LittleEndian.Uint64(x[4*8 : 5*8]) - x5 := binary.LittleEndian.Uint64(x[5*8 : 6*8]) - x6 := binary.LittleEndian.Uint64(x[6*8 : 7*8]) - - y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8]) - y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8]) - y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8]) - y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8]) - y4 := binary.LittleEndian.Uint64(y[4*8 : 5*8]) - y5 := binary.LittleEndian.Uint64(y[5*8 : 6*8]) - y6 := binary.LittleEndian.Uint64(y[6*8 : 7*8]) - - x0 = (x0 &^ m) | (y0 & m) - x1 = (x1 &^ m) | (y1 & m) - x2 = (x2 &^ m) | (y2 & m) - x3 = (x3 &^ m) | (y3 & m) - x4 = (x4 &^ m) | (y4 & m) - x5 = (x5 &^ m) | (y5 & m) - x6 = (x6 &^ m) | (y6 & m) - - binary.LittleEndian.PutUint64(x[0*8:1*8], x0) - binary.LittleEndian.PutUint64(x[1*8:2*8], x1) - binary.LittleEndian.PutUint64(x[2*8:3*8], x2) - binary.LittleEndian.PutUint64(x[3*8:4*8], x3) - binary.LittleEndian.PutUint64(x[4*8:5*8], x4) - binary.LittleEndian.PutUint64(x[5*8:6*8], x5) - binary.LittleEndian.PutUint64(x[6*8:7*8], x6) -} - -func cswapGeneric(x, y *Elt, n uint) { - m := -uint64(n & 0x1) - x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8]) - x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8]) - x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8]) - x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8]) - x4 := binary.LittleEndian.Uint64(x[4*8 : 5*8]) - x5 := binary.LittleEndian.Uint64(x[5*8 : 6*8]) - x6 := binary.LittleEndian.Uint64(x[6*8 : 7*8]) - - y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8]) - y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8]) - y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8]) - y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8]) - y4 := binary.LittleEndian.Uint64(y[4*8 : 5*8]) - y5 := binary.LittleEndian.Uint64(y[5*8 : 6*8]) - y6 := binary.LittleEndian.Uint64(y[6*8 : 7*8]) - - t0 := m & (x0 ^ y0) - t1 := m & (x1 ^ y1) - t2 := m & (x2 ^ y2) - t3 := m & (x3 ^ y3) - t4 := m & (x4 ^ y4) - t5 := m & (x5 ^ y5) - t6 := m & (x6 ^ y6) - x0 ^= t0 - x1 ^= t1 - x2 ^= t2 - x3 ^= t3 - x4 ^= t4 - x5 ^= t5 - x6 ^= t6 - y0 ^= t0 - y1 ^= t1 - y2 ^= t2 - y3 ^= t3 - y4 ^= t4 - y5 ^= t5 - y6 ^= t6 - - binary.LittleEndian.PutUint64(x[0*8:1*8], x0) - binary.LittleEndian.PutUint64(x[1*8:2*8], x1) - binary.LittleEndian.PutUint64(x[2*8:3*8], x2) - binary.LittleEndian.PutUint64(x[3*8:4*8], x3) - binary.LittleEndian.PutUint64(x[4*8:5*8], x4) - binary.LittleEndian.PutUint64(x[5*8:6*8], x5) - binary.LittleEndian.PutUint64(x[6*8:7*8], x6) - - binary.LittleEndian.PutUint64(y[0*8:1*8], y0) - binary.LittleEndian.PutUint64(y[1*8:2*8], y1) - binary.LittleEndian.PutUint64(y[2*8:3*8], y2) - binary.LittleEndian.PutUint64(y[3*8:4*8], y3) - binary.LittleEndian.PutUint64(y[4*8:5*8], y4) - binary.LittleEndian.PutUint64(y[5*8:6*8], y5) - binary.LittleEndian.PutUint64(y[6*8:7*8], y6) -} - -func addGeneric(z, x, y *Elt) { - x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8]) - x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8]) - x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8]) - x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8]) - x4 := binary.LittleEndian.Uint64(x[4*8 : 5*8]) - x5 := binary.LittleEndian.Uint64(x[5*8 : 6*8]) - x6 := binary.LittleEndian.Uint64(x[6*8 : 7*8]) - - y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8]) - y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8]) - y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8]) - y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8]) - y4 := binary.LittleEndian.Uint64(y[4*8 : 5*8]) - y5 := binary.LittleEndian.Uint64(y[5*8 : 6*8]) - y6 := binary.LittleEndian.Uint64(y[6*8 : 7*8]) - - z0, c0 := bits.Add64(x0, y0, 0) - z1, c1 := bits.Add64(x1, y1, c0) - z2, c2 := bits.Add64(x2, y2, c1) - z3, c3 := bits.Add64(x3, y3, c2) - z4, c4 := bits.Add64(x4, y4, c3) - z5, c5 := bits.Add64(x5, y5, c4) - z6, z7 := bits.Add64(x6, y6, c5) - - z0, c0 = bits.Add64(z0, z7, 0) - z1, c1 = bits.Add64(z1, 0, c0) - z2, c2 = bits.Add64(z2, 0, c1) - z3, c3 = bits.Add64(z3, z7<<32, c2) - z4, c4 = bits.Add64(z4, 0, c3) - z5, c5 = bits.Add64(z5, 0, c4) - z6, z7 = bits.Add64(z6, 0, c5) - - z0, c0 = bits.Add64(z0, z7, 0) - z1, c1 = bits.Add64(z1, 0, c0) - z2, c2 = bits.Add64(z2, 0, c1) - z3, c3 = bits.Add64(z3, z7<<32, c2) - z4, c4 = bits.Add64(z4, 0, c3) - z5, c5 = bits.Add64(z5, 0, c4) - z6, _ = bits.Add64(z6, 0, c5) - - binary.LittleEndian.PutUint64(z[0*8:1*8], z0) - binary.LittleEndian.PutUint64(z[1*8:2*8], z1) - binary.LittleEndian.PutUint64(z[2*8:3*8], z2) - binary.LittleEndian.PutUint64(z[3*8:4*8], z3) - binary.LittleEndian.PutUint64(z[4*8:5*8], z4) - binary.LittleEndian.PutUint64(z[5*8:6*8], z5) - binary.LittleEndian.PutUint64(z[6*8:7*8], z6) -} - -func subGeneric(z, x, y *Elt) { - x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8]) - x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8]) - x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8]) - x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8]) - x4 := binary.LittleEndian.Uint64(x[4*8 : 5*8]) - x5 := binary.LittleEndian.Uint64(x[5*8 : 6*8]) - x6 := binary.LittleEndian.Uint64(x[6*8 : 7*8]) - - y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8]) - y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8]) - y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8]) - y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8]) - y4 := binary.LittleEndian.Uint64(y[4*8 : 5*8]) - y5 := binary.LittleEndian.Uint64(y[5*8 : 6*8]) - y6 := binary.LittleEndian.Uint64(y[6*8 : 7*8]) - - z0, c0 := bits.Sub64(x0, y0, 0) - z1, c1 := bits.Sub64(x1, y1, c0) - z2, c2 := bits.Sub64(x2, y2, c1) - z3, c3 := bits.Sub64(x3, y3, c2) - z4, c4 := bits.Sub64(x4, y4, c3) - z5, c5 := bits.Sub64(x5, y5, c4) - z6, z7 := bits.Sub64(x6, y6, c5) - - z0, c0 = bits.Sub64(z0, z7, 0) - z1, c1 = bits.Sub64(z1, 0, c0) - z2, c2 = bits.Sub64(z2, 0, c1) - z3, c3 = bits.Sub64(z3, z7<<32, c2) - z4, c4 = bits.Sub64(z4, 0, c3) - z5, c5 = bits.Sub64(z5, 0, c4) - z6, z7 = bits.Sub64(z6, 0, c5) - - z0, c0 = bits.Sub64(z0, z7, 0) - z1, c1 = bits.Sub64(z1, 0, c0) - z2, c2 = bits.Sub64(z2, 0, c1) - z3, c3 = bits.Sub64(z3, z7<<32, c2) - z4, c4 = bits.Sub64(z4, 0, c3) - z5, c5 = bits.Sub64(z5, 0, c4) - z6, _ = bits.Sub64(z6, 0, c5) - - binary.LittleEndian.PutUint64(z[0*8:1*8], z0) - binary.LittleEndian.PutUint64(z[1*8:2*8], z1) - binary.LittleEndian.PutUint64(z[2*8:3*8], z2) - binary.LittleEndian.PutUint64(z[3*8:4*8], z3) - binary.LittleEndian.PutUint64(z[4*8:5*8], z4) - binary.LittleEndian.PutUint64(z[5*8:6*8], z5) - binary.LittleEndian.PutUint64(z[6*8:7*8], z6) -} - -func addsubGeneric(x, y *Elt) { - z := &Elt{} - addGeneric(z, x, y) - subGeneric(y, x, y) - *x = *z -} - -func mulGeneric(z, x, y *Elt) { - x0 := binary.LittleEndian.Uint64(x[0*8 : 1*8]) - x1 := binary.LittleEndian.Uint64(x[1*8 : 2*8]) - x2 := binary.LittleEndian.Uint64(x[2*8 : 3*8]) - x3 := binary.LittleEndian.Uint64(x[3*8 : 4*8]) - x4 := binary.LittleEndian.Uint64(x[4*8 : 5*8]) - x5 := binary.LittleEndian.Uint64(x[5*8 : 6*8]) - x6 := binary.LittleEndian.Uint64(x[6*8 : 7*8]) - - y0 := binary.LittleEndian.Uint64(y[0*8 : 1*8]) - y1 := binary.LittleEndian.Uint64(y[1*8 : 2*8]) - y2 := binary.LittleEndian.Uint64(y[2*8 : 3*8]) - y3 := binary.LittleEndian.Uint64(y[3*8 : 4*8]) - y4 := binary.LittleEndian.Uint64(y[4*8 : 5*8]) - y5 := binary.LittleEndian.Uint64(y[5*8 : 6*8]) - y6 := binary.LittleEndian.Uint64(y[6*8 : 7*8]) - - yy := [7]uint64{y0, y1, y2, y3, y4, y5, y6} - zz := [7]uint64{} - - yi := yy[0] - h0, l0 := bits.Mul64(x0, yi) - h1, l1 := bits.Mul64(x1, yi) - h2, l2 := bits.Mul64(x2, yi) - h3, l3 := bits.Mul64(x3, yi) - h4, l4 := bits.Mul64(x4, yi) - h5, l5 := bits.Mul64(x5, yi) - h6, l6 := bits.Mul64(x6, yi) - - zz[0] = l0 - a0, c0 := bits.Add64(h0, l1, 0) - a1, c1 := bits.Add64(h1, l2, c0) - a2, c2 := bits.Add64(h2, l3, c1) - a3, c3 := bits.Add64(h3, l4, c2) - a4, c4 := bits.Add64(h4, l5, c3) - a5, c5 := bits.Add64(h5, l6, c4) - a6, _ := bits.Add64(h6, 0, c5) - - for i := 1; i < 7; i++ { - yi = yy[i] - h0, l0 = bits.Mul64(x0, yi) - h1, l1 = bits.Mul64(x1, yi) - h2, l2 = bits.Mul64(x2, yi) - h3, l3 = bits.Mul64(x3, yi) - h4, l4 = bits.Mul64(x4, yi) - h5, l5 = bits.Mul64(x5, yi) - h6, l6 = bits.Mul64(x6, yi) - - zz[i], c0 = bits.Add64(a0, l0, 0) - a0, c1 = bits.Add64(a1, l1, c0) - a1, c2 = bits.Add64(a2, l2, c1) - a2, c3 = bits.Add64(a3, l3, c2) - a3, c4 = bits.Add64(a4, l4, c3) - a4, c5 = bits.Add64(a5, l5, c4) - a5, a6 = bits.Add64(a6, l6, c5) - - a0, c0 = bits.Add64(a0, h0, 0) - a1, c1 = bits.Add64(a1, h1, c0) - a2, c2 = bits.Add64(a2, h2, c1) - a3, c3 = bits.Add64(a3, h3, c2) - a4, c4 = bits.Add64(a4, h4, c3) - a5, c5 = bits.Add64(a5, h5, c4) - a6, _ = bits.Add64(a6, h6, c5) - } - red64(z, &zz, &[7]uint64{a0, a1, a2, a3, a4, a5, a6}) -} - -func sqrGeneric(z, x *Elt) { mulGeneric(z, x, x) } - -func red64(z *Elt, l, h *[7]uint64) { - /* (2C13, 2C12, 2C11, 2C10|C10, C9, C8, C7) + (C6,...,C0) */ - h0 := h[0] - h1 := h[1] - h2 := h[2] - h3 := ((h[3] & (0xFFFFFFFF << 32)) << 1) | (h[3] & 0xFFFFFFFF) - h4 := (h[3] >> 63) | (h[4] << 1) - h5 := (h[4] >> 63) | (h[5] << 1) - h6 := (h[5] >> 63) | (h[6] << 1) - h7 := (h[6] >> 63) - - l0, c0 := bits.Add64(h0, l[0], 0) - l1, c1 := bits.Add64(h1, l[1], c0) - l2, c2 := bits.Add64(h2, l[2], c1) - l3, c3 := bits.Add64(h3, l[3], c2) - l4, c4 := bits.Add64(h4, l[4], c3) - l5, c5 := bits.Add64(h5, l[5], c4) - l6, c6 := bits.Add64(h6, l[6], c5) - l7, _ := bits.Add64(h7, 0, c6) - - /* (C10C9, C9C8,C8C7,C7C13,C13C12,C12C11,C11C10) + (C6,...,C0) */ - h0 = (h[3] >> 32) | (h[4] << 32) - h1 = (h[4] >> 32) | (h[5] << 32) - h2 = (h[5] >> 32) | (h[6] << 32) - h3 = (h[6] >> 32) | (h[0] << 32) - h4 = (h[0] >> 32) | (h[1] << 32) - h5 = (h[1] >> 32) | (h[2] << 32) - h6 = (h[2] >> 32) | (h[3] << 32) - - l0, c0 = bits.Add64(l0, h0, 0) - l1, c1 = bits.Add64(l1, h1, c0) - l2, c2 = bits.Add64(l2, h2, c1) - l3, c3 = bits.Add64(l3, h3, c2) - l4, c4 = bits.Add64(l4, h4, c3) - l5, c5 = bits.Add64(l5, h5, c4) - l6, c6 = bits.Add64(l6, h6, c5) - l7, _ = bits.Add64(l7, 0, c6) - - /* (C7) + (C6,...,C0) */ - l0, c0 = bits.Add64(l0, l7, 0) - l1, c1 = bits.Add64(l1, 0, c0) - l2, c2 = bits.Add64(l2, 0, c1) - l3, c3 = bits.Add64(l3, l7<<32, c2) - l4, c4 = bits.Add64(l4, 0, c3) - l5, c5 = bits.Add64(l5, 0, c4) - l6, l7 = bits.Add64(l6, 0, c5) - - /* (C7) + (C6,...,C0) */ - l0, c0 = bits.Add64(l0, l7, 0) - l1, c1 = bits.Add64(l1, 0, c0) - l2, c2 = bits.Add64(l2, 0, c1) - l3, c3 = bits.Add64(l3, l7<<32, c2) - l4, c4 = bits.Add64(l4, 0, c3) - l5, c5 = bits.Add64(l5, 0, c4) - l6, _ = bits.Add64(l6, 0, c5) - - binary.LittleEndian.PutUint64(z[0*8:1*8], l0) - binary.LittleEndian.PutUint64(z[1*8:2*8], l1) - binary.LittleEndian.PutUint64(z[2*8:3*8], l2) - binary.LittleEndian.PutUint64(z[3*8:4*8], l3) - binary.LittleEndian.PutUint64(z[4*8:5*8], l4) - binary.LittleEndian.PutUint64(z[5*8:6*8], l5) - binary.LittleEndian.PutUint64(z[6*8:7*8], l6) -} diff --git a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_noasm.go b/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_noasm.go deleted file mode 100644 index a62225d..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/fp448/fp_noasm.go +++ /dev/null @@ -1,12 +0,0 @@ -//go:build !amd64 || purego -// +build !amd64 purego - -package fp448 - -func cmov(x, y *Elt, n uint) { cmovGeneric(x, y, n) } -func cswap(x, y *Elt, n uint) { cswapGeneric(x, y, n) } -func add(z, x, y *Elt) { addGeneric(z, x, y) } -func sub(z, x, y *Elt) { subGeneric(z, x, y) } -func addsub(x, y *Elt) { addsubGeneric(x, y) } -func mul(z, x, y *Elt) { mulGeneric(z, x, y) } -func sqr(z, x *Elt) { sqrGeneric(z, x) } diff --git a/backend/vendor/github.com/cloudflare/circl/math/fp448/fuzzer.go b/backend/vendor/github.com/cloudflare/circl/math/fp448/fuzzer.go deleted file mode 100644 index 2d7afc8..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/fp448/fuzzer.go +++ /dev/null @@ -1,75 +0,0 @@ -//go:build gofuzz -// +build gofuzz - -// How to run the fuzzer: -// -// $ go get -u github.com/dvyukov/go-fuzz/go-fuzz -// $ go get -u github.com/dvyukov/go-fuzz/go-fuzz-build -// $ go-fuzz-build -libfuzzer -func FuzzReduction -o lib.a -// $ clang -fsanitize=fuzzer lib.a -o fu.exe -// $ ./fu.exe -package fp448 - -import ( - "encoding/binary" - "fmt" - "math/big" - - "github.com/cloudflare/circl/internal/conv" -) - -// FuzzReduction is a fuzzer target for red64 function, which reduces t -// (112 bits) to a number t' (56 bits) congruent modulo p448. -func FuzzReduction(data []byte) int { - if len(data) != 2*Size { - return -1 - } - var got, want Elt - var lo, hi [7]uint64 - a := data[:Size] - b := data[Size:] - lo[0] = binary.LittleEndian.Uint64(a[0*8 : 1*8]) - lo[1] = binary.LittleEndian.Uint64(a[1*8 : 2*8]) - lo[2] = binary.LittleEndian.Uint64(a[2*8 : 3*8]) - lo[3] = binary.LittleEndian.Uint64(a[3*8 : 4*8]) - lo[4] = binary.LittleEndian.Uint64(a[4*8 : 5*8]) - lo[5] = binary.LittleEndian.Uint64(a[5*8 : 6*8]) - lo[6] = binary.LittleEndian.Uint64(a[6*8 : 7*8]) - - hi[0] = binary.LittleEndian.Uint64(b[0*8 : 1*8]) - hi[1] = binary.LittleEndian.Uint64(b[1*8 : 2*8]) - hi[2] = binary.LittleEndian.Uint64(b[2*8 : 3*8]) - hi[3] = binary.LittleEndian.Uint64(b[3*8 : 4*8]) - hi[4] = binary.LittleEndian.Uint64(b[4*8 : 5*8]) - hi[5] = binary.LittleEndian.Uint64(b[5*8 : 6*8]) - hi[6] = binary.LittleEndian.Uint64(b[6*8 : 7*8]) - - red64(&got, &lo, &hi) - - t := conv.BytesLe2BigInt(data[:2*Size]) - - two448 := big.NewInt(1) - two448.Lsh(two448, 448) // 2^448 - mask448 := big.NewInt(1) - mask448.Sub(two448, mask448) // 2^448-1 - two224plus1 := big.NewInt(1) - two224plus1.Lsh(two224plus1, 224) - two224plus1.Add(two224plus1, big.NewInt(1)) // 2^224+1 - - var loBig, hiBig big.Int - for t.Cmp(two448) >= 0 { - loBig.And(t, mask448) - hiBig.Rsh(t, 448) - t.Mul(&hiBig, two224plus1) - t.Add(t, &loBig) - } - conv.BigInt2BytesLe(want[:], t) - - if got != want { - fmt.Printf("in: %v\n", conv.BytesLe2BigInt(data[:2*Size])) - fmt.Printf("got: %v\n", got) - fmt.Printf("want: %v\n", want) - panic("error found") - } - return 1 -} diff --git a/backend/vendor/github.com/cloudflare/circl/math/integer.go b/backend/vendor/github.com/cloudflare/circl/math/integer.go deleted file mode 100644 index 9c80c23..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/integer.go +++ /dev/null @@ -1,16 +0,0 @@ -package math - -import "math/bits" - -// NextPow2 finds the next power of two (N=2^k, k>=0) greater than n. -// If n is already a power of two, then this function returns n, and log2(n). -func NextPow2(n uint) (N uint, k uint) { - if bits.OnesCount(n) == 1 { - k = uint(bits.TrailingZeros(n)) - N = n - } else { - k = uint(bits.Len(n)) - N = uint(1) << k - } - return -} diff --git a/backend/vendor/github.com/cloudflare/circl/math/mlsbset/mlsbset.go b/backend/vendor/github.com/cloudflare/circl/math/mlsbset/mlsbset.go deleted file mode 100644 index a43851b..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/mlsbset/mlsbset.go +++ /dev/null @@ -1,122 +0,0 @@ -// Package mlsbset provides a constant-time exponentiation method with precomputation. -// -// References: "Efficient and secure algorithms for GLV-based scalar -// multiplication and their implementation on GLV–GLS curves" by (Faz-Hernandez et al.) -// - https://doi.org/10.1007/s13389-014-0085-7 -// - https://eprint.iacr.org/2013/158 -package mlsbset - -import ( - "errors" - "fmt" - "math/big" - - "github.com/cloudflare/circl/internal/conv" -) - -// EltG is a group element. -type EltG interface{} - -// EltP is a precomputed group element. -type EltP interface{} - -// Group defines the operations required by MLSBSet exponentiation method. -type Group interface { - Identity() EltG // Returns the identity of the group. - Sqr(x EltG) // Calculates x = x^2. - Mul(x EltG, y EltP) // Calculates x = x*y. - NewEltP() EltP // Returns an arbitrary precomputed element. - ExtendedEltP() EltP // Returns the precomputed element x^(2^(w*d)). - Lookup(a EltP, v uint, s, u int32) // Sets a = s*T[v][u]. -} - -// Params contains the parameters of the encoding. -type Params struct { - T uint // T is the maximum size (in bits) of exponents. - V uint // V is the number of tables. - W uint // W is the window size. - E uint // E is the number of digits per table. - D uint // D is the number of digits in total. - L uint // L is the length of the code. -} - -// Encoder allows to convert integers into valid powers. -type Encoder struct{ p Params } - -// New produces an encoder of the MLSBSet algorithm. -func New(t, v, w uint) (Encoder, error) { - if !(t > 1 && v >= 1 && w >= 2) { - return Encoder{}, errors.New("t>1, v>=1, w>=2") - } - e := (t + w*v - 1) / (w * v) - d := e * v - l := d * w - return Encoder{Params{t, v, w, e, d, l}}, nil -} - -// Encode converts an odd integer k into a valid power for exponentiation. -func (m Encoder) Encode(k []byte) (*Power, error) { - if len(k) == 0 { - return nil, errors.New("empty slice") - } - if !(len(k) <= int(m.p.L+7)>>3) { - return nil, errors.New("k too big") - } - if k[0]%2 == 0 { - return nil, errors.New("k must be odd") - } - ap := int((m.p.L+7)/8) - len(k) - k = append(k, make([]byte, ap)...) - s := m.signs(k) - b := make([]int32, m.p.L-m.p.D) - c := conv.BytesLe2BigInt(k) - c.Rsh(c, m.p.D) - var bi big.Int - for i := m.p.D; i < m.p.L; i++ { - c0 := int32(c.Bit(0)) - b[i-m.p.D] = s[i%m.p.D] * c0 - bi.SetInt64(int64(b[i-m.p.D] >> 1)) - c.Rsh(c, 1) - c.Sub(c, &bi) - } - carry := int(c.Int64()) - return &Power{m, s, b, carry}, nil -} - -// signs calculates the set of signs. -func (m Encoder) signs(k []byte) []int32 { - s := make([]int32, m.p.D) - s[m.p.D-1] = 1 - for i := uint(1); i < m.p.D; i++ { - ki := int32((k[i>>3] >> (i & 0x7)) & 0x1) - s[i-1] = 2*ki - 1 - } - return s -} - -// GetParams returns the complementary parameters of the encoding. -func (m Encoder) GetParams() Params { return m.p } - -// tableSize returns the size of each table. -func (m Encoder) tableSize() uint { return 1 << (m.p.W - 1) } - -// Elts returns the total number of elements that must be precomputed. -func (m Encoder) Elts() uint { return m.p.V * m.tableSize() } - -// IsExtended returns true if the element x^(2^(wd)) must be calculated. -func (m Encoder) IsExtended() bool { q := m.p.T / (m.p.V * m.p.W); return m.p.T == q*m.p.V*m.p.W } - -// Ops returns the number of squares and multiplications executed during an exponentiation. -func (m Encoder) Ops() (S uint, M uint) { - S = m.p.E - M = m.p.E * m.p.V - if m.IsExtended() { - M++ - } - return -} - -func (m Encoder) String() string { - return fmt.Sprintf("T: %v W: %v V: %v e: %v d: %v l: %v wv|t: %v", - m.p.T, m.p.W, m.p.V, m.p.E, m.p.D, m.p.L, m.IsExtended()) -} diff --git a/backend/vendor/github.com/cloudflare/circl/math/mlsbset/power.go b/backend/vendor/github.com/cloudflare/circl/math/mlsbset/power.go deleted file mode 100644 index 3f214c3..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/mlsbset/power.go +++ /dev/null @@ -1,64 +0,0 @@ -package mlsbset - -import "fmt" - -// Power is a valid exponent produced by the MLSBSet encoding algorithm. -type Power struct { - set Encoder // parameters of code. - s []int32 // set of signs. - b []int32 // set of digits. - c int // carry is {0,1}. -} - -// Exp is calculates x^k, where x is a predetermined element of a group G. -func (p *Power) Exp(G Group) EltG { - a, b := G.Identity(), G.NewEltP() - for e := int(p.set.p.E - 1); e >= 0; e-- { - G.Sqr(a) - for v := uint(0); v < p.set.p.V; v++ { - sgnElt, idElt := p.Digit(v, uint(e)) - G.Lookup(b, v, sgnElt, idElt) - G.Mul(a, b) - } - } - if p.set.IsExtended() && p.c == 1 { - G.Mul(a, G.ExtendedEltP()) - } - return a -} - -// Digit returns the (v,e)-th digit and its sign. -func (p *Power) Digit(v, e uint) (sgn, dig int32) { - sgn = p.bit(0, v, e) - dig = 0 - for i := p.set.p.W - 1; i > 0; i-- { - dig = 2*dig + p.bit(i, v, e) - } - mask := dig >> 31 - dig = (dig + mask) ^ mask - return sgn, dig -} - -// bit returns the (w,v,e)-th bit of the code. -func (p *Power) bit(w, v, e uint) int32 { - if !(w < p.set.p.W && - v < p.set.p.V && - e < p.set.p.E) { - panic(fmt.Errorf("indexes outside (%v,%v,%v)", w, v, e)) - } - if w == 0 { - return p.s[p.set.p.E*v+e] - } - return p.b[p.set.p.D*(w-1)+p.set.p.E*v+e] -} - -func (p *Power) String() string { - dig := "" - for j := uint(0); j < p.set.p.V; j++ { - for i := uint(0); i < p.set.p.E; i++ { - s, d := p.Digit(j, i) - dig += fmt.Sprintf("(%2v,%2v) = %+2v %+2v\n", j, i, s, d) - } - } - return fmt.Sprintf("len: %v\ncarry: %v\ndigits:\n%v", len(p.b)+len(p.s), p.c, dig) -} diff --git a/backend/vendor/github.com/cloudflare/circl/math/primes.go b/backend/vendor/github.com/cloudflare/circl/math/primes.go deleted file mode 100644 index 158fd83..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/primes.go +++ /dev/null @@ -1,34 +0,0 @@ -package math - -import ( - "crypto/rand" - "io" - "math/big" -) - -// IsSafePrime reports whether p is (probably) a safe prime. -// The prime p=2*q+1 is safe prime if both p and q are primes. -// Note that ProbablyPrime is not suitable for judging primes -// that an adversary may have crafted to fool the test. -func IsSafePrime(p *big.Int) bool { - pdiv2 := new(big.Int).Rsh(p, 1) - return p.ProbablyPrime(20) && pdiv2.ProbablyPrime(20) -} - -// SafePrime returns a number of the given bit length that is a safe prime with high probability. -// The number returned p=2*q+1 is a safe prime if both p and q are primes. -// SafePrime will return error for any error returned by rand.Read or if bits < 2. -func SafePrime(random io.Reader, bits int) (*big.Int, error) { - one := big.NewInt(1) - p := new(big.Int) - for { - q, err := rand.Prime(random, bits-1) - if err != nil { - return nil, err - } - p.Lsh(q, 1).Add(p, one) - if p.ProbablyPrime(20) { - return p, nil - } - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/math/wnaf.go b/backend/vendor/github.com/cloudflare/circl/math/wnaf.go deleted file mode 100644 index 94a1ec5..0000000 --- a/backend/vendor/github.com/cloudflare/circl/math/wnaf.go +++ /dev/null @@ -1,84 +0,0 @@ -// Package math provides some utility functions for big integers. -package math - -import "math/big" - -// SignedDigit obtains the signed-digit recoding of n and returns a list L of -// digits such that n = sum( L[i]*2^(i*(w-1)) ), and each L[i] is an odd number -// in the set {±1, ±3, ..., ±2^(w-1)-1}. The third parameter ensures that the -// output has ceil(l/(w-1)) digits. -// -// Restrictions: -// - n is odd and n > 0. -// - 1 < w < 32. -// - l >= bit length of n. -// -// References: -// - Alg.6 in "Exponent Recoding and Regular Exponentiation Algorithms" -// by Joye-Tunstall. http://doi.org/10.1007/978-3-642-02384-2_21 -// - Alg.6 in "Selecting Elliptic Curves for Cryptography: An Efficiency and -// Security Analysis" by Bos et al. http://doi.org/10.1007/s13389-015-0097-y -func SignedDigit(n *big.Int, w, l uint) []int32 { - if n.Sign() <= 0 || n.Bit(0) == 0 { - panic("n must be non-zero, odd, and positive") - } - if w <= 1 || w >= 32 { - panic("Verify that 1 < w < 32") - } - if uint(n.BitLen()) > l { - panic("n is too big to fit in l digits") - } - lenN := (l + (w - 1) - 1) / (w - 1) // ceil(l/(w-1)) - L := make([]int32, lenN+1) - var k, v big.Int - k.Set(n) - - var i uint - for i = 0; i < lenN; i++ { - words := k.Bits() - value := int32(words[0] & ((1 << w) - 1)) - value -= int32(1) << (w - 1) - L[i] = value - v.SetInt64(int64(value)) - k.Sub(&k, &v) - k.Rsh(&k, w-1) - } - L[i] = int32(k.Int64()) - return L -} - -// OmegaNAF obtains the window-w Non-Adjacent Form of a positive number n and -// 1 < w < 32. The returned slice L holds n = sum( L[i]*2^i ). -// -// Reference: -// - Alg.9 "Efficient arithmetic on Koblitz curves" by Solinas. -// http://doi.org/10.1023/A:1008306223194 -func OmegaNAF(n *big.Int, w uint) (L []int32) { - if n.Sign() < 0 { - panic("n must be positive") - } - if w <= 1 || w >= 32 { - panic("Verify that 1 < w < 32") - } - - L = make([]int32, n.BitLen()+1) - var k, v big.Int - k.Set(n) - - i := 0 - for ; k.Sign() > 0; i++ { - value := int32(0) - if k.Bit(0) == 1 { - words := k.Bits() - value = int32(words[0] & ((1 << w) - 1)) - if value >= (int32(1) << (w - 1)) { - value -= int32(1) << w - } - v.SetInt64(int64(value)) - k.Sub(&k, &v) - } - L[i] = value - k.Rsh(&k, 1) - } - return L[:i] -} diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/amd64.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/amd64.go deleted file mode 100644 index 2c96563..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/amd64.go +++ /dev/null @@ -1,302 +0,0 @@ -//go:build amd64 && !purego -// +build amd64,!purego - -package common - -import ( - "golang.org/x/sys/cpu" -) - -// ZetasAVX2 contains all ζ used in NTT (like the Zetas array), but also -// the values int16(zeta * 62209) for each zeta, which is used in -// Montgomery reduction. There is some duplication and reordering as -// compared to Zetas to make it more convenient for use with AVX2. -var ZetasAVX2 = [...]int16{ - // level 1: int16(Zetas[1]*62209) and Zetas[1] - 31499, 2571, - - // level 2 - // - // int16(Zetas[2]*62209), Zetas[2], int16(Zetas[3]*62209), Zetas[3] - 14746, 2970, 788, 1812, - - // level 3, like level 2. - 13525, 1493, -12402, 1422, 28191, 287, -16694, 202, - - 0, 0, // padding - - // layer 4. offset: 1*16 - // - // The precomputed multiplication and zetas are grouped by 16 at a - // time as used in the set of butterflies, etc. - -20906, -20906, -20906, -20906, -20906, -20906, -20906, -20906, - 27758, 27758, 27758, 27758, 27758, 27758, 27758, 27758, - 3158, 3158, 3158, 3158, 3158, 3158, 3158, 3158, - 622, 622, 622, 622, 622, 622, 622, 622, - -3799, -3799, -3799, -3799, -3799, -3799, -3799, -3799, - -15690, -15690, -15690, -15690, -15690, -15690, -15690, -15690, - 1577, 1577, 1577, 1577, 1577, 1577, 1577, 1577, - 182, 182, 182, 182, 182, 182, 182, 182, - 10690, 10690, 10690, 10690, 10690, 10690, 10690, 10690, - 1359, 1359, 1359, 1359, 1359, 1359, 1359, 1359, - 962, 962, 962, 962, 962, 962, 962, 962, - 2127, 2127, 2127, 2127, 2127, 2127, 2127, 2127, - -11201, -11201, -11201, -11201, -11201, -11201, -11201, -11201, - 31164, 31164, 31164, 31164, 31164, 31164, 31164, 31164, - 1855, 1855, 1855, 1855, 1855, 1855, 1855, 1855, - 1468, 1468, 1468, 1468, 1468, 1468, 1468, 1468, - - // layer 5. offset: 9*16 - -5827, -5827, -5827, -5827, 17364, 17364, 17364, 17364, - -26360, -26360, -26360, -26360, -29057, -29057, -29057, -29057, - 573, 573, 573, 573, 2004, 2004, 2004, 2004, - 264, 264, 264, 264, 383, 383, 383, 383, - 5572, 5572, 5572, 5572, -1102, -1102, -1102, -1102, - 21439, 21439, 21439, 21439, -26241, -26241, -26241, -26241, - 2500, 2500, 2500, 2500, 1458, 1458, 1458, 1458, - 1727, 1727, 1727, 1727, 3199, 3199, 3199, 3199, - -28072, -28072, -28072, -28072, 24313, 24313, 24313, 24313, - -10532, -10532, -10532, -10532, 8800, 8800, 8800, 8800, - 2648, 2648, 2648, 2648, 1017, 1017, 1017, 1017, - 732, 732, 732, 732, 608, 608, 608, 608, - 18427, 18427, 18427, 18427, 8859, 8859, 8859, 8859, - 26676, 26676, 26676, 26676, -16162, -16162, -16162, -16162, - 1787, 1787, 1787, 1787, 411, 411, 411, 411, - 3124, 3124, 3124, 3124, 1758, 1758, 1758, 1758, - - // layer 6. offset: 17*16 - -5689, -5689, -6516, -6516, 1497, 1497, 30967, 30967, - -23564, -23564, 20179, 20179, 20711, 20711, 25081, 25081, - 1223, 1223, 652, 652, 2777, 2777, 1015, 1015, - 2036, 2036, 1491, 1491, 3047, 3047, 1785, 1785, - -12796, -12796, 26617, 26617, 16065, 16065, -12441, -12441, - 9135, 9135, -649, -649, -25986, -25986, 27837, 27837, - 516, 516, 3321, 3321, 3009, 3009, 2663, 2663, - 1711, 1711, 2167, 2167, 126, 126, 1469, 1469, - 19884, 19884, -28249, -28249, -15886, -15886, -8898, -8898, - -28309, -28309, 9076, 9076, -30198, -30198, 18250, 18250, - 2476, 2476, 3239, 3239, 3058, 3058, 830, 830, - 107, 107, 1908, 1908, 3082, 3082, 2378, 2378, - 13427, 13427, 14017, 14017, -29155, -29155, -12756, -12756, - 16832, 16832, 4312, 4312, -24155, -24155, -17914, -17914, - 2931, 2931, 961, 961, 1821, 1821, 2604, 2604, - 448, 448, 2264, 2264, 677, 677, 2054, 2054, - - // layer 7. offset: 25*16 - -334, 11182, -11477, 13387, -32226, -14233, 20494, -21655, - -27738, 13131, 945, -4586, -14882, 23093, 6182, 5493, - 2226, 430, 555, 843, 2078, 871, 1550, 105, - 422, 587, 177, 3094, 3038, 2869, 1574, 1653, - 32011, -32502, 10631, 30318, 29176, -18741, -28761, 12639, - -18485, 20100, 17561, 18525, -14430, 19529, -5275, -12618, - 3083, 778, 1159, 3182, 2552, 1483, 2727, 1119, - 1739, 644, 2457, 349, 418, 329, 3173, 3254, - -31183, 20297, 25435, 2146, -7382, 15356, 24392, -32384, - -20926, -6279, 10946, -14902, 24215, -11044, 16990, 14470, - 817, 1097, 603, 610, 1322, 2044, 1864, 384, - 2114, 3193, 1218, 1994, 2455, 220, 2142, 1670, - 10336, -21497, -7933, -20198, -22501, 23211, 10907, -17442, - 31637, -23859, 28644, -20257, 23998, 7757, -17422, 23132, - 2144, 1799, 2051, 794, 1819, 2475, 2459, 478, - 3221, 3021, 996, 991, 958, 1869, 1522, 1628, - - // layer 1 inverse - 23132, -17422, 7757, 23998, -20257, 28644, -23859, 31637, - -17442, 10907, 23211, -22501, -20198, -7933, -21497, 10336, - 1628, 1522, 1869, 958, 991, 996, 3021, 3221, - 478, 2459, 2475, 1819, 794, 2051, 1799, 2144, - 14470, 16990, -11044, 24215, -14902, 10946, -6279, -20926, - -32384, 24392, 15356, -7382, 2146, 25435, 20297, -31183, - 1670, 2142, 220, 2455, 1994, 1218, 3193, 2114, - 384, 1864, 2044, 1322, 610, 603, 1097, 817, - -12618, -5275, 19529, -14430, 18525, 17561, 20100, -18485, - 12639, -28761, -18741, 29176, 30318, 10631, -32502, 32011, - 3254, 3173, 329, 418, 349, 2457, 644, 1739, - 1119, 2727, 1483, 2552, 3182, 1159, 778, 3083, - 5493, 6182, 23093, -14882, -4586, 945, 13131, -27738, - -21655, 20494, -14233, -32226, 13387, -11477, 11182, -334, - 1653, 1574, 2869, 3038, 3094, 177, 587, 422, - 105, 1550, 871, 2078, 843, 555, 430, 2226, - - // layer 2 inverse - -17914, -17914, -24155, -24155, 4312, 4312, 16832, 16832, - -12756, -12756, -29155, -29155, 14017, 14017, 13427, 13427, - 2054, 2054, 677, 677, 2264, 2264, 448, 448, - 2604, 2604, 1821, 1821, 961, 961, 2931, 2931, - 18250, 18250, -30198, -30198, 9076, 9076, -28309, -28309, - -8898, -8898, -15886, -15886, -28249, -28249, 19884, 19884, - 2378, 2378, 3082, 3082, 1908, 1908, 107, 107, - 830, 830, 3058, 3058, 3239, 3239, 2476, 2476, - 27837, 27837, -25986, -25986, -649, -649, 9135, 9135, - -12441, -12441, 16065, 16065, 26617, 26617, -12796, -12796, - 1469, 1469, 126, 126, 2167, 2167, 1711, 1711, - 2663, 2663, 3009, 3009, 3321, 3321, 516, 516, - 25081, 25081, 20711, 20711, 20179, 20179, -23564, -23564, - 30967, 30967, 1497, 1497, -6516, -6516, -5689, -5689, - 1785, 1785, 3047, 3047, 1491, 1491, 2036, 2036, - 1015, 1015, 2777, 2777, 652, 652, 1223, 1223, - - // layer 3 inverse - -16162, -16162, -16162, -16162, 26676, 26676, 26676, 26676, - 8859, 8859, 8859, 8859, 18427, 18427, 18427, 18427, - 1758, 1758, 1758, 1758, 3124, 3124, 3124, 3124, - 411, 411, 411, 411, 1787, 1787, 1787, 1787, - 8800, 8800, 8800, 8800, -10532, -10532, -10532, -10532, - 24313, 24313, 24313, 24313, -28072, -28072, -28072, -28072, - 608, 608, 608, 608, 732, 732, 732, 732, - 1017, 1017, 1017, 1017, 2648, 2648, 2648, 2648, - -26241, -26241, -26241, -26241, 21439, 21439, 21439, 21439, - -1102, -1102, -1102, -1102, 5572, 5572, 5572, 5572, - 3199, 3199, 3199, 3199, 1727, 1727, 1727, 1727, - 1458, 1458, 1458, 1458, 2500, 2500, 2500, 2500, - -29057, -29057, -29057, -29057, -26360, -26360, -26360, -26360, - 17364, 17364, 17364, 17364, -5827, -5827, -5827, -5827, - 383, 383, 383, 383, 264, 264, 264, 264, - 2004, 2004, 2004, 2004, 573, 573, 573, 573, - - // layer 4 inverse - 31164, 31164, 31164, 31164, 31164, 31164, 31164, 31164, - -11201, -11201, -11201, -11201, -11201, -11201, -11201, -11201, - 1468, 1468, 1468, 1468, 1468, 1468, 1468, 1468, - 1855, 1855, 1855, 1855, 1855, 1855, 1855, 1855, - 1359, 1359, 1359, 1359, 1359, 1359, 1359, 1359, - 10690, 10690, 10690, 10690, 10690, 10690, 10690, 10690, - 2127, 2127, 2127, 2127, 2127, 2127, 2127, 2127, - 962, 962, 962, 962, 962, 962, 962, 962, - -15690, -15690, -15690, -15690, -15690, -15690, -15690, -15690, - -3799, -3799, -3799, -3799, -3799, -3799, -3799, -3799, - 182, 182, 182, 182, 182, 182, 182, 182, - 1577, 1577, 1577, 1577, 1577, 1577, 1577, 1577, - 27758, 27758, 27758, 27758, 27758, 27758, 27758, 27758, - -20906, -20906, -20906, -20906, -20906, -20906, -20906, -20906, - 622, 622, 622, 622, 622, 622, 622, 622, - 3158, 3158, 3158, 3158, 3158, 3158, 3158, 3158, - - // layer 5 inverse - -16694, 202, 28191, 287, -12402, 1422, 13525, 1493, - - // layer 6 inverse - 788, 1812, 14746, 2970, - - // layer 7 inverse - 31499, 2571, -} - -// Sets p to a + b. Does not normalize coefficients. -func (p *Poly) Add(a, b *Poly) { - if cpu.X86.HasAVX2 { - addAVX2( - (*[N]int16)(p), - (*[N]int16)(a), - (*[N]int16)(b), - ) - } else { - p.addGeneric(a, b) - } -} - -// Sets p to a - b. Does not normalize coefficients. -func (p *Poly) Sub(a, b *Poly) { - if cpu.X86.HasAVX2 { - subAVX2( - (*[N]int16)(p), - (*[N]int16)(a), - (*[N]int16)(b), - ) - } else { - p.subGeneric(a, b) - } -} - -// Executes an in-place forward "NTT" on p. -// -// Assumes the coefficients are in absolute value ≤q. The resulting -// coefficients are in absolute value ≤7q. If the input is in Montgomery -// form, then the result is in Montgomery form and so (by linearity of the NTT) -// if the input is in regular form, then the result is also in regular form. -// The order of coefficients will be "tangled". These can be put back into -// their proper order by calling Detangle(). -func (p *Poly) NTT() { - if cpu.X86.HasAVX2 { - nttAVX2((*[N]int16)(p)) - } else { - p.nttGeneric() - } -} - -// Executes an in-place inverse "NTT" on p and multiply by the Montgomery -// factor R. -// -// Requires coefficients to be in "tangled" order, see Tangle(). -// Assumes the coefficients are in absolute value ≤q. The resulting -// coefficients are in absolute value ≤q. If the input is in Montgomery -// form, then the result is in Montgomery form and so (by linearity) -// if the input is in regular form, then the result is also in regular form. -func (p *Poly) InvNTT() { - if cpu.X86.HasAVX2 { - invNttAVX2((*[N]int16)(p)) - } else { - p.invNTTGeneric() - } -} - -// Sets p to the "pointwise" multiplication of a and b. -// -// That is: InvNTT(p) = InvNTT(a) * InvNTT(b). Assumes a and b are in -// Montgomery form. Products between coefficients of a and b must be strictly -// bounded in absolute value by 2¹⁵q. p will be in Montgomery form and -// bounded in absolute value by 2q. -// -// Requires a and b to be in "tangled" order, see Tangle(). p will be in -// tangled order as well. -func (p *Poly) MulHat(a, b *Poly) { - if cpu.X86.HasAVX2 { - mulHatAVX2( - (*[N]int16)(p), - (*[N]int16)(a), - (*[N]int16)(b), - ) - } else { - p.mulHatGeneric(a, b) - } -} - -// Puts p into the right form to be used with (among others) InvNTT(). -func (p *Poly) Tangle() { - if cpu.X86.HasAVX2 { - tangleAVX2((*[N]int16)(p)) - } - - // When AVX2 is not available, we use the standard order. -} - -// Puts p back into standard form. -func (p *Poly) Detangle() { - if cpu.X86.HasAVX2 { - detangleAVX2((*[N]int16)(p)) - } - - // When AVX2 is not available, we use the standard order. -} - -// Almost normalizes coefficients. -// -// Ensures each coefficient is in {0, …, q}. -func (p *Poly) BarrettReduce() { - if cpu.X86.HasAVX2 { - barrettReduceAVX2((*[N]int16)(p)) - } else { - p.barrettReduceGeneric() - } -} - -// Normalizes coefficients. -// -// Ensures each coefficient is in {0, …, q-1}. -func (p *Poly) Normalize() { - if cpu.X86.HasAVX2 { - normalizeAVX2((*[N]int16)(p)) - } else { - p.normalizeGeneric() - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/amd64.s b/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/amd64.s deleted file mode 100644 index 5c7536b..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/amd64.s +++ /dev/null @@ -1,2354 +0,0 @@ -// Code generated by command: go run src.go -out ../amd64.s -stubs ../stubs_amd64.go -pkg common. DO NOT EDIT. - -//go:build amd64 && !purego - -#include "textflag.h" - -// func addAVX2(p *[256]int16, a *[256]int16, b *[256]int16) -// Requires: AVX, AVX2 -TEXT ·addAVX2(SB), NOSPLIT, $0-24 - MOVQ p+0(FP), AX - MOVQ a+8(FP), CX - MOVQ b+16(FP), DX - VMOVDQU (CX), Y0 - VMOVDQU 32(CX), Y2 - VMOVDQU 64(CX), Y4 - VMOVDQU 96(CX), Y6 - VMOVDQU 128(CX), Y8 - VMOVDQU 160(CX), Y10 - VMOVDQU 192(CX), Y12 - VMOVDQU 224(CX), Y14 - VMOVDQU (DX), Y1 - VMOVDQU 32(DX), Y3 - VMOVDQU 64(DX), Y5 - VMOVDQU 96(DX), Y7 - VMOVDQU 128(DX), Y9 - VMOVDQU 160(DX), Y11 - VMOVDQU 192(DX), Y13 - VMOVDQU 224(DX), Y15 - VPADDW Y0, Y1, Y1 - VPADDW Y2, Y3, Y3 - VPADDW Y4, Y5, Y5 - VPADDW Y6, Y7, Y7 - VPADDW Y8, Y9, Y9 - VPADDW Y10, Y11, Y11 - VPADDW Y12, Y13, Y13 - VPADDW Y14, Y15, Y15 - VMOVDQU Y1, (AX) - VMOVDQU Y3, 32(AX) - VMOVDQU Y5, 64(AX) - VMOVDQU Y7, 96(AX) - VMOVDQU Y9, 128(AX) - VMOVDQU Y11, 160(AX) - VMOVDQU Y13, 192(AX) - VMOVDQU Y15, 224(AX) - VMOVDQU 256(CX), Y0 - VMOVDQU 288(CX), Y2 - VMOVDQU 320(CX), Y4 - VMOVDQU 352(CX), Y6 - VMOVDQU 384(CX), Y8 - VMOVDQU 416(CX), Y10 - VMOVDQU 448(CX), Y12 - VMOVDQU 480(CX), Y14 - VMOVDQU 256(DX), Y1 - VMOVDQU 288(DX), Y3 - VMOVDQU 320(DX), Y5 - VMOVDQU 352(DX), Y7 - VMOVDQU 384(DX), Y9 - VMOVDQU 416(DX), Y11 - VMOVDQU 448(DX), Y13 - VMOVDQU 480(DX), Y15 - VPADDW Y0, Y1, Y1 - VPADDW Y2, Y3, Y3 - VPADDW Y4, Y5, Y5 - VPADDW Y6, Y7, Y7 - VPADDW Y8, Y9, Y9 - VPADDW Y10, Y11, Y11 - VPADDW Y12, Y13, Y13 - VPADDW Y14, Y15, Y15 - VMOVDQU Y1, 256(AX) - VMOVDQU Y3, 288(AX) - VMOVDQU Y5, 320(AX) - VMOVDQU Y7, 352(AX) - VMOVDQU Y9, 384(AX) - VMOVDQU Y11, 416(AX) - VMOVDQU Y13, 448(AX) - VMOVDQU Y15, 480(AX) - RET - -// func subAVX2(p *[256]int16, a *[256]int16, b *[256]int16) -// Requires: AVX, AVX2 -TEXT ·subAVX2(SB), NOSPLIT, $0-24 - MOVQ p+0(FP), AX - MOVQ a+8(FP), CX - MOVQ b+16(FP), DX - VMOVDQU (CX), Y0 - VMOVDQU 32(CX), Y2 - VMOVDQU 64(CX), Y4 - VMOVDQU 96(CX), Y6 - VMOVDQU 128(CX), Y8 - VMOVDQU 160(CX), Y10 - VMOVDQU 192(CX), Y12 - VMOVDQU 224(CX), Y14 - VMOVDQU (DX), Y1 - VMOVDQU 32(DX), Y3 - VMOVDQU 64(DX), Y5 - VMOVDQU 96(DX), Y7 - VMOVDQU 128(DX), Y9 - VMOVDQU 160(DX), Y11 - VMOVDQU 192(DX), Y13 - VMOVDQU 224(DX), Y15 - VPSUBW Y1, Y0, Y1 - VPSUBW Y3, Y2, Y3 - VPSUBW Y5, Y4, Y5 - VPSUBW Y7, Y6, Y7 - VPSUBW Y9, Y8, Y9 - VPSUBW Y11, Y10, Y11 - VPSUBW Y13, Y12, Y13 - VPSUBW Y15, Y14, Y15 - VMOVDQU Y1, (AX) - VMOVDQU Y3, 32(AX) - VMOVDQU Y5, 64(AX) - VMOVDQU Y7, 96(AX) - VMOVDQU Y9, 128(AX) - VMOVDQU Y11, 160(AX) - VMOVDQU Y13, 192(AX) - VMOVDQU Y15, 224(AX) - VMOVDQU 256(CX), Y0 - VMOVDQU 288(CX), Y2 - VMOVDQU 320(CX), Y4 - VMOVDQU 352(CX), Y6 - VMOVDQU 384(CX), Y8 - VMOVDQU 416(CX), Y10 - VMOVDQU 448(CX), Y12 - VMOVDQU 480(CX), Y14 - VMOVDQU 256(DX), Y1 - VMOVDQU 288(DX), Y3 - VMOVDQU 320(DX), Y5 - VMOVDQU 352(DX), Y7 - VMOVDQU 384(DX), Y9 - VMOVDQU 416(DX), Y11 - VMOVDQU 448(DX), Y13 - VMOVDQU 480(DX), Y15 - VPSUBW Y1, Y0, Y1 - VPSUBW Y3, Y2, Y3 - VPSUBW Y5, Y4, Y5 - VPSUBW Y7, Y6, Y7 - VPSUBW Y9, Y8, Y9 - VPSUBW Y11, Y10, Y11 - VPSUBW Y13, Y12, Y13 - VPSUBW Y15, Y14, Y15 - VMOVDQU Y1, 256(AX) - VMOVDQU Y3, 288(AX) - VMOVDQU Y5, 320(AX) - VMOVDQU Y7, 352(AX) - VMOVDQU Y9, 384(AX) - VMOVDQU Y11, 416(AX) - VMOVDQU Y13, 448(AX) - VMOVDQU Y15, 480(AX) - RET - -// func nttAVX2(p *[256]int16) -// Requires: AVX, AVX2 -TEXT ·nttAVX2(SB), NOSPLIT, $0-8 - MOVQ p+0(FP), AX - LEAQ ·ZetasAVX2+0(SB), CX - MOVL $0x00000d01, DX - VMOVD DX, X0 - VPBROADCASTW X0, Y15 - VPBROADCASTW (CX), Y0 - VPBROADCASTW 2(CX), Y1 - VMOVDQU (AX), Y7 - VMOVDQU 32(AX), Y8 - VMOVDQU 64(AX), Y9 - VMOVDQU 96(AX), Y10 - VMOVDQU 256(AX), Y11 - VMOVDQU 288(AX), Y12 - VMOVDQU 320(AX), Y13 - VMOVDQU 352(AX), Y14 - VPMULLW Y11, Y0, Y2 - VPMULLW Y12, Y0, Y3 - VPMULLW Y13, Y0, Y4 - VPMULLW Y14, Y0, Y5 - VPMULHW Y11, Y1, Y11 - VPMULHW Y12, Y1, Y12 - VPMULHW Y13, Y1, Y13 - VPMULHW Y14, Y1, Y14 - VPMULHW Y2, Y15, Y2 - VPMULHW Y3, Y15, Y3 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPSUBW Y2, Y11, Y2 - VPSUBW Y3, Y12, Y3 - VPSUBW Y4, Y13, Y4 - VPSUBW Y5, Y14, Y5 - VPSUBW Y2, Y7, Y11 - VPSUBW Y3, Y8, Y12 - VPSUBW Y4, Y9, Y13 - VPSUBW Y5, Y10, Y14 - VPADDW Y2, Y7, Y7 - VPADDW Y3, Y8, Y8 - VPADDW Y4, Y9, Y9 - VPADDW Y5, Y10, Y10 - VMOVDQU Y7, (AX) - VMOVDQU Y8, 32(AX) - VMOVDQU Y9, 64(AX) - VMOVDQU Y10, 96(AX) - VMOVDQU Y11, 256(AX) - VMOVDQU Y12, 288(AX) - VMOVDQU Y13, 320(AX) - VMOVDQU Y14, 352(AX) - VMOVDQU 128(AX), Y7 - VMOVDQU 160(AX), Y8 - VMOVDQU 192(AX), Y9 - VMOVDQU 224(AX), Y10 - VMOVDQU 384(AX), Y11 - VMOVDQU 416(AX), Y12 - VMOVDQU 448(AX), Y13 - VMOVDQU 480(AX), Y14 - VPMULLW Y11, Y0, Y2 - VPMULLW Y12, Y0, Y3 - VPMULLW Y13, Y0, Y4 - VPMULLW Y14, Y0, Y5 - VPMULHW Y11, Y1, Y11 - VPMULHW Y12, Y1, Y12 - VPMULHW Y13, Y1, Y13 - VPMULHW Y14, Y1, Y14 - VPMULHW Y2, Y15, Y2 - VPMULHW Y3, Y15, Y3 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPSUBW Y2, Y11, Y2 - VPSUBW Y3, Y12, Y3 - VPSUBW Y4, Y13, Y4 - VPSUBW Y5, Y14, Y5 - VPSUBW Y2, Y7, Y11 - VPSUBW Y3, Y8, Y12 - VPSUBW Y4, Y9, Y13 - VPSUBW Y5, Y10, Y14 - VPADDW Y2, Y7, Y7 - VPADDW Y3, Y8, Y8 - VPADDW Y4, Y9, Y9 - VPADDW Y5, Y10, Y10 - VMOVDQU Y7, 128(AX) - VMOVDQU Y8, 160(AX) - VMOVDQU Y9, 192(AX) - VMOVDQU Y10, 224(AX) - VMOVDQU Y11, 384(AX) - VMOVDQU Y12, 416(AX) - VMOVDQU Y13, 448(AX) - VMOVDQU Y14, 480(AX) - VPBROADCASTW 4(CX), Y0 - VPBROADCASTW 6(CX), Y1 - VMOVDQU (AX), Y7 - VMOVDQU 32(AX), Y8 - VMOVDQU 64(AX), Y9 - VMOVDQU 96(AX), Y10 - VMOVDQU 128(AX), Y11 - VMOVDQU 160(AX), Y12 - VMOVDQU 192(AX), Y13 - VMOVDQU 224(AX), Y14 - VPMULLW Y11, Y0, Y2 - VPMULLW Y12, Y0, Y3 - VPMULLW Y13, Y0, Y4 - VPMULLW Y14, Y0, Y5 - VPMULHW Y11, Y1, Y11 - VPMULHW Y12, Y1, Y12 - VPMULHW Y13, Y1, Y13 - VPMULHW Y14, Y1, Y14 - VPMULHW Y2, Y15, Y2 - VPMULHW Y3, Y15, Y3 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPSUBW Y2, Y11, Y2 - VPSUBW Y3, Y12, Y3 - VPSUBW Y4, Y13, Y4 - VPSUBW Y5, Y14, Y5 - VPSUBW Y2, Y7, Y11 - VPSUBW Y3, Y8, Y12 - VPSUBW Y4, Y9, Y13 - VPSUBW Y5, Y10, Y14 - VPADDW Y2, Y7, Y7 - VPADDW Y3, Y8, Y8 - VPADDW Y4, Y9, Y9 - VPADDW Y5, Y10, Y10 - VPBROADCASTW 12(CX), Y0 - VPBROADCASTW 14(CX), Y1 - VPBROADCASTW 16(CX), Y2 - VPBROADCASTW 18(CX), Y3 - VPMULLW Y9, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULLW Y13, Y2, Y6 - VPMULLW Y14, Y2, Y0 - VPMULHW Y9, Y1, Y9 - VPMULHW Y10, Y1, Y10 - VPMULHW Y13, Y3, Y13 - VPMULHW Y14, Y3, Y14 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPMULHW Y6, Y15, Y6 - VPMULHW Y0, Y15, Y0 - VPSUBW Y4, Y9, Y4 - VPSUBW Y5, Y10, Y5 - VPSUBW Y6, Y13, Y6 - VPSUBW Y0, Y14, Y0 - VPSUBW Y4, Y7, Y9 - VPSUBW Y5, Y8, Y10 - VPSUBW Y6, Y11, Y13 - VPSUBW Y0, Y12, Y14 - VPADDW Y4, Y7, Y7 - VPADDW Y5, Y8, Y8 - VPADDW Y6, Y11, Y11 - VPADDW Y0, Y12, Y12 - VMOVDQU 32(CX), Y0 - VMOVDQU 64(CX), Y1 - VMOVDQU 96(CX), Y2 - VMOVDQU 128(CX), Y3 - VPERM2I128 $0x20, Y9, Y7, Y4 - VPERM2I128 $0x31, Y9, Y7, Y9 - VMOVDQA Y4, Y7 - VPERM2I128 $0x20, Y10, Y8, Y4 - VPERM2I128 $0x31, Y10, Y8, Y10 - VMOVDQA Y4, Y8 - VPERM2I128 $0x20, Y13, Y11, Y4 - VPERM2I128 $0x31, Y13, Y11, Y13 - VMOVDQA Y4, Y11 - VPERM2I128 $0x20, Y14, Y12, Y4 - VPERM2I128 $0x31, Y14, Y12, Y14 - VMOVDQA Y4, Y12 - VPMULLW Y8, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULLW Y12, Y2, Y6 - VPMULLW Y14, Y2, Y0 - VPMULHW Y8, Y1, Y8 - VPMULHW Y10, Y1, Y10 - VPMULHW Y12, Y3, Y12 - VPMULHW Y14, Y3, Y14 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPMULHW Y6, Y15, Y6 - VPMULHW Y0, Y15, Y0 - VPSUBW Y4, Y8, Y4 - VPSUBW Y5, Y10, Y5 - VPSUBW Y6, Y12, Y6 - VPSUBW Y0, Y14, Y0 - VPSUBW Y4, Y7, Y8 - VPSUBW Y5, Y9, Y10 - VPSUBW Y6, Y11, Y12 - VPSUBW Y0, Y13, Y14 - VPADDW Y4, Y7, Y7 - VPADDW Y5, Y9, Y9 - VPADDW Y6, Y11, Y11 - VPADDW Y0, Y13, Y13 - VMOVDQU 288(CX), Y0 - VMOVDQU 320(CX), Y1 - VMOVDQU 352(CX), Y2 - VMOVDQU 384(CX), Y3 - VPUNPCKLQDQ Y8, Y7, Y4 - VPUNPCKHQDQ Y8, Y7, Y8 - VMOVDQA Y4, Y7 - VPUNPCKLQDQ Y10, Y9, Y4 - VPUNPCKHQDQ Y10, Y9, Y10 - VMOVDQA Y4, Y9 - VPUNPCKLQDQ Y12, Y11, Y4 - VPUNPCKHQDQ Y12, Y11, Y12 - VMOVDQA Y4, Y11 - VPUNPCKLQDQ Y14, Y13, Y4 - VPUNPCKHQDQ Y14, Y13, Y14 - VMOVDQA Y4, Y13 - VPMULLW Y9, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULLW Y13, Y2, Y6 - VPMULLW Y14, Y2, Y0 - VPMULHW Y9, Y1, Y9 - VPMULHW Y10, Y1, Y10 - VPMULHW Y13, Y3, Y13 - VPMULHW Y14, Y3, Y14 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPMULHW Y6, Y15, Y6 - VPMULHW Y0, Y15, Y0 - VPSUBW Y4, Y9, Y4 - VPSUBW Y5, Y10, Y5 - VPSUBW Y6, Y13, Y6 - VPSUBW Y0, Y14, Y0 - VPSUBW Y4, Y7, Y9 - VPSUBW Y5, Y8, Y10 - VPSUBW Y6, Y11, Y13 - VPSUBW Y0, Y12, Y14 - VPADDW Y4, Y7, Y7 - VPADDW Y5, Y8, Y8 - VPADDW Y6, Y11, Y11 - VPADDW Y0, Y12, Y12 - VMOVDQU 544(CX), Y0 - VMOVDQU 576(CX), Y1 - VMOVDQU 608(CX), Y2 - VMOVDQU 640(CX), Y3 - VMOVSLDUP Y9, Y4 - VPBLENDD $0xaa, Y4, Y7, Y4 - VPSRLQ $0x20, Y7, Y7 - VPBLENDD $0xaa, Y9, Y7, Y9 - VMOVDQA Y4, Y7 - VMOVSLDUP Y10, Y4 - VPBLENDD $0xaa, Y4, Y8, Y4 - VPSRLQ $0x20, Y8, Y8 - VPBLENDD $0xaa, Y10, Y8, Y10 - VMOVDQA Y4, Y8 - VMOVSLDUP Y13, Y4 - VPBLENDD $0xaa, Y4, Y11, Y4 - VPSRLQ $0x20, Y11, Y11 - VPBLENDD $0xaa, Y13, Y11, Y13 - VMOVDQA Y4, Y11 - VMOVSLDUP Y14, Y4 - VPBLENDD $0xaa, Y4, Y12, Y4 - VPSRLQ $0x20, Y12, Y12 - VPBLENDD $0xaa, Y14, Y12, Y14 - VMOVDQA Y4, Y12 - VPMULLW Y8, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULLW Y12, Y2, Y6 - VPMULLW Y14, Y2, Y0 - VPMULHW Y8, Y1, Y8 - VPMULHW Y10, Y1, Y10 - VPMULHW Y12, Y3, Y12 - VPMULHW Y14, Y3, Y14 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPMULHW Y6, Y15, Y6 - VPMULHW Y0, Y15, Y0 - VPSUBW Y4, Y8, Y4 - VPSUBW Y5, Y10, Y5 - VPSUBW Y6, Y12, Y6 - VPSUBW Y0, Y14, Y0 - VPSUBW Y4, Y7, Y8 - VPSUBW Y5, Y9, Y10 - VPSUBW Y6, Y11, Y12 - VPSUBW Y0, Y13, Y14 - VPADDW Y4, Y7, Y7 - VPADDW Y5, Y9, Y9 - VPADDW Y6, Y11, Y11 - VPADDW Y0, Y13, Y13 - VMOVDQU 800(CX), Y0 - VMOVDQU 832(CX), Y1 - VMOVDQU 864(CX), Y2 - VMOVDQU 896(CX), Y3 - VPSLLD $0x10, Y8, Y4 - VPBLENDW $0xaa, Y4, Y7, Y4 - VPSRLD $0x10, Y7, Y7 - VPBLENDW $0xaa, Y8, Y7, Y8 - VMOVDQA Y4, Y7 - VPSLLD $0x10, Y10, Y4 - VPBLENDW $0xaa, Y4, Y9, Y4 - VPSRLD $0x10, Y9, Y9 - VPBLENDW $0xaa, Y10, Y9, Y10 - VMOVDQA Y4, Y9 - VPSLLD $0x10, Y12, Y4 - VPBLENDW $0xaa, Y4, Y11, Y4 - VPSRLD $0x10, Y11, Y11 - VPBLENDW $0xaa, Y12, Y11, Y12 - VMOVDQA Y4, Y11 - VPSLLD $0x10, Y14, Y4 - VPBLENDW $0xaa, Y4, Y13, Y4 - VPSRLD $0x10, Y13, Y13 - VPBLENDW $0xaa, Y14, Y13, Y14 - VMOVDQA Y4, Y13 - VPMULLW Y9, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULLW Y13, Y2, Y6 - VPMULLW Y14, Y2, Y0 - VPMULHW Y9, Y1, Y9 - VPMULHW Y10, Y1, Y10 - VPMULHW Y13, Y3, Y13 - VPMULHW Y14, Y3, Y14 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPMULHW Y6, Y15, Y6 - VPMULHW Y0, Y15, Y0 - VPSUBW Y4, Y9, Y4 - VPSUBW Y5, Y10, Y5 - VPSUBW Y6, Y13, Y6 - VPSUBW Y0, Y14, Y0 - VPSUBW Y4, Y7, Y9 - VPSUBW Y5, Y8, Y10 - VPSUBW Y6, Y11, Y13 - VPSUBW Y0, Y12, Y14 - VPADDW Y4, Y7, Y7 - VPADDW Y5, Y8, Y8 - VPADDW Y6, Y11, Y11 - VPADDW Y0, Y12, Y12 - VMOVDQU Y7, (AX) - VMOVDQU Y8, 32(AX) - VMOVDQU Y9, 64(AX) - VMOVDQU Y10, 96(AX) - VMOVDQU Y11, 128(AX) - VMOVDQU Y12, 160(AX) - VMOVDQU Y13, 192(AX) - VMOVDQU Y14, 224(AX) - VPBROADCASTW 8(CX), Y0 - VPBROADCASTW 10(CX), Y1 - VMOVDQU 256(AX), Y7 - VMOVDQU 288(AX), Y8 - VMOVDQU 320(AX), Y9 - VMOVDQU 352(AX), Y10 - VMOVDQU 384(AX), Y11 - VMOVDQU 416(AX), Y12 - VMOVDQU 448(AX), Y13 - VMOVDQU 480(AX), Y14 - VPMULLW Y11, Y0, Y2 - VPMULLW Y12, Y0, Y3 - VPMULLW Y13, Y0, Y4 - VPMULLW Y14, Y0, Y5 - VPMULHW Y11, Y1, Y11 - VPMULHW Y12, Y1, Y12 - VPMULHW Y13, Y1, Y13 - VPMULHW Y14, Y1, Y14 - VPMULHW Y2, Y15, Y2 - VPMULHW Y3, Y15, Y3 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPSUBW Y2, Y11, Y2 - VPSUBW Y3, Y12, Y3 - VPSUBW Y4, Y13, Y4 - VPSUBW Y5, Y14, Y5 - VPSUBW Y2, Y7, Y11 - VPSUBW Y3, Y8, Y12 - VPSUBW Y4, Y9, Y13 - VPSUBW Y5, Y10, Y14 - VPADDW Y2, Y7, Y7 - VPADDW Y3, Y8, Y8 - VPADDW Y4, Y9, Y9 - VPADDW Y5, Y10, Y10 - VPBROADCASTW 20(CX), Y0 - VPBROADCASTW 22(CX), Y1 - VPBROADCASTW 24(CX), Y2 - VPBROADCASTW 26(CX), Y3 - VPMULLW Y9, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULLW Y13, Y2, Y6 - VPMULLW Y14, Y2, Y0 - VPMULHW Y9, Y1, Y9 - VPMULHW Y10, Y1, Y10 - VPMULHW Y13, Y3, Y13 - VPMULHW Y14, Y3, Y14 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPMULHW Y6, Y15, Y6 - VPMULHW Y0, Y15, Y0 - VPSUBW Y4, Y9, Y4 - VPSUBW Y5, Y10, Y5 - VPSUBW Y6, Y13, Y6 - VPSUBW Y0, Y14, Y0 - VPSUBW Y4, Y7, Y9 - VPSUBW Y5, Y8, Y10 - VPSUBW Y6, Y11, Y13 - VPSUBW Y0, Y12, Y14 - VPADDW Y4, Y7, Y7 - VPADDW Y5, Y8, Y8 - VPADDW Y6, Y11, Y11 - VPADDW Y0, Y12, Y12 - VMOVDQU 160(CX), Y0 - VMOVDQU 192(CX), Y1 - VMOVDQU 224(CX), Y2 - VMOVDQU 256(CX), Y3 - VPERM2I128 $0x20, Y9, Y7, Y4 - VPERM2I128 $0x31, Y9, Y7, Y9 - VMOVDQA Y4, Y7 - VPERM2I128 $0x20, Y10, Y8, Y4 - VPERM2I128 $0x31, Y10, Y8, Y10 - VMOVDQA Y4, Y8 - VPERM2I128 $0x20, Y13, Y11, Y4 - VPERM2I128 $0x31, Y13, Y11, Y13 - VMOVDQA Y4, Y11 - VPERM2I128 $0x20, Y14, Y12, Y4 - VPERM2I128 $0x31, Y14, Y12, Y14 - VMOVDQA Y4, Y12 - VPMULLW Y8, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULLW Y12, Y2, Y6 - VPMULLW Y14, Y2, Y0 - VPMULHW Y8, Y1, Y8 - VPMULHW Y10, Y1, Y10 - VPMULHW Y12, Y3, Y12 - VPMULHW Y14, Y3, Y14 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPMULHW Y6, Y15, Y6 - VPMULHW Y0, Y15, Y0 - VPSUBW Y4, Y8, Y4 - VPSUBW Y5, Y10, Y5 - VPSUBW Y6, Y12, Y6 - VPSUBW Y0, Y14, Y0 - VPSUBW Y4, Y7, Y8 - VPSUBW Y5, Y9, Y10 - VPSUBW Y6, Y11, Y12 - VPSUBW Y0, Y13, Y14 - VPADDW Y4, Y7, Y7 - VPADDW Y5, Y9, Y9 - VPADDW Y6, Y11, Y11 - VPADDW Y0, Y13, Y13 - VMOVDQU 416(CX), Y0 - VMOVDQU 448(CX), Y1 - VMOVDQU 480(CX), Y2 - VMOVDQU 512(CX), Y3 - VPUNPCKLQDQ Y8, Y7, Y4 - VPUNPCKHQDQ Y8, Y7, Y8 - VMOVDQA Y4, Y7 - VPUNPCKLQDQ Y10, Y9, Y4 - VPUNPCKHQDQ Y10, Y9, Y10 - VMOVDQA Y4, Y9 - VPUNPCKLQDQ Y12, Y11, Y4 - VPUNPCKHQDQ Y12, Y11, Y12 - VMOVDQA Y4, Y11 - VPUNPCKLQDQ Y14, Y13, Y4 - VPUNPCKHQDQ Y14, Y13, Y14 - VMOVDQA Y4, Y13 - VPMULLW Y9, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULLW Y13, Y2, Y6 - VPMULLW Y14, Y2, Y0 - VPMULHW Y9, Y1, Y9 - VPMULHW Y10, Y1, Y10 - VPMULHW Y13, Y3, Y13 - VPMULHW Y14, Y3, Y14 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPMULHW Y6, Y15, Y6 - VPMULHW Y0, Y15, Y0 - VPSUBW Y4, Y9, Y4 - VPSUBW Y5, Y10, Y5 - VPSUBW Y6, Y13, Y6 - VPSUBW Y0, Y14, Y0 - VPSUBW Y4, Y7, Y9 - VPSUBW Y5, Y8, Y10 - VPSUBW Y6, Y11, Y13 - VPSUBW Y0, Y12, Y14 - VPADDW Y4, Y7, Y7 - VPADDW Y5, Y8, Y8 - VPADDW Y6, Y11, Y11 - VPADDW Y0, Y12, Y12 - VMOVDQU 672(CX), Y0 - VMOVDQU 704(CX), Y1 - VMOVDQU 736(CX), Y2 - VMOVDQU 768(CX), Y3 - VMOVSLDUP Y9, Y4 - VPBLENDD $0xaa, Y4, Y7, Y4 - VPSRLQ $0x20, Y7, Y7 - VPBLENDD $0xaa, Y9, Y7, Y9 - VMOVDQA Y4, Y7 - VMOVSLDUP Y10, Y4 - VPBLENDD $0xaa, Y4, Y8, Y4 - VPSRLQ $0x20, Y8, Y8 - VPBLENDD $0xaa, Y10, Y8, Y10 - VMOVDQA Y4, Y8 - VMOVSLDUP Y13, Y4 - VPBLENDD $0xaa, Y4, Y11, Y4 - VPSRLQ $0x20, Y11, Y11 - VPBLENDD $0xaa, Y13, Y11, Y13 - VMOVDQA Y4, Y11 - VMOVSLDUP Y14, Y4 - VPBLENDD $0xaa, Y4, Y12, Y4 - VPSRLQ $0x20, Y12, Y12 - VPBLENDD $0xaa, Y14, Y12, Y14 - VMOVDQA Y4, Y12 - VPMULLW Y8, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULLW Y12, Y2, Y6 - VPMULLW Y14, Y2, Y0 - VPMULHW Y8, Y1, Y8 - VPMULHW Y10, Y1, Y10 - VPMULHW Y12, Y3, Y12 - VPMULHW Y14, Y3, Y14 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPMULHW Y6, Y15, Y6 - VPMULHW Y0, Y15, Y0 - VPSUBW Y4, Y8, Y4 - VPSUBW Y5, Y10, Y5 - VPSUBW Y6, Y12, Y6 - VPSUBW Y0, Y14, Y0 - VPSUBW Y4, Y7, Y8 - VPSUBW Y5, Y9, Y10 - VPSUBW Y6, Y11, Y12 - VPSUBW Y0, Y13, Y14 - VPADDW Y4, Y7, Y7 - VPADDW Y5, Y9, Y9 - VPADDW Y6, Y11, Y11 - VPADDW Y0, Y13, Y13 - VMOVDQU 928(CX), Y0 - VMOVDQU 960(CX), Y1 - VMOVDQU 992(CX), Y2 - VMOVDQU 1024(CX), Y3 - VPSLLD $0x10, Y8, Y4 - VPBLENDW $0xaa, Y4, Y7, Y4 - VPSRLD $0x10, Y7, Y7 - VPBLENDW $0xaa, Y8, Y7, Y8 - VMOVDQA Y4, Y7 - VPSLLD $0x10, Y10, Y4 - VPBLENDW $0xaa, Y4, Y9, Y4 - VPSRLD $0x10, Y9, Y9 - VPBLENDW $0xaa, Y10, Y9, Y10 - VMOVDQA Y4, Y9 - VPSLLD $0x10, Y12, Y4 - VPBLENDW $0xaa, Y4, Y11, Y4 - VPSRLD $0x10, Y11, Y11 - VPBLENDW $0xaa, Y12, Y11, Y12 - VMOVDQA Y4, Y11 - VPSLLD $0x10, Y14, Y4 - VPBLENDW $0xaa, Y4, Y13, Y4 - VPSRLD $0x10, Y13, Y13 - VPBLENDW $0xaa, Y14, Y13, Y14 - VMOVDQA Y4, Y13 - VPMULLW Y9, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULLW Y13, Y2, Y6 - VPMULLW Y14, Y2, Y0 - VPMULHW Y9, Y1, Y9 - VPMULHW Y10, Y1, Y10 - VPMULHW Y13, Y3, Y13 - VPMULHW Y14, Y3, Y14 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPMULHW Y6, Y15, Y6 - VPMULHW Y0, Y15, Y0 - VPSUBW Y4, Y9, Y4 - VPSUBW Y5, Y10, Y5 - VPSUBW Y6, Y13, Y6 - VPSUBW Y0, Y14, Y0 - VPSUBW Y4, Y7, Y9 - VPSUBW Y5, Y8, Y10 - VPSUBW Y6, Y11, Y13 - VPSUBW Y0, Y12, Y14 - VPADDW Y4, Y7, Y7 - VPADDW Y5, Y8, Y8 - VPADDW Y6, Y11, Y11 - VPADDW Y0, Y12, Y12 - VMOVDQU Y7, 256(AX) - VMOVDQU Y8, 288(AX) - VMOVDQU Y9, 320(AX) - VMOVDQU Y10, 352(AX) - VMOVDQU Y11, 384(AX) - VMOVDQU Y12, 416(AX) - VMOVDQU Y13, 448(AX) - VMOVDQU Y14, 480(AX) - RET - -// func invNttAVX2(p *[256]int16) -// Requires: AVX, AVX2 -TEXT ·invNttAVX2(SB), NOSPLIT, $0-8 - MOVQ p+0(FP), AX - LEAQ ·ZetasAVX2+0(SB), CX - MOVL $0x00000d01, DX - VMOVD DX, X0 - VPBROADCASTW X0, Y15 - VMOVDQU (AX), Y7 - VMOVDQU 32(AX), Y8 - VMOVDQU 64(AX), Y9 - VMOVDQU 96(AX), Y10 - VMOVDQU 128(AX), Y11 - VMOVDQU 160(AX), Y12 - VMOVDQU 192(AX), Y13 - VMOVDQU 224(AX), Y14 - VMOVDQU 1056(CX), Y0 - VMOVDQU 1088(CX), Y1 - VMOVDQU 1120(CX), Y2 - VMOVDQU 1152(CX), Y3 - VPSUBW Y7, Y9, Y4 - VPSUBW Y8, Y10, Y5 - VPSUBW Y11, Y13, Y6 - VPADDW Y7, Y9, Y7 - VPADDW Y8, Y10, Y8 - VPADDW Y11, Y13, Y11 - VPMULLW Y4, Y0, Y9 - VPMULLW Y5, Y0, Y10 - VPSUBW Y12, Y14, Y0 - VPMULLW Y6, Y2, Y13 - VPADDW Y12, Y14, Y12 - VPMULLW Y0, Y2, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y3, Y6 - VPMULHW Y0, Y3, Y0 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y13, Y15, Y13 - VPMULHW Y14, Y15, Y14 - VPSUBW Y9, Y4, Y9 - VPSUBW Y10, Y5, Y10 - VPSUBW Y13, Y6, Y13 - VPSUBW Y14, Y0, Y14 - VMOVDQU 1312(CX), Y0 - VMOVDQU 1344(CX), Y1 - VMOVDQU 1376(CX), Y2 - VMOVDQU 1408(CX), Y3 - VPSLLD $0x10, Y8, Y4 - VPBLENDW $0xaa, Y4, Y7, Y4 - VPSRLD $0x10, Y7, Y7 - VPBLENDW $0xaa, Y8, Y7, Y8 - VMOVDQA Y4, Y7 - VPSLLD $0x10, Y10, Y4 - VPBLENDW $0xaa, Y4, Y9, Y4 - VPSRLD $0x10, Y9, Y9 - VPBLENDW $0xaa, Y10, Y9, Y10 - VMOVDQA Y4, Y9 - VPSLLD $0x10, Y12, Y4 - VPBLENDW $0xaa, Y4, Y11, Y4 - VPSRLD $0x10, Y11, Y11 - VPBLENDW $0xaa, Y12, Y11, Y12 - VMOVDQA Y4, Y11 - VPSLLD $0x10, Y14, Y4 - VPBLENDW $0xaa, Y4, Y13, Y4 - VPSRLD $0x10, Y13, Y13 - VPBLENDW $0xaa, Y14, Y13, Y14 - VMOVDQA Y4, Y13 - VPSUBW Y7, Y8, Y4 - VPSUBW Y9, Y10, Y5 - VPSUBW Y11, Y12, Y6 - VPADDW Y7, Y8, Y7 - VPADDW Y9, Y10, Y9 - VPADDW Y11, Y12, Y11 - VPMULLW Y4, Y0, Y8 - VPMULLW Y5, Y0, Y10 - VPSUBW Y13, Y14, Y0 - VPMULLW Y6, Y2, Y12 - VPADDW Y13, Y14, Y13 - VPMULLW Y0, Y2, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y3, Y6 - VPMULHW Y0, Y3, Y0 - VPMULHW Y8, Y15, Y8 - VPMULHW Y10, Y15, Y10 - VPMULHW Y12, Y15, Y12 - VPMULHW Y14, Y15, Y14 - VPSUBW Y8, Y4, Y8 - VPSUBW Y10, Y5, Y10 - VPSUBW Y12, Y6, Y12 - VPSUBW Y14, Y0, Y14 - VMOVDQU 1568(CX), Y0 - VMOVDQU 1600(CX), Y1 - VMOVDQU 1632(CX), Y2 - VMOVDQU 1664(CX), Y3 - VMOVSLDUP Y9, Y4 - VPBLENDD $0xaa, Y4, Y7, Y4 - VPSRLQ $0x20, Y7, Y7 - VPBLENDD $0xaa, Y9, Y7, Y9 - VMOVDQA Y4, Y7 - VMOVSLDUP Y10, Y4 - VPBLENDD $0xaa, Y4, Y8, Y4 - VPSRLQ $0x20, Y8, Y8 - VPBLENDD $0xaa, Y10, Y8, Y10 - VMOVDQA Y4, Y8 - VMOVSLDUP Y13, Y4 - VPBLENDD $0xaa, Y4, Y11, Y4 - VPSRLQ $0x20, Y11, Y11 - VPBLENDD $0xaa, Y13, Y11, Y13 - VMOVDQA Y4, Y11 - VMOVSLDUP Y14, Y4 - VPBLENDD $0xaa, Y4, Y12, Y4 - VPSRLQ $0x20, Y12, Y12 - VPBLENDD $0xaa, Y14, Y12, Y14 - VMOVDQA Y4, Y12 - VPSUBW Y7, Y9, Y4 - VPSUBW Y8, Y10, Y5 - VPSUBW Y11, Y13, Y6 - VPADDW Y7, Y9, Y7 - VPADDW Y8, Y10, Y8 - VPADDW Y11, Y13, Y11 - VPMULLW Y4, Y0, Y9 - VPMULLW Y5, Y0, Y10 - VPSUBW Y12, Y14, Y0 - VPMULLW Y6, Y2, Y13 - VPADDW Y12, Y14, Y12 - VPMULLW Y0, Y2, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y3, Y6 - VPMULHW Y0, Y3, Y0 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y13, Y15, Y13 - VPMULHW Y14, Y15, Y14 - VPSUBW Y9, Y4, Y9 - VPSUBW Y10, Y5, Y10 - VPSUBW Y13, Y6, Y13 - VPSUBW Y14, Y0, Y14 - MOVL $0x00004ebf, DX - VMOVD DX, X0 - VPBROADCASTW X0, Y4 - VPMULHW Y4, Y7, Y5 - VPSRAW $0x0a, Y5, Y5 - VPMULLW Y15, Y5, Y5 - VPSUBW Y5, Y7, Y7 - VPMULHW Y4, Y11, Y5 - VPSRAW $0x0a, Y5, Y5 - VPMULLW Y15, Y5, Y5 - VPSUBW Y5, Y11, Y11 - VMOVDQU 1824(CX), Y0 - VMOVDQU 1856(CX), Y1 - VMOVDQU 1888(CX), Y2 - VMOVDQU 1920(CX), Y3 - VPUNPCKLQDQ Y8, Y7, Y4 - VPUNPCKHQDQ Y8, Y7, Y8 - VMOVDQA Y4, Y7 - VPUNPCKLQDQ Y10, Y9, Y4 - VPUNPCKHQDQ Y10, Y9, Y10 - VMOVDQA Y4, Y9 - VPUNPCKLQDQ Y12, Y11, Y4 - VPUNPCKHQDQ Y12, Y11, Y12 - VMOVDQA Y4, Y11 - VPUNPCKLQDQ Y14, Y13, Y4 - VPUNPCKHQDQ Y14, Y13, Y14 - VMOVDQA Y4, Y13 - VPSUBW Y7, Y8, Y4 - VPSUBW Y9, Y10, Y5 - VPSUBW Y11, Y12, Y6 - VPADDW Y7, Y8, Y7 - VPADDW Y9, Y10, Y9 - VPADDW Y11, Y12, Y11 - VPMULLW Y4, Y0, Y8 - VPMULLW Y5, Y0, Y10 - VPSUBW Y13, Y14, Y0 - VPMULLW Y6, Y2, Y12 - VPADDW Y13, Y14, Y13 - VPMULLW Y0, Y2, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y3, Y6 - VPMULHW Y0, Y3, Y0 - VPMULHW Y8, Y15, Y8 - VPMULHW Y10, Y15, Y10 - VPMULHW Y12, Y15, Y12 - VPMULHW Y14, Y15, Y14 - VPSUBW Y8, Y4, Y8 - VPSUBW Y10, Y5, Y10 - VPSUBW Y12, Y6, Y12 - VPSUBW Y14, Y0, Y14 - VPBROADCASTW 2080(CX), Y0 - VPBROADCASTW 2082(CX), Y1 - VPBROADCASTW 2084(CX), Y2 - VPBROADCASTW 2086(CX), Y3 - VPERM2I128 $0x20, Y9, Y7, Y4 - VPERM2I128 $0x31, Y9, Y7, Y9 - VMOVDQA Y4, Y7 - VPERM2I128 $0x20, Y10, Y8, Y4 - VPERM2I128 $0x31, Y10, Y8, Y10 - VMOVDQA Y4, Y8 - VPERM2I128 $0x20, Y13, Y11, Y4 - VPERM2I128 $0x31, Y13, Y11, Y13 - VMOVDQA Y4, Y11 - VPERM2I128 $0x20, Y14, Y12, Y4 - VPERM2I128 $0x31, Y14, Y12, Y14 - VMOVDQA Y4, Y12 - VPSUBW Y7, Y9, Y4 - VPSUBW Y8, Y10, Y5 - VPSUBW Y11, Y13, Y6 - VPADDW Y7, Y9, Y7 - VPADDW Y8, Y10, Y8 - VPADDW Y11, Y13, Y11 - VPMULLW Y4, Y0, Y9 - VPMULLW Y5, Y0, Y10 - VPSUBW Y12, Y14, Y0 - VPMULLW Y6, Y2, Y13 - VPADDW Y12, Y14, Y12 - VPMULLW Y0, Y2, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y3, Y6 - VPMULHW Y0, Y3, Y0 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y13, Y15, Y13 - VPMULHW Y14, Y15, Y14 - VPSUBW Y9, Y4, Y9 - VPSUBW Y10, Y5, Y10 - VPSUBW Y13, Y6, Y13 - VPSUBW Y14, Y0, Y14 - MOVL $0x00004ebf, DX - VMOVD DX, X0 - VPBROADCASTW X0, Y4 - VPMULHW Y4, Y7, Y5 - VPSRAW $0x0a, Y5, Y5 - VPMULLW Y15, Y5, Y5 - VPSUBW Y5, Y7, Y7 - VPMULHW Y4, Y11, Y5 - VPSRAW $0x0a, Y5, Y5 - VPMULLW Y15, Y5, Y5 - VPSUBW Y5, Y11, Y11 - VPBROADCASTW 2096(CX), Y0 - VPBROADCASTW 2098(CX), Y1 - VPSUBW Y7, Y11, Y4 - VPSUBW Y8, Y12, Y5 - VPSUBW Y9, Y13, Y6 - VPADDW Y7, Y11, Y7 - VPADDW Y8, Y12, Y8 - VPADDW Y9, Y13, Y9 - VPMULLW Y4, Y0, Y11 - VPMULLW Y5, Y0, Y12 - VPSUBW Y10, Y14, Y2 - VPMULLW Y6, Y0, Y13 - VPADDW Y10, Y14, Y10 - VPMULLW Y2, Y0, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y1, Y6 - VPMULHW Y2, Y1, Y2 - VPMULHW Y11, Y15, Y11 - VPMULHW Y12, Y15, Y12 - VPMULHW Y13, Y15, Y13 - VPMULHW Y14, Y15, Y14 - VPSUBW Y11, Y4, Y11 - VPSUBW Y12, Y5, Y12 - VPSUBW Y13, Y6, Y13 - VPSUBW Y14, Y2, Y14 - VMOVDQU Y7, (AX) - VMOVDQU Y8, 32(AX) - VMOVDQU Y9, 64(AX) - VMOVDQU Y10, 96(AX) - VMOVDQU Y11, 128(AX) - VMOVDQU Y12, 160(AX) - VMOVDQU Y13, 192(AX) - VMOVDQU Y14, 224(AX) - VMOVDQU 256(AX), Y7 - VMOVDQU 288(AX), Y8 - VMOVDQU 320(AX), Y9 - VMOVDQU 352(AX), Y10 - VMOVDQU 384(AX), Y11 - VMOVDQU 416(AX), Y12 - VMOVDQU 448(AX), Y13 - VMOVDQU 480(AX), Y14 - VMOVDQU 1184(CX), Y0 - VMOVDQU 1216(CX), Y1 - VMOVDQU 1248(CX), Y2 - VMOVDQU 1280(CX), Y3 - VPSUBW Y7, Y9, Y4 - VPSUBW Y8, Y10, Y5 - VPSUBW Y11, Y13, Y6 - VPADDW Y7, Y9, Y7 - VPADDW Y8, Y10, Y8 - VPADDW Y11, Y13, Y11 - VPMULLW Y4, Y0, Y9 - VPMULLW Y5, Y0, Y10 - VPSUBW Y12, Y14, Y0 - VPMULLW Y6, Y2, Y13 - VPADDW Y12, Y14, Y12 - VPMULLW Y0, Y2, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y3, Y6 - VPMULHW Y0, Y3, Y0 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y13, Y15, Y13 - VPMULHW Y14, Y15, Y14 - VPSUBW Y9, Y4, Y9 - VPSUBW Y10, Y5, Y10 - VPSUBW Y13, Y6, Y13 - VPSUBW Y14, Y0, Y14 - VMOVDQU 1440(CX), Y0 - VMOVDQU 1472(CX), Y1 - VMOVDQU 1504(CX), Y2 - VMOVDQU 1536(CX), Y3 - VPSLLD $0x10, Y8, Y4 - VPBLENDW $0xaa, Y4, Y7, Y4 - VPSRLD $0x10, Y7, Y7 - VPBLENDW $0xaa, Y8, Y7, Y8 - VMOVDQA Y4, Y7 - VPSLLD $0x10, Y10, Y4 - VPBLENDW $0xaa, Y4, Y9, Y4 - VPSRLD $0x10, Y9, Y9 - VPBLENDW $0xaa, Y10, Y9, Y10 - VMOVDQA Y4, Y9 - VPSLLD $0x10, Y12, Y4 - VPBLENDW $0xaa, Y4, Y11, Y4 - VPSRLD $0x10, Y11, Y11 - VPBLENDW $0xaa, Y12, Y11, Y12 - VMOVDQA Y4, Y11 - VPSLLD $0x10, Y14, Y4 - VPBLENDW $0xaa, Y4, Y13, Y4 - VPSRLD $0x10, Y13, Y13 - VPBLENDW $0xaa, Y14, Y13, Y14 - VMOVDQA Y4, Y13 - VPSUBW Y7, Y8, Y4 - VPSUBW Y9, Y10, Y5 - VPSUBW Y11, Y12, Y6 - VPADDW Y7, Y8, Y7 - VPADDW Y9, Y10, Y9 - VPADDW Y11, Y12, Y11 - VPMULLW Y4, Y0, Y8 - VPMULLW Y5, Y0, Y10 - VPSUBW Y13, Y14, Y0 - VPMULLW Y6, Y2, Y12 - VPADDW Y13, Y14, Y13 - VPMULLW Y0, Y2, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y3, Y6 - VPMULHW Y0, Y3, Y0 - VPMULHW Y8, Y15, Y8 - VPMULHW Y10, Y15, Y10 - VPMULHW Y12, Y15, Y12 - VPMULHW Y14, Y15, Y14 - VPSUBW Y8, Y4, Y8 - VPSUBW Y10, Y5, Y10 - VPSUBW Y12, Y6, Y12 - VPSUBW Y14, Y0, Y14 - VMOVDQU 1696(CX), Y0 - VMOVDQU 1728(CX), Y1 - VMOVDQU 1760(CX), Y2 - VMOVDQU 1792(CX), Y3 - VMOVSLDUP Y9, Y4 - VPBLENDD $0xaa, Y4, Y7, Y4 - VPSRLQ $0x20, Y7, Y7 - VPBLENDD $0xaa, Y9, Y7, Y9 - VMOVDQA Y4, Y7 - VMOVSLDUP Y10, Y4 - VPBLENDD $0xaa, Y4, Y8, Y4 - VPSRLQ $0x20, Y8, Y8 - VPBLENDD $0xaa, Y10, Y8, Y10 - VMOVDQA Y4, Y8 - VMOVSLDUP Y13, Y4 - VPBLENDD $0xaa, Y4, Y11, Y4 - VPSRLQ $0x20, Y11, Y11 - VPBLENDD $0xaa, Y13, Y11, Y13 - VMOVDQA Y4, Y11 - VMOVSLDUP Y14, Y4 - VPBLENDD $0xaa, Y4, Y12, Y4 - VPSRLQ $0x20, Y12, Y12 - VPBLENDD $0xaa, Y14, Y12, Y14 - VMOVDQA Y4, Y12 - VPSUBW Y7, Y9, Y4 - VPSUBW Y8, Y10, Y5 - VPSUBW Y11, Y13, Y6 - VPADDW Y7, Y9, Y7 - VPADDW Y8, Y10, Y8 - VPADDW Y11, Y13, Y11 - VPMULLW Y4, Y0, Y9 - VPMULLW Y5, Y0, Y10 - VPSUBW Y12, Y14, Y0 - VPMULLW Y6, Y2, Y13 - VPADDW Y12, Y14, Y12 - VPMULLW Y0, Y2, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y3, Y6 - VPMULHW Y0, Y3, Y0 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y13, Y15, Y13 - VPMULHW Y14, Y15, Y14 - VPSUBW Y9, Y4, Y9 - VPSUBW Y10, Y5, Y10 - VPSUBW Y13, Y6, Y13 - VPSUBW Y14, Y0, Y14 - MOVL $0x00004ebf, DX - VMOVD DX, X0 - VPBROADCASTW X0, Y4 - VPMULHW Y4, Y7, Y5 - VPSRAW $0x0a, Y5, Y5 - VPMULLW Y15, Y5, Y5 - VPSUBW Y5, Y7, Y7 - VPMULHW Y4, Y11, Y5 - VPSRAW $0x0a, Y5, Y5 - VPMULLW Y15, Y5, Y5 - VPSUBW Y5, Y11, Y11 - VMOVDQU 1952(CX), Y0 - VMOVDQU 1984(CX), Y1 - VMOVDQU 2016(CX), Y2 - VMOVDQU 2048(CX), Y3 - VPUNPCKLQDQ Y8, Y7, Y4 - VPUNPCKHQDQ Y8, Y7, Y8 - VMOVDQA Y4, Y7 - VPUNPCKLQDQ Y10, Y9, Y4 - VPUNPCKHQDQ Y10, Y9, Y10 - VMOVDQA Y4, Y9 - VPUNPCKLQDQ Y12, Y11, Y4 - VPUNPCKHQDQ Y12, Y11, Y12 - VMOVDQA Y4, Y11 - VPUNPCKLQDQ Y14, Y13, Y4 - VPUNPCKHQDQ Y14, Y13, Y14 - VMOVDQA Y4, Y13 - VPSUBW Y7, Y8, Y4 - VPSUBW Y9, Y10, Y5 - VPSUBW Y11, Y12, Y6 - VPADDW Y7, Y8, Y7 - VPADDW Y9, Y10, Y9 - VPADDW Y11, Y12, Y11 - VPMULLW Y4, Y0, Y8 - VPMULLW Y5, Y0, Y10 - VPSUBW Y13, Y14, Y0 - VPMULLW Y6, Y2, Y12 - VPADDW Y13, Y14, Y13 - VPMULLW Y0, Y2, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y3, Y6 - VPMULHW Y0, Y3, Y0 - VPMULHW Y8, Y15, Y8 - VPMULHW Y10, Y15, Y10 - VPMULHW Y12, Y15, Y12 - VPMULHW Y14, Y15, Y14 - VPSUBW Y8, Y4, Y8 - VPSUBW Y10, Y5, Y10 - VPSUBW Y12, Y6, Y12 - VPSUBW Y14, Y0, Y14 - VPBROADCASTW 2088(CX), Y0 - VPBROADCASTW 2090(CX), Y1 - VPBROADCASTW 2092(CX), Y2 - VPBROADCASTW 2094(CX), Y3 - VPERM2I128 $0x20, Y9, Y7, Y4 - VPERM2I128 $0x31, Y9, Y7, Y9 - VMOVDQA Y4, Y7 - VPERM2I128 $0x20, Y10, Y8, Y4 - VPERM2I128 $0x31, Y10, Y8, Y10 - VMOVDQA Y4, Y8 - VPERM2I128 $0x20, Y13, Y11, Y4 - VPERM2I128 $0x31, Y13, Y11, Y13 - VMOVDQA Y4, Y11 - VPERM2I128 $0x20, Y14, Y12, Y4 - VPERM2I128 $0x31, Y14, Y12, Y14 - VMOVDQA Y4, Y12 - VPSUBW Y7, Y9, Y4 - VPSUBW Y8, Y10, Y5 - VPSUBW Y11, Y13, Y6 - VPADDW Y7, Y9, Y7 - VPADDW Y8, Y10, Y8 - VPADDW Y11, Y13, Y11 - VPMULLW Y4, Y0, Y9 - VPMULLW Y5, Y0, Y10 - VPSUBW Y12, Y14, Y0 - VPMULLW Y6, Y2, Y13 - VPADDW Y12, Y14, Y12 - VPMULLW Y0, Y2, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y3, Y6 - VPMULHW Y0, Y3, Y0 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y13, Y15, Y13 - VPMULHW Y14, Y15, Y14 - VPSUBW Y9, Y4, Y9 - VPSUBW Y10, Y5, Y10 - VPSUBW Y13, Y6, Y13 - VPSUBW Y14, Y0, Y14 - MOVL $0x00004ebf, DX - VMOVD DX, X0 - VPBROADCASTW X0, Y4 - VPMULHW Y4, Y7, Y5 - VPSRAW $0x0a, Y5, Y5 - VPMULLW Y15, Y5, Y5 - VPSUBW Y5, Y7, Y7 - VPMULHW Y4, Y11, Y5 - VPSRAW $0x0a, Y5, Y5 - VPMULLW Y15, Y5, Y5 - VPSUBW Y5, Y11, Y11 - VPBROADCASTW 2100(CX), Y0 - VPBROADCASTW 2102(CX), Y1 - VPSUBW Y7, Y11, Y4 - VPSUBW Y8, Y12, Y5 - VPSUBW Y9, Y13, Y6 - VPADDW Y7, Y11, Y7 - VPADDW Y8, Y12, Y8 - VPADDW Y9, Y13, Y9 - VPMULLW Y4, Y0, Y11 - VPMULLW Y5, Y0, Y12 - VPSUBW Y10, Y14, Y2 - VPMULLW Y6, Y0, Y13 - VPADDW Y10, Y14, Y10 - VPMULLW Y2, Y0, Y14 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y6, Y1, Y6 - VPMULHW Y2, Y1, Y2 - VPMULHW Y11, Y15, Y11 - VPMULHW Y12, Y15, Y12 - VPMULHW Y13, Y15, Y13 - VPMULHW Y14, Y15, Y14 - VPSUBW Y11, Y4, Y11 - VPSUBW Y12, Y5, Y12 - VPSUBW Y13, Y6, Y13 - VPSUBW Y14, Y2, Y14 - VMOVDQU Y7, 256(AX) - VMOVDQU Y8, 288(AX) - VMOVDQU Y9, 320(AX) - VMOVDQU Y10, 352(AX) - VMOVDQU Y11, 384(AX) - VMOVDQU Y12, 416(AX) - VMOVDQU Y13, 448(AX) - VMOVDQU Y14, 480(AX) - VPBROADCASTW 2104(CX), Y0 - VPBROADCASTW 2106(CX), Y1 - VMOVDQU (AX), Y7 - VMOVDQU 32(AX), Y8 - VMOVDQU 64(AX), Y9 - VMOVDQU 96(AX), Y10 - VMOVDQU 256(AX), Y11 - VMOVDQU 288(AX), Y12 - VMOVDQU 320(AX), Y13 - VMOVDQU 352(AX), Y14 - VPSUBW Y7, Y11, Y2 - VPSUBW Y8, Y12, Y3 - VPSUBW Y9, Y13, Y4 - VPADDW Y7, Y11, Y7 - VPADDW Y8, Y12, Y8 - VPADDW Y9, Y13, Y9 - VPMULLW Y2, Y0, Y11 - VPMULLW Y3, Y0, Y12 - VPSUBW Y10, Y14, Y5 - VPMULLW Y4, Y0, Y13 - VPADDW Y10, Y14, Y10 - VPMULLW Y5, Y0, Y14 - VPMULHW Y2, Y1, Y2 - VPMULHW Y3, Y1, Y3 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y11, Y15, Y11 - VPMULHW Y12, Y15, Y12 - VPMULHW Y13, Y15, Y13 - VPMULHW Y14, Y15, Y14 - VPSUBW Y11, Y2, Y11 - VPSUBW Y12, Y3, Y12 - VPSUBW Y13, Y4, Y13 - VPSUBW Y14, Y5, Y14 - MOVL $0xffffd8a1, DX - VMOVD DX, X0 - VPBROADCASTW X0, Y0 - MOVL $0x000005a1, DX - VMOVD DX, X1 - VPBROADCASTW X1, Y1 - VPMULLW Y7, Y0, Y2 - VPMULLW Y8, Y0, Y3 - VPMULLW Y9, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULHW Y7, Y1, Y7 - VPMULHW Y8, Y1, Y8 - VPMULHW Y9, Y1, Y9 - VPMULHW Y10, Y1, Y10 - VPMULHW Y2, Y15, Y2 - VPMULHW Y3, Y15, Y3 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPSUBW Y2, Y7, Y7 - VPSUBW Y3, Y8, Y8 - VPSUBW Y4, Y9, Y9 - VPSUBW Y5, Y10, Y10 - VPMULLW Y11, Y0, Y2 - VPMULLW Y12, Y0, Y3 - VPMULLW Y13, Y0, Y4 - VPMULLW Y14, Y0, Y5 - VPMULHW Y11, Y1, Y11 - VPMULHW Y12, Y1, Y12 - VPMULHW Y13, Y1, Y13 - VPMULHW Y14, Y1, Y14 - VPMULHW Y2, Y15, Y2 - VPMULHW Y3, Y15, Y3 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPSUBW Y2, Y11, Y11 - VPSUBW Y3, Y12, Y12 - VPSUBW Y4, Y13, Y13 - VPSUBW Y5, Y14, Y14 - VMOVDQU Y7, (AX) - VMOVDQU Y8, 32(AX) - VMOVDQU Y9, 64(AX) - VMOVDQU Y10, 96(AX) - VMOVDQU Y11, 256(AX) - VMOVDQU Y12, 288(AX) - VMOVDQU Y13, 320(AX) - VMOVDQU Y14, 352(AX) - VPBROADCASTW 2104(CX), Y0 - VPBROADCASTW 2106(CX), Y1 - VMOVDQU 128(AX), Y7 - VMOVDQU 160(AX), Y8 - VMOVDQU 192(AX), Y9 - VMOVDQU 224(AX), Y10 - VMOVDQU 384(AX), Y11 - VMOVDQU 416(AX), Y12 - VMOVDQU 448(AX), Y13 - VMOVDQU 480(AX), Y14 - VPSUBW Y7, Y11, Y2 - VPSUBW Y8, Y12, Y3 - VPSUBW Y9, Y13, Y4 - VPADDW Y7, Y11, Y7 - VPADDW Y8, Y12, Y8 - VPADDW Y9, Y13, Y9 - VPMULLW Y2, Y0, Y11 - VPMULLW Y3, Y0, Y12 - VPSUBW Y10, Y14, Y5 - VPMULLW Y4, Y0, Y13 - VPADDW Y10, Y14, Y10 - VPMULLW Y5, Y0, Y14 - VPMULHW Y2, Y1, Y2 - VPMULHW Y3, Y1, Y3 - VPMULHW Y4, Y1, Y4 - VPMULHW Y5, Y1, Y5 - VPMULHW Y11, Y15, Y11 - VPMULHW Y12, Y15, Y12 - VPMULHW Y13, Y15, Y13 - VPMULHW Y14, Y15, Y14 - VPSUBW Y11, Y2, Y11 - VPSUBW Y12, Y3, Y12 - VPSUBW Y13, Y4, Y13 - VPSUBW Y14, Y5, Y14 - MOVL $0xffffd8a1, CX - VMOVD CX, X0 - VPBROADCASTW X0, Y0 - MOVL $0x000005a1, CX - VMOVD CX, X1 - VPBROADCASTW X1, Y1 - VPMULLW Y7, Y0, Y2 - VPMULLW Y8, Y0, Y3 - VPMULLW Y9, Y0, Y4 - VPMULLW Y10, Y0, Y5 - VPMULHW Y7, Y1, Y7 - VPMULHW Y8, Y1, Y8 - VPMULHW Y9, Y1, Y9 - VPMULHW Y10, Y1, Y10 - VPMULHW Y2, Y15, Y2 - VPMULHW Y3, Y15, Y3 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPSUBW Y2, Y7, Y7 - VPSUBW Y3, Y8, Y8 - VPSUBW Y4, Y9, Y9 - VPSUBW Y5, Y10, Y10 - VPMULLW Y11, Y0, Y2 - VPMULLW Y12, Y0, Y3 - VPMULLW Y13, Y0, Y4 - VPMULLW Y14, Y0, Y5 - VPMULHW Y11, Y1, Y11 - VPMULHW Y12, Y1, Y12 - VPMULHW Y13, Y1, Y13 - VPMULHW Y14, Y1, Y14 - VPMULHW Y2, Y15, Y2 - VPMULHW Y3, Y15, Y3 - VPMULHW Y4, Y15, Y4 - VPMULHW Y5, Y15, Y5 - VPSUBW Y2, Y11, Y11 - VPSUBW Y3, Y12, Y12 - VPSUBW Y4, Y13, Y13 - VPSUBW Y5, Y14, Y14 - VMOVDQU Y7, 128(AX) - VMOVDQU Y8, 160(AX) - VMOVDQU Y9, 192(AX) - VMOVDQU Y10, 224(AX) - VMOVDQU Y11, 384(AX) - VMOVDQU Y12, 416(AX) - VMOVDQU Y13, 448(AX) - VMOVDQU Y14, 480(AX) - RET - -// func mulHatAVX2(p *[256]int16, a *[256]int16, b *[256]int16) -// Requires: AVX, AVX2 -TEXT ·mulHatAVX2(SB), NOSPLIT, $8-24 - MOVQ p+0(FP), AX - MOVQ a+8(FP), CX - MOVQ b+16(FP), DX - LEAQ ·ZetasAVX2+0(SB), BX - MOVL $0xfffff301, SI - VMOVD SI, X0 - VPBROADCASTW X0, Y14 - MOVL $0x00000d01, SI - VMOVD SI, X0 - VPBROADCASTW X0, Y15 - VMOVDQU (CX), Y0 - VMOVDQU 32(CX), Y1 - VMOVDQU 64(CX), Y2 - VMOVDQU 96(CX), Y3 - VMOVDQU (DX), Y4 - VMOVDQU 32(DX), Y5 - VMOVDQU 64(DX), Y6 - VMOVDQU 96(DX), Y7 - VPMULLW Y1, Y5, Y8 - VPMULLW Y0, Y4, Y9 - VPMULLW Y0, Y5, Y10 - VPMULLW Y1, Y4, Y11 - VPMULLW Y8, Y14, Y8 - VPMULLW Y9, Y14, Y9 - VPMULLW Y10, Y14, Y10 - VPMULLW Y11, Y14, Y11 - VPMULHW Y1, Y5, Y12 - VPMULHW Y0, Y4, Y13 - VPMULHW Y0, Y5, Y0 - VPMULHW Y1, Y4, Y1 - VMOVDQA Y12, Y4 - VMOVDQA Y13, Y5 - VPMULHW Y8, Y15, Y8 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y11, Y15, Y11 - VPSUBW Y8, Y4, Y4 - VPSUBW Y9, Y5, Y5 - VPSUBW Y10, Y0, Y0 - VPSUBW Y11, Y1, Y1 - VMOVDQU 800(BX), Y12 - VMOVDQU 832(BX), Y13 - VPMULLW Y4, Y12, Y8 - VPMULHW Y4, Y13, Y4 - VPMULHW Y8, Y15, Y8 - VPSUBW Y8, Y4, Y4 - VPADDW Y4, Y5, Y4 - VPADDW Y0, Y1, Y5 - VPMULLW Y3, Y7, Y8 - VPMULLW Y2, Y6, Y9 - VPMULLW Y2, Y7, Y10 - VPMULLW Y3, Y6, Y11 - VPMULLW Y8, Y14, Y8 - VPMULLW Y9, Y14, Y9 - VPMULLW Y10, Y14, Y10 - VPMULLW Y11, Y14, Y11 - VPMULHW Y3, Y7, Y12 - VPMULHW Y2, Y6, Y13 - VPMULHW Y2, Y7, Y2 - VPMULHW Y3, Y6, Y3 - VMOVDQA Y12, Y6 - VMOVDQA Y13, Y7 - VPMULHW Y8, Y15, Y8 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y11, Y15, Y11 - VPSUBW Y8, Y6, Y6 - VPSUBW Y9, Y7, Y7 - VPSUBW Y10, Y2, Y2 - VPSUBW Y11, Y3, Y3 - VMOVDQU 800(BX), Y12 - VMOVDQU 832(BX), Y13 - VPMULLW Y6, Y12, Y8 - VPMULHW Y6, Y13, Y6 - VPMULHW Y8, Y15, Y8 - VPSUBW Y8, Y6, Y6 - VPSUBW Y6, Y7, Y6 - VPADDW Y2, Y3, Y7 - VMOVDQU Y4, (AX) - VMOVDQU Y5, 32(AX) - VMOVDQU Y6, 64(AX) - VMOVDQU Y7, 96(AX) - VMOVDQU 128(CX), Y0 - VMOVDQU 160(CX), Y1 - VMOVDQU 192(CX), Y2 - VMOVDQU 224(CX), Y3 - VMOVDQU 128(DX), Y4 - VMOVDQU 160(DX), Y5 - VMOVDQU 192(DX), Y6 - VMOVDQU 224(DX), Y7 - VPMULLW Y1, Y5, Y8 - VPMULLW Y0, Y4, Y9 - VPMULLW Y0, Y5, Y10 - VPMULLW Y1, Y4, Y11 - VPMULLW Y8, Y14, Y8 - VPMULLW Y9, Y14, Y9 - VPMULLW Y10, Y14, Y10 - VPMULLW Y11, Y14, Y11 - VPMULHW Y1, Y5, Y12 - VPMULHW Y0, Y4, Y13 - VPMULHW Y0, Y5, Y0 - VPMULHW Y1, Y4, Y1 - VMOVDQA Y12, Y4 - VMOVDQA Y13, Y5 - VPMULHW Y8, Y15, Y8 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y11, Y15, Y11 - VPSUBW Y8, Y4, Y4 - VPSUBW Y9, Y5, Y5 - VPSUBW Y10, Y0, Y0 - VPSUBW Y11, Y1, Y1 - VMOVDQU 864(BX), Y12 - VMOVDQU 896(BX), Y13 - VPMULLW Y4, Y12, Y8 - VPMULHW Y4, Y13, Y4 - VPMULHW Y8, Y15, Y8 - VPSUBW Y8, Y4, Y4 - VPADDW Y4, Y5, Y4 - VPADDW Y0, Y1, Y5 - VPMULLW Y3, Y7, Y8 - VPMULLW Y2, Y6, Y9 - VPMULLW Y2, Y7, Y10 - VPMULLW Y3, Y6, Y11 - VPMULLW Y8, Y14, Y8 - VPMULLW Y9, Y14, Y9 - VPMULLW Y10, Y14, Y10 - VPMULLW Y11, Y14, Y11 - VPMULHW Y3, Y7, Y12 - VPMULHW Y2, Y6, Y13 - VPMULHW Y2, Y7, Y2 - VPMULHW Y3, Y6, Y3 - VMOVDQA Y12, Y6 - VMOVDQA Y13, Y7 - VPMULHW Y8, Y15, Y8 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y11, Y15, Y11 - VPSUBW Y8, Y6, Y6 - VPSUBW Y9, Y7, Y7 - VPSUBW Y10, Y2, Y2 - VPSUBW Y11, Y3, Y3 - VMOVDQU 864(BX), Y12 - VMOVDQU 896(BX), Y13 - VPMULLW Y6, Y12, Y8 - VPMULHW Y6, Y13, Y6 - VPMULHW Y8, Y15, Y8 - VPSUBW Y8, Y6, Y6 - VPSUBW Y6, Y7, Y6 - VPADDW Y2, Y3, Y7 - VMOVDQU Y4, 128(AX) - VMOVDQU Y5, 160(AX) - VMOVDQU Y6, 192(AX) - VMOVDQU Y7, 224(AX) - VMOVDQU 256(CX), Y0 - VMOVDQU 288(CX), Y1 - VMOVDQU 320(CX), Y2 - VMOVDQU 352(CX), Y3 - VMOVDQU 256(DX), Y4 - VMOVDQU 288(DX), Y5 - VMOVDQU 320(DX), Y6 - VMOVDQU 352(DX), Y7 - VPMULLW Y1, Y5, Y8 - VPMULLW Y0, Y4, Y9 - VPMULLW Y0, Y5, Y10 - VPMULLW Y1, Y4, Y11 - VPMULLW Y8, Y14, Y8 - VPMULLW Y9, Y14, Y9 - VPMULLW Y10, Y14, Y10 - VPMULLW Y11, Y14, Y11 - VPMULHW Y1, Y5, Y12 - VPMULHW Y0, Y4, Y13 - VPMULHW Y0, Y5, Y0 - VPMULHW Y1, Y4, Y1 - VMOVDQA Y12, Y4 - VMOVDQA Y13, Y5 - VPMULHW Y8, Y15, Y8 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y11, Y15, Y11 - VPSUBW Y8, Y4, Y4 - VPSUBW Y9, Y5, Y5 - VPSUBW Y10, Y0, Y0 - VPSUBW Y11, Y1, Y1 - VMOVDQU 928(BX), Y12 - VMOVDQU 960(BX), Y13 - VPMULLW Y4, Y12, Y8 - VPMULHW Y4, Y13, Y4 - VPMULHW Y8, Y15, Y8 - VPSUBW Y8, Y4, Y4 - VPADDW Y4, Y5, Y4 - VPADDW Y0, Y1, Y5 - VPMULLW Y3, Y7, Y8 - VPMULLW Y2, Y6, Y9 - VPMULLW Y2, Y7, Y10 - VPMULLW Y3, Y6, Y11 - VPMULLW Y8, Y14, Y8 - VPMULLW Y9, Y14, Y9 - VPMULLW Y10, Y14, Y10 - VPMULLW Y11, Y14, Y11 - VPMULHW Y3, Y7, Y12 - VPMULHW Y2, Y6, Y13 - VPMULHW Y2, Y7, Y2 - VPMULHW Y3, Y6, Y3 - VMOVDQA Y12, Y6 - VMOVDQA Y13, Y7 - VPMULHW Y8, Y15, Y8 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y11, Y15, Y11 - VPSUBW Y8, Y6, Y6 - VPSUBW Y9, Y7, Y7 - VPSUBW Y10, Y2, Y2 - VPSUBW Y11, Y3, Y3 - VMOVDQU 928(BX), Y12 - VMOVDQU 960(BX), Y13 - VPMULLW Y6, Y12, Y8 - VPMULHW Y6, Y13, Y6 - VPMULHW Y8, Y15, Y8 - VPSUBW Y8, Y6, Y6 - VPSUBW Y6, Y7, Y6 - VPADDW Y2, Y3, Y7 - VMOVDQU Y4, 256(AX) - VMOVDQU Y5, 288(AX) - VMOVDQU Y6, 320(AX) - VMOVDQU Y7, 352(AX) - VMOVDQU 384(CX), Y0 - VMOVDQU 416(CX), Y1 - VMOVDQU 448(CX), Y2 - VMOVDQU 480(CX), Y3 - VMOVDQU 384(DX), Y4 - VMOVDQU 416(DX), Y5 - VMOVDQU 448(DX), Y6 - VMOVDQU 480(DX), Y7 - VPMULLW Y1, Y5, Y8 - VPMULLW Y0, Y4, Y9 - VPMULLW Y0, Y5, Y10 - VPMULLW Y1, Y4, Y11 - VPMULLW Y8, Y14, Y8 - VPMULLW Y9, Y14, Y9 - VPMULLW Y10, Y14, Y10 - VPMULLW Y11, Y14, Y11 - VPMULHW Y1, Y5, Y12 - VPMULHW Y0, Y4, Y13 - VPMULHW Y0, Y5, Y0 - VPMULHW Y1, Y4, Y1 - VMOVDQA Y12, Y4 - VMOVDQA Y13, Y5 - VPMULHW Y8, Y15, Y8 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y11, Y15, Y11 - VPSUBW Y8, Y4, Y4 - VPSUBW Y9, Y5, Y5 - VPSUBW Y10, Y0, Y0 - VPSUBW Y11, Y1, Y1 - VMOVDQU 992(BX), Y12 - VMOVDQU 1024(BX), Y13 - VPMULLW Y4, Y12, Y8 - VPMULHW Y4, Y13, Y4 - VPMULHW Y8, Y15, Y8 - VPSUBW Y8, Y4, Y4 - VPADDW Y4, Y5, Y4 - VPADDW Y0, Y1, Y5 - VPMULLW Y3, Y7, Y8 - VPMULLW Y2, Y6, Y9 - VPMULLW Y2, Y7, Y10 - VPMULLW Y3, Y6, Y11 - VPMULLW Y8, Y14, Y8 - VPMULLW Y9, Y14, Y9 - VPMULLW Y10, Y14, Y10 - VPMULLW Y11, Y14, Y11 - VPMULHW Y3, Y7, Y12 - VPMULHW Y2, Y6, Y13 - VPMULHW Y2, Y7, Y2 - VPMULHW Y3, Y6, Y3 - VMOVDQA Y12, Y6 - VMOVDQA Y13, Y7 - VPMULHW Y8, Y15, Y8 - VPMULHW Y9, Y15, Y9 - VPMULHW Y10, Y15, Y10 - VPMULHW Y11, Y15, Y11 - VPSUBW Y8, Y6, Y6 - VPSUBW Y9, Y7, Y7 - VPSUBW Y10, Y2, Y2 - VPSUBW Y11, Y3, Y3 - VMOVDQU 992(BX), Y12 - VMOVDQU 1024(BX), Y13 - VPMULLW Y6, Y12, Y8 - VPMULHW Y6, Y13, Y6 - VPMULHW Y8, Y15, Y8 - VPSUBW Y8, Y6, Y6 - VPSUBW Y6, Y7, Y6 - VPADDW Y2, Y3, Y7 - VMOVDQU Y4, 384(AX) - VMOVDQU Y5, 416(AX) - VMOVDQU Y6, 448(AX) - VMOVDQU Y7, 480(AX) - RET - -// func detangleAVX2(p *[256]int16) -// Requires: AVX, AVX2 -TEXT ·detangleAVX2(SB), NOSPLIT, $0-8 - MOVQ p+0(FP), AX - VMOVDQU (AX), Y0 - VMOVDQU 32(AX), Y1 - VMOVDQU 64(AX), Y2 - VMOVDQU 96(AX), Y3 - VMOVDQU 128(AX), Y4 - VMOVDQU 160(AX), Y5 - VMOVDQU 192(AX), Y6 - VMOVDQU 224(AX), Y7 - VPSLLD $0x10, Y1, Y8 - VPBLENDW $0xaa, Y8, Y0, Y8 - VPSRLD $0x10, Y0, Y0 - VPBLENDW $0xaa, Y1, Y0, Y1 - VMOVDQA Y8, Y0 - VPSLLD $0x10, Y3, Y8 - VPBLENDW $0xaa, Y8, Y2, Y8 - VPSRLD $0x10, Y2, Y2 - VPBLENDW $0xaa, Y3, Y2, Y3 - VMOVDQA Y8, Y2 - VPSLLD $0x10, Y5, Y8 - VPBLENDW $0xaa, Y8, Y4, Y8 - VPSRLD $0x10, Y4, Y4 - VPBLENDW $0xaa, Y5, Y4, Y5 - VMOVDQA Y8, Y4 - VPSLLD $0x10, Y7, Y8 - VPBLENDW $0xaa, Y8, Y6, Y8 - VPSRLD $0x10, Y6, Y6 - VPBLENDW $0xaa, Y7, Y6, Y7 - VMOVDQA Y8, Y6 - VMOVSLDUP Y2, Y8 - VPBLENDD $0xaa, Y8, Y0, Y8 - VPSRLQ $0x20, Y0, Y0 - VPBLENDD $0xaa, Y2, Y0, Y2 - VMOVDQA Y8, Y0 - VMOVSLDUP Y3, Y8 - VPBLENDD $0xaa, Y8, Y1, Y8 - VPSRLQ $0x20, Y1, Y1 - VPBLENDD $0xaa, Y3, Y1, Y3 - VMOVDQA Y8, Y1 - VMOVSLDUP Y6, Y8 - VPBLENDD $0xaa, Y8, Y4, Y8 - VPSRLQ $0x20, Y4, Y4 - VPBLENDD $0xaa, Y6, Y4, Y6 - VMOVDQA Y8, Y4 - VMOVSLDUP Y7, Y8 - VPBLENDD $0xaa, Y8, Y5, Y8 - VPSRLQ $0x20, Y5, Y5 - VPBLENDD $0xaa, Y7, Y5, Y7 - VMOVDQA Y8, Y5 - VPUNPCKLQDQ Y1, Y0, Y8 - VPUNPCKHQDQ Y1, Y0, Y1 - VMOVDQA Y8, Y0 - VPUNPCKLQDQ Y3, Y2, Y8 - VPUNPCKHQDQ Y3, Y2, Y3 - VMOVDQA Y8, Y2 - VPUNPCKLQDQ Y5, Y4, Y8 - VPUNPCKHQDQ Y5, Y4, Y5 - VMOVDQA Y8, Y4 - VPUNPCKLQDQ Y7, Y6, Y8 - VPUNPCKHQDQ Y7, Y6, Y7 - VMOVDQA Y8, Y6 - VPERM2I128 $0x20, Y2, Y0, Y8 - VPERM2I128 $0x31, Y2, Y0, Y2 - VMOVDQA Y8, Y0 - VPERM2I128 $0x20, Y3, Y1, Y8 - VPERM2I128 $0x31, Y3, Y1, Y3 - VMOVDQA Y8, Y1 - VPERM2I128 $0x20, Y6, Y4, Y8 - VPERM2I128 $0x31, Y6, Y4, Y6 - VMOVDQA Y8, Y4 - VPERM2I128 $0x20, Y7, Y5, Y8 - VPERM2I128 $0x31, Y7, Y5, Y7 - VMOVDQA Y8, Y5 - VMOVDQU Y0, (AX) - VMOVDQU Y1, 32(AX) - VMOVDQU Y2, 64(AX) - VMOVDQU Y3, 96(AX) - VMOVDQU Y4, 128(AX) - VMOVDQU Y5, 160(AX) - VMOVDQU Y6, 192(AX) - VMOVDQU Y7, 224(AX) - VMOVDQU 256(AX), Y0 - VMOVDQU 288(AX), Y1 - VMOVDQU 320(AX), Y2 - VMOVDQU 352(AX), Y3 - VMOVDQU 384(AX), Y4 - VMOVDQU 416(AX), Y5 - VMOVDQU 448(AX), Y6 - VMOVDQU 480(AX), Y7 - VPSLLD $0x10, Y1, Y8 - VPBLENDW $0xaa, Y8, Y0, Y8 - VPSRLD $0x10, Y0, Y0 - VPBLENDW $0xaa, Y1, Y0, Y1 - VMOVDQA Y8, Y0 - VPSLLD $0x10, Y3, Y8 - VPBLENDW $0xaa, Y8, Y2, Y8 - VPSRLD $0x10, Y2, Y2 - VPBLENDW $0xaa, Y3, Y2, Y3 - VMOVDQA Y8, Y2 - VPSLLD $0x10, Y5, Y8 - VPBLENDW $0xaa, Y8, Y4, Y8 - VPSRLD $0x10, Y4, Y4 - VPBLENDW $0xaa, Y5, Y4, Y5 - VMOVDQA Y8, Y4 - VPSLLD $0x10, Y7, Y8 - VPBLENDW $0xaa, Y8, Y6, Y8 - VPSRLD $0x10, Y6, Y6 - VPBLENDW $0xaa, Y7, Y6, Y7 - VMOVDQA Y8, Y6 - VMOVSLDUP Y2, Y8 - VPBLENDD $0xaa, Y8, Y0, Y8 - VPSRLQ $0x20, Y0, Y0 - VPBLENDD $0xaa, Y2, Y0, Y2 - VMOVDQA Y8, Y0 - VMOVSLDUP Y3, Y8 - VPBLENDD $0xaa, Y8, Y1, Y8 - VPSRLQ $0x20, Y1, Y1 - VPBLENDD $0xaa, Y3, Y1, Y3 - VMOVDQA Y8, Y1 - VMOVSLDUP Y6, Y8 - VPBLENDD $0xaa, Y8, Y4, Y8 - VPSRLQ $0x20, Y4, Y4 - VPBLENDD $0xaa, Y6, Y4, Y6 - VMOVDQA Y8, Y4 - VMOVSLDUP Y7, Y8 - VPBLENDD $0xaa, Y8, Y5, Y8 - VPSRLQ $0x20, Y5, Y5 - VPBLENDD $0xaa, Y7, Y5, Y7 - VMOVDQA Y8, Y5 - VPUNPCKLQDQ Y1, Y0, Y8 - VPUNPCKHQDQ Y1, Y0, Y1 - VMOVDQA Y8, Y0 - VPUNPCKLQDQ Y3, Y2, Y8 - VPUNPCKHQDQ Y3, Y2, Y3 - VMOVDQA Y8, Y2 - VPUNPCKLQDQ Y5, Y4, Y8 - VPUNPCKHQDQ Y5, Y4, Y5 - VMOVDQA Y8, Y4 - VPUNPCKLQDQ Y7, Y6, Y8 - VPUNPCKHQDQ Y7, Y6, Y7 - VMOVDQA Y8, Y6 - VPERM2I128 $0x20, Y2, Y0, Y8 - VPERM2I128 $0x31, Y2, Y0, Y2 - VMOVDQA Y8, Y0 - VPERM2I128 $0x20, Y3, Y1, Y8 - VPERM2I128 $0x31, Y3, Y1, Y3 - VMOVDQA Y8, Y1 - VPERM2I128 $0x20, Y6, Y4, Y8 - VPERM2I128 $0x31, Y6, Y4, Y6 - VMOVDQA Y8, Y4 - VPERM2I128 $0x20, Y7, Y5, Y8 - VPERM2I128 $0x31, Y7, Y5, Y7 - VMOVDQA Y8, Y5 - VMOVDQU Y0, 256(AX) - VMOVDQU Y1, 288(AX) - VMOVDQU Y2, 320(AX) - VMOVDQU Y3, 352(AX) - VMOVDQU Y4, 384(AX) - VMOVDQU Y5, 416(AX) - VMOVDQU Y6, 448(AX) - VMOVDQU Y7, 480(AX) - RET - -// func tangleAVX2(p *[256]int16) -// Requires: AVX, AVX2 -TEXT ·tangleAVX2(SB), NOSPLIT, $0-8 - MOVQ p+0(FP), AX - VMOVDQU (AX), Y0 - VMOVDQU 32(AX), Y1 - VMOVDQU 64(AX), Y2 - VMOVDQU 96(AX), Y3 - VMOVDQU 128(AX), Y4 - VMOVDQU 160(AX), Y5 - VMOVDQU 192(AX), Y6 - VMOVDQU 224(AX), Y7 - VPERM2I128 $0x20, Y2, Y0, Y8 - VPERM2I128 $0x31, Y2, Y0, Y2 - VMOVDQA Y8, Y0 - VPERM2I128 $0x20, Y3, Y1, Y8 - VPERM2I128 $0x31, Y3, Y1, Y3 - VMOVDQA Y8, Y1 - VPERM2I128 $0x20, Y6, Y4, Y8 - VPERM2I128 $0x31, Y6, Y4, Y6 - VMOVDQA Y8, Y4 - VPERM2I128 $0x20, Y7, Y5, Y8 - VPERM2I128 $0x31, Y7, Y5, Y7 - VMOVDQA Y8, Y5 - VPUNPCKLQDQ Y1, Y0, Y8 - VPUNPCKHQDQ Y1, Y0, Y1 - VMOVDQA Y8, Y0 - VPUNPCKLQDQ Y3, Y2, Y8 - VPUNPCKHQDQ Y3, Y2, Y3 - VMOVDQA Y8, Y2 - VPUNPCKLQDQ Y5, Y4, Y8 - VPUNPCKHQDQ Y5, Y4, Y5 - VMOVDQA Y8, Y4 - VPUNPCKLQDQ Y7, Y6, Y8 - VPUNPCKHQDQ Y7, Y6, Y7 - VMOVDQA Y8, Y6 - VMOVSLDUP Y2, Y8 - VPBLENDD $0xaa, Y8, Y0, Y8 - VPSRLQ $0x20, Y0, Y0 - VPBLENDD $0xaa, Y2, Y0, Y2 - VMOVDQA Y8, Y0 - VMOVSLDUP Y3, Y8 - VPBLENDD $0xaa, Y8, Y1, Y8 - VPSRLQ $0x20, Y1, Y1 - VPBLENDD $0xaa, Y3, Y1, Y3 - VMOVDQA Y8, Y1 - VMOVSLDUP Y6, Y8 - VPBLENDD $0xaa, Y8, Y4, Y8 - VPSRLQ $0x20, Y4, Y4 - VPBLENDD $0xaa, Y6, Y4, Y6 - VMOVDQA Y8, Y4 - VMOVSLDUP Y7, Y8 - VPBLENDD $0xaa, Y8, Y5, Y8 - VPSRLQ $0x20, Y5, Y5 - VPBLENDD $0xaa, Y7, Y5, Y7 - VMOVDQA Y8, Y5 - VPSLLD $0x10, Y1, Y8 - VPBLENDW $0xaa, Y8, Y0, Y8 - VPSRLD $0x10, Y0, Y0 - VPBLENDW $0xaa, Y1, Y0, Y1 - VMOVDQA Y8, Y0 - VPSLLD $0x10, Y3, Y8 - VPBLENDW $0xaa, Y8, Y2, Y8 - VPSRLD $0x10, Y2, Y2 - VPBLENDW $0xaa, Y3, Y2, Y3 - VMOVDQA Y8, Y2 - VPSLLD $0x10, Y5, Y8 - VPBLENDW $0xaa, Y8, Y4, Y8 - VPSRLD $0x10, Y4, Y4 - VPBLENDW $0xaa, Y5, Y4, Y5 - VMOVDQA Y8, Y4 - VPSLLD $0x10, Y7, Y8 - VPBLENDW $0xaa, Y8, Y6, Y8 - VPSRLD $0x10, Y6, Y6 - VPBLENDW $0xaa, Y7, Y6, Y7 - VMOVDQA Y8, Y6 - VMOVDQU Y0, (AX) - VMOVDQU Y1, 32(AX) - VMOVDQU Y2, 64(AX) - VMOVDQU Y3, 96(AX) - VMOVDQU Y4, 128(AX) - VMOVDQU Y5, 160(AX) - VMOVDQU Y6, 192(AX) - VMOVDQU Y7, 224(AX) - VMOVDQU 256(AX), Y0 - VMOVDQU 288(AX), Y1 - VMOVDQU 320(AX), Y2 - VMOVDQU 352(AX), Y3 - VMOVDQU 384(AX), Y4 - VMOVDQU 416(AX), Y5 - VMOVDQU 448(AX), Y6 - VMOVDQU 480(AX), Y7 - VPERM2I128 $0x20, Y2, Y0, Y8 - VPERM2I128 $0x31, Y2, Y0, Y2 - VMOVDQA Y8, Y0 - VPERM2I128 $0x20, Y3, Y1, Y8 - VPERM2I128 $0x31, Y3, Y1, Y3 - VMOVDQA Y8, Y1 - VPERM2I128 $0x20, Y6, Y4, Y8 - VPERM2I128 $0x31, Y6, Y4, Y6 - VMOVDQA Y8, Y4 - VPERM2I128 $0x20, Y7, Y5, Y8 - VPERM2I128 $0x31, Y7, Y5, Y7 - VMOVDQA Y8, Y5 - VPUNPCKLQDQ Y1, Y0, Y8 - VPUNPCKHQDQ Y1, Y0, Y1 - VMOVDQA Y8, Y0 - VPUNPCKLQDQ Y3, Y2, Y8 - VPUNPCKHQDQ Y3, Y2, Y3 - VMOVDQA Y8, Y2 - VPUNPCKLQDQ Y5, Y4, Y8 - VPUNPCKHQDQ Y5, Y4, Y5 - VMOVDQA Y8, Y4 - VPUNPCKLQDQ Y7, Y6, Y8 - VPUNPCKHQDQ Y7, Y6, Y7 - VMOVDQA Y8, Y6 - VMOVSLDUP Y2, Y8 - VPBLENDD $0xaa, Y8, Y0, Y8 - VPSRLQ $0x20, Y0, Y0 - VPBLENDD $0xaa, Y2, Y0, Y2 - VMOVDQA Y8, Y0 - VMOVSLDUP Y3, Y8 - VPBLENDD $0xaa, Y8, Y1, Y8 - VPSRLQ $0x20, Y1, Y1 - VPBLENDD $0xaa, Y3, Y1, Y3 - VMOVDQA Y8, Y1 - VMOVSLDUP Y6, Y8 - VPBLENDD $0xaa, Y8, Y4, Y8 - VPSRLQ $0x20, Y4, Y4 - VPBLENDD $0xaa, Y6, Y4, Y6 - VMOVDQA Y8, Y4 - VMOVSLDUP Y7, Y8 - VPBLENDD $0xaa, Y8, Y5, Y8 - VPSRLQ $0x20, Y5, Y5 - VPBLENDD $0xaa, Y7, Y5, Y7 - VMOVDQA Y8, Y5 - VPSLLD $0x10, Y1, Y8 - VPBLENDW $0xaa, Y8, Y0, Y8 - VPSRLD $0x10, Y0, Y0 - VPBLENDW $0xaa, Y1, Y0, Y1 - VMOVDQA Y8, Y0 - VPSLLD $0x10, Y3, Y8 - VPBLENDW $0xaa, Y8, Y2, Y8 - VPSRLD $0x10, Y2, Y2 - VPBLENDW $0xaa, Y3, Y2, Y3 - VMOVDQA Y8, Y2 - VPSLLD $0x10, Y5, Y8 - VPBLENDW $0xaa, Y8, Y4, Y8 - VPSRLD $0x10, Y4, Y4 - VPBLENDW $0xaa, Y5, Y4, Y5 - VMOVDQA Y8, Y4 - VPSLLD $0x10, Y7, Y8 - VPBLENDW $0xaa, Y8, Y6, Y8 - VPSRLD $0x10, Y6, Y6 - VPBLENDW $0xaa, Y7, Y6, Y7 - VMOVDQA Y8, Y6 - VMOVDQU Y0, 256(AX) - VMOVDQU Y1, 288(AX) - VMOVDQU Y2, 320(AX) - VMOVDQU Y3, 352(AX) - VMOVDQU Y4, 384(AX) - VMOVDQU Y5, 416(AX) - VMOVDQU Y6, 448(AX) - VMOVDQU Y7, 480(AX) - RET - -// func barrettReduceAVX2(p *[256]int16) -// Requires: AVX, AVX2 -TEXT ·barrettReduceAVX2(SB), NOSPLIT, $0-8 - MOVQ p+0(FP), AX - MOVL $0x00000d01, CX - VMOVD CX, X0 - VPBROADCASTW X0, Y9 - MOVL $0x00004ebf, CX - VMOVD CX, X0 - VPBROADCASTW X0, Y8 - VMOVDQU (AX), Y0 - VMOVDQU 32(AX), Y1 - VMOVDQU 64(AX), Y2 - VMOVDQU 96(AX), Y3 - VPMULHW Y8, Y0, Y4 - VPMULHW Y8, Y1, Y5 - VPMULHW Y8, Y2, Y6 - VPMULHW Y8, Y3, Y7 - VPSRAW $0x0a, Y4, Y4 - VPSRAW $0x0a, Y5, Y5 - VPSRAW $0x0a, Y6, Y6 - VPSRAW $0x0a, Y7, Y7 - VPMULLW Y9, Y4, Y4 - VPMULLW Y9, Y5, Y5 - VPMULLW Y9, Y6, Y6 - VPMULLW Y9, Y7, Y7 - VPSUBW Y4, Y0, Y0 - VPSUBW Y5, Y1, Y1 - VPSUBW Y6, Y2, Y2 - VPSUBW Y7, Y3, Y3 - VMOVDQU Y0, (AX) - VMOVDQU Y1, 32(AX) - VMOVDQU Y2, 64(AX) - VMOVDQU Y3, 96(AX) - VMOVDQU 128(AX), Y0 - VMOVDQU 160(AX), Y1 - VMOVDQU 192(AX), Y2 - VMOVDQU 224(AX), Y3 - VPMULHW Y8, Y0, Y4 - VPMULHW Y8, Y1, Y5 - VPMULHW Y8, Y2, Y6 - VPMULHW Y8, Y3, Y7 - VPSRAW $0x0a, Y4, Y4 - VPSRAW $0x0a, Y5, Y5 - VPSRAW $0x0a, Y6, Y6 - VPSRAW $0x0a, Y7, Y7 - VPMULLW Y9, Y4, Y4 - VPMULLW Y9, Y5, Y5 - VPMULLW Y9, Y6, Y6 - VPMULLW Y9, Y7, Y7 - VPSUBW Y4, Y0, Y0 - VPSUBW Y5, Y1, Y1 - VPSUBW Y6, Y2, Y2 - VPSUBW Y7, Y3, Y3 - VMOVDQU Y0, 128(AX) - VMOVDQU Y1, 160(AX) - VMOVDQU Y2, 192(AX) - VMOVDQU Y3, 224(AX) - VMOVDQU 256(AX), Y0 - VMOVDQU 288(AX), Y1 - VMOVDQU 320(AX), Y2 - VMOVDQU 352(AX), Y3 - VPMULHW Y8, Y0, Y4 - VPMULHW Y8, Y1, Y5 - VPMULHW Y8, Y2, Y6 - VPMULHW Y8, Y3, Y7 - VPSRAW $0x0a, Y4, Y4 - VPSRAW $0x0a, Y5, Y5 - VPSRAW $0x0a, Y6, Y6 - VPSRAW $0x0a, Y7, Y7 - VPMULLW Y9, Y4, Y4 - VPMULLW Y9, Y5, Y5 - VPMULLW Y9, Y6, Y6 - VPMULLW Y9, Y7, Y7 - VPSUBW Y4, Y0, Y0 - VPSUBW Y5, Y1, Y1 - VPSUBW Y6, Y2, Y2 - VPSUBW Y7, Y3, Y3 - VMOVDQU Y0, 256(AX) - VMOVDQU Y1, 288(AX) - VMOVDQU Y2, 320(AX) - VMOVDQU Y3, 352(AX) - VMOVDQU 384(AX), Y0 - VMOVDQU 416(AX), Y1 - VMOVDQU 448(AX), Y2 - VMOVDQU 480(AX), Y3 - VPMULHW Y8, Y0, Y4 - VPMULHW Y8, Y1, Y5 - VPMULHW Y8, Y2, Y6 - VPMULHW Y8, Y3, Y7 - VPSRAW $0x0a, Y4, Y4 - VPSRAW $0x0a, Y5, Y5 - VPSRAW $0x0a, Y6, Y6 - VPSRAW $0x0a, Y7, Y7 - VPMULLW Y9, Y4, Y4 - VPMULLW Y9, Y5, Y5 - VPMULLW Y9, Y6, Y6 - VPMULLW Y9, Y7, Y7 - VPSUBW Y4, Y0, Y0 - VPSUBW Y5, Y1, Y1 - VPSUBW Y6, Y2, Y2 - VPSUBW Y7, Y3, Y3 - VMOVDQU Y0, 384(AX) - VMOVDQU Y1, 416(AX) - VMOVDQU Y2, 448(AX) - VMOVDQU Y3, 480(AX) - RET - -// func normalizeAVX2(p *[256]int16) -// Requires: AVX, AVX2 -TEXT ·normalizeAVX2(SB), NOSPLIT, $0-8 - MOVQ p+0(FP), AX - MOVL $0x00000d01, CX - VMOVD CX, X0 - VPBROADCASTW X0, Y9 - MOVL $0x00004ebf, CX - VMOVD CX, X0 - VPBROADCASTW X0, Y8 - VMOVDQU (AX), Y0 - VMOVDQU 32(AX), Y1 - VMOVDQU 64(AX), Y2 - VMOVDQU 96(AX), Y3 - VPMULHW Y8, Y0, Y4 - VPMULHW Y8, Y1, Y5 - VPMULHW Y8, Y2, Y6 - VPMULHW Y8, Y3, Y7 - VPSRAW $0x0a, Y4, Y4 - VPSRAW $0x0a, Y5, Y5 - VPSRAW $0x0a, Y6, Y6 - VPSRAW $0x0a, Y7, Y7 - VPMULLW Y9, Y4, Y4 - VPMULLW Y9, Y5, Y5 - VPMULLW Y9, Y6, Y6 - VPMULLW Y9, Y7, Y7 - VPSUBW Y4, Y0, Y0 - VPSUBW Y5, Y1, Y1 - VPSUBW Y6, Y2, Y2 - VPSUBW Y7, Y3, Y3 - VPSUBW Y9, Y0, Y0 - VPSUBW Y9, Y1, Y1 - VPSUBW Y9, Y2, Y2 - VPSUBW Y9, Y3, Y3 - VPSRAW $0x0f, Y0, Y4 - VPSRAW $0x0f, Y1, Y5 - VPSRAW $0x0f, Y2, Y6 - VPSRAW $0x0f, Y3, Y7 - VPAND Y4, Y9, Y4 - VPAND Y5, Y9, Y5 - VPAND Y6, Y9, Y6 - VPAND Y7, Y9, Y7 - VPADDW Y0, Y4, Y0 - VPADDW Y1, Y5, Y1 - VPADDW Y2, Y6, Y2 - VPADDW Y3, Y7, Y3 - VMOVDQU Y0, (AX) - VMOVDQU Y1, 32(AX) - VMOVDQU Y2, 64(AX) - VMOVDQU Y3, 96(AX) - VMOVDQU 128(AX), Y0 - VMOVDQU 160(AX), Y1 - VMOVDQU 192(AX), Y2 - VMOVDQU 224(AX), Y3 - VPMULHW Y8, Y0, Y4 - VPMULHW Y8, Y1, Y5 - VPMULHW Y8, Y2, Y6 - VPMULHW Y8, Y3, Y7 - VPSRAW $0x0a, Y4, Y4 - VPSRAW $0x0a, Y5, Y5 - VPSRAW $0x0a, Y6, Y6 - VPSRAW $0x0a, Y7, Y7 - VPMULLW Y9, Y4, Y4 - VPMULLW Y9, Y5, Y5 - VPMULLW Y9, Y6, Y6 - VPMULLW Y9, Y7, Y7 - VPSUBW Y4, Y0, Y0 - VPSUBW Y5, Y1, Y1 - VPSUBW Y6, Y2, Y2 - VPSUBW Y7, Y3, Y3 - VPSUBW Y9, Y0, Y0 - VPSUBW Y9, Y1, Y1 - VPSUBW Y9, Y2, Y2 - VPSUBW Y9, Y3, Y3 - VPSRAW $0x0f, Y0, Y4 - VPSRAW $0x0f, Y1, Y5 - VPSRAW $0x0f, Y2, Y6 - VPSRAW $0x0f, Y3, Y7 - VPAND Y4, Y9, Y4 - VPAND Y5, Y9, Y5 - VPAND Y6, Y9, Y6 - VPAND Y7, Y9, Y7 - VPADDW Y0, Y4, Y0 - VPADDW Y1, Y5, Y1 - VPADDW Y2, Y6, Y2 - VPADDW Y3, Y7, Y3 - VMOVDQU Y0, 128(AX) - VMOVDQU Y1, 160(AX) - VMOVDQU Y2, 192(AX) - VMOVDQU Y3, 224(AX) - VMOVDQU 256(AX), Y0 - VMOVDQU 288(AX), Y1 - VMOVDQU 320(AX), Y2 - VMOVDQU 352(AX), Y3 - VPMULHW Y8, Y0, Y4 - VPMULHW Y8, Y1, Y5 - VPMULHW Y8, Y2, Y6 - VPMULHW Y8, Y3, Y7 - VPSRAW $0x0a, Y4, Y4 - VPSRAW $0x0a, Y5, Y5 - VPSRAW $0x0a, Y6, Y6 - VPSRAW $0x0a, Y7, Y7 - VPMULLW Y9, Y4, Y4 - VPMULLW Y9, Y5, Y5 - VPMULLW Y9, Y6, Y6 - VPMULLW Y9, Y7, Y7 - VPSUBW Y4, Y0, Y0 - VPSUBW Y5, Y1, Y1 - VPSUBW Y6, Y2, Y2 - VPSUBW Y7, Y3, Y3 - VPSUBW Y9, Y0, Y0 - VPSUBW Y9, Y1, Y1 - VPSUBW Y9, Y2, Y2 - VPSUBW Y9, Y3, Y3 - VPSRAW $0x0f, Y0, Y4 - VPSRAW $0x0f, Y1, Y5 - VPSRAW $0x0f, Y2, Y6 - VPSRAW $0x0f, Y3, Y7 - VPAND Y4, Y9, Y4 - VPAND Y5, Y9, Y5 - VPAND Y6, Y9, Y6 - VPAND Y7, Y9, Y7 - VPADDW Y0, Y4, Y0 - VPADDW Y1, Y5, Y1 - VPADDW Y2, Y6, Y2 - VPADDW Y3, Y7, Y3 - VMOVDQU Y0, 256(AX) - VMOVDQU Y1, 288(AX) - VMOVDQU Y2, 320(AX) - VMOVDQU Y3, 352(AX) - VMOVDQU 384(AX), Y0 - VMOVDQU 416(AX), Y1 - VMOVDQU 448(AX), Y2 - VMOVDQU 480(AX), Y3 - VPMULHW Y8, Y0, Y4 - VPMULHW Y8, Y1, Y5 - VPMULHW Y8, Y2, Y6 - VPMULHW Y8, Y3, Y7 - VPSRAW $0x0a, Y4, Y4 - VPSRAW $0x0a, Y5, Y5 - VPSRAW $0x0a, Y6, Y6 - VPSRAW $0x0a, Y7, Y7 - VPMULLW Y9, Y4, Y4 - VPMULLW Y9, Y5, Y5 - VPMULLW Y9, Y6, Y6 - VPMULLW Y9, Y7, Y7 - VPSUBW Y4, Y0, Y0 - VPSUBW Y5, Y1, Y1 - VPSUBW Y6, Y2, Y2 - VPSUBW Y7, Y3, Y3 - VPSUBW Y9, Y0, Y0 - VPSUBW Y9, Y1, Y1 - VPSUBW Y9, Y2, Y2 - VPSUBW Y9, Y3, Y3 - VPSRAW $0x0f, Y0, Y4 - VPSRAW $0x0f, Y1, Y5 - VPSRAW $0x0f, Y2, Y6 - VPSRAW $0x0f, Y3, Y7 - VPAND Y4, Y9, Y4 - VPAND Y5, Y9, Y5 - VPAND Y6, Y9, Y6 - VPAND Y7, Y9, Y7 - VPADDW Y0, Y4, Y0 - VPADDW Y1, Y5, Y1 - VPADDW Y2, Y6, Y2 - VPADDW Y3, Y7, Y3 - VMOVDQU Y0, 384(AX) - VMOVDQU Y1, 416(AX) - VMOVDQU Y2, 448(AX) - VMOVDQU Y3, 480(AX) - RET diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/field.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/field.go deleted file mode 100644 index 31e93ed..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/field.go +++ /dev/null @@ -1,74 +0,0 @@ -package common - -// Given -2¹⁵ q ≤ x < 2¹⁵ q, returns -q < y < q with x 2⁻¹⁶ = y (mod q). -func montReduce(x int32) int16 { - // This is Montgomery reduction with R=2¹⁶. - // - // Note gcd(2¹⁶, q) = 1 as q is prime. Write q' := 62209 = q⁻¹ mod R. - // First we compute - // - // m := ((x mod R) q') mod R - // = x q' mod R - // = int16(x q') - // = int16(int32(x) * int32(q')) - // - // Note that x q' might be as big as 2³² and could overflow the int32 - // multiplication in the last line. However for any int32s a and b, - // we have int32(int64(a)*int64(b)) = int32(a*b) and so the result is ok. - m := int16(x * 62209) - - // Note that x - m q is divisible by R; indeed modulo R we have - // - // x - m q ≡ x - x q' q ≡ x - x q⁻¹ q ≡ x - x = 0. - // - // We return y := (x - m q) / R. Note that y is indeed correct as - // modulo q we have - // - // y ≡ x R⁻¹ - m q R⁻¹ = x R⁻¹ - // - // and as both 2¹⁵ q ≤ m q, x < 2¹⁵ q, we have - // 2¹⁶ q ≤ x - m q < 2¹⁶ and so q ≤ (x - m q) / R < q as desired. - return int16(uint32(x-int32(m)*int32(Q)) >> 16) -} - -// Given any x, returns x R mod q where R=2¹⁶. -func toMont(x int16) int16 { - // Note |1353 x| ≤ 1353 2¹⁵ ≤ 13318 q ≤ 2¹⁵ q and so we're within - // the bounds of montReduce. - return montReduce(int32(x) * 1353) // 1353 = R² mod q. -} - -// Given any x, compute 0 ≤ y ≤ q with x = y (mod q). -// -// Beware: we might have barrettReduce(x) = q ≠ 0 for some x. In fact, -// this happens if and only if x = -nq for some positive integer n. -func barrettReduce(x int16) int16 { - // This is standard Barrett reduction. - // - // For any x we have x mod q = x - ⌊x/q⌋ q. We will use 20159/2²⁶ as - // an approximation of 1/q. Note that 0 ≤ 20159/2²⁶ - 1/q ≤ 0.135/2²⁶ - // and so | x 20156/2²⁶ - x/q | ≤ 2⁻¹⁰ for |x| ≤ 2¹⁶. For all x - // not a multiple of q, the number x/q is further than 1/q from any integer - // and so ⌊x 20156/2²⁶⌋ = ⌊x/q⌋. If x is a multiple of q and x is positive, - // then x 20156/2²⁶ is larger than x/q so ⌊x 20156/2²⁶⌋ = ⌊x/q⌋ as well. - // Finally, if x is negative multiple of q, then ⌊x 20156/2²⁶⌋ = ⌊x/q⌋-1. - // Thus - // [ q if x=-nq for pos. integer n - // x - ⌊x 20156/2²⁶⌋ q = [ - // [ x mod q otherwise - // - // To compute actually compute this, note that - // - // ⌊x 20156/2²⁶⌋ = (20159 x) >> 26. - return x - int16((int32(x)*20159)>>26)*Q -} - -// Returns x if x < q and x - q otherwise. Assumes x ≥ -29439. -func csubq(x int16) int16 { - x -= Q // no overflow due to assumption x ≥ -29439. - // If x is positive, then x >> 15 = 0. If x is negative, - // then uint16(x >> 15) = 2¹⁶-1. So this will add back in q - // if x was smaller than q. - x += (x >> 15) & Q - return x -} diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/generic.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/generic.go deleted file mode 100644 index 66e0e86..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/generic.go +++ /dev/null @@ -1,77 +0,0 @@ -//go:build !amd64 || purego -// +build !amd64 purego - -package common - -// Sets p to a + b. Does not normalize coefficients. -func (p *Poly) Add(a, b *Poly) { - p.addGeneric(a, b) -} - -// Sets p to a - b. Does not normalize coefficients. -func (p *Poly) Sub(a, b *Poly) { - p.subGeneric(a, b) -} - -// Executes an in-place forward "NTT" on p. -// -// Assumes the coefficients are in absolute value ≤q. The resulting -// coefficients are in absolute value ≤7q. If the input is in Montgomery -// form, then the result is in Montgomery form and so (by linearity of the NTT) -// if the input is in regular form, then the result is also in regular form. -// The order of coefficients will be "tangled". These can be put back into -// their proper order by calling Detangle(). -func (p *Poly) NTT() { - p.nttGeneric() -} - -// Executes an in-place inverse "NTT" on p and multiply by the Montgomery -// factor R. -// -// Requires coefficients to be in "tangled" order, see Tangle(). -// Assumes the coefficients are in absolute value ≤q. The resulting -// coefficients are in absolute value ≤q. If the input is in Montgomery -// form, then the result is in Montgomery form and so (by linearity) -// if the input is in regular form, then the result is also in regular form. -func (p *Poly) InvNTT() { - p.invNTTGeneric() -} - -// Sets p to the "pointwise" multiplication of a and b. -// -// That is: InvNTT(p) = InvNTT(a) * InvNTT(b). Assumes a and b are in -// Montgomery form. Products between coefficients of a and b must be strictly -// bounded in absolute value by 2¹⁵q. p will be in Montgomery form and -// bounded in absolute value by 2q. -// -// Requires a and b to be in "tangled" order, see Tangle(). p will be in -// tangled order as well. -func (p *Poly) MulHat(a, b *Poly) { - p.mulHatGeneric(a, b) -} - -// Puts p into the right form to be used with (among others) InvNTT(). -func (p *Poly) Tangle() { - // In the generic implementation there is no advantage to using a - // different order, so we use the standard order everywhere. -} - -// Puts p back into standard form. -func (p *Poly) Detangle() { - // In the generic implementation there is no advantage to using a - // different order, so we use the standard order everywhere. -} - -// Almost normalizes coefficients. -// -// Ensures each coefficient is in {0, …, q}. -func (p *Poly) BarrettReduce() { - p.barrettReduceGeneric() -} - -// Normalizes coefficients. -// -// Ensures each coefficient is in {0, …, q-1}. -func (p *Poly) Normalize() { - p.normalizeGeneric() -} diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/ntt.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/ntt.go deleted file mode 100644 index 5e565b3..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/ntt.go +++ /dev/null @@ -1,193 +0,0 @@ -package common - -// Zetas lists precomputed powers of the primitive root of unity in -// Montgomery representation used for the NTT: -// -// Zetas[i] = ζᵇʳᵛ⁽ⁱ⁾ R mod q -// -// where ζ = 17, brv(i) is the bitreversal of a 7-bit number and R=2¹⁶ mod q. -// -// The following Python code generates the Zetas arrays: -// -// q = 13*2**8 + 1; zeta = 17 -// R = 2**16 % q # Montgomery const. -// def brv(x): return int(''.join(reversed(bin(x)[2:].zfill(7))),2) -// print([(pow(zeta, brv(i), q)*R)%q for i in range(128)]) -var Zetas = [128]int16{ - 2285, 2571, 2970, 1812, 1493, 1422, 287, 202, 3158, 622, 1577, 182, - 962, 2127, 1855, 1468, 573, 2004, 264, 383, 2500, 1458, 1727, 3199, - 2648, 1017, 732, 608, 1787, 411, 3124, 1758, 1223, 652, 2777, 1015, - 2036, 1491, 3047, 1785, 516, 3321, 3009, 2663, 1711, 2167, 126, - 1469, 2476, 3239, 3058, 830, 107, 1908, 3082, 2378, 2931, 961, 1821, - 2604, 448, 2264, 677, 2054, 2226, 430, 555, 843, 2078, 871, 1550, - 105, 422, 587, 177, 3094, 3038, 2869, 1574, 1653, 3083, 778, 1159, - 3182, 2552, 1483, 2727, 1119, 1739, 644, 2457, 349, 418, 329, 3173, - 3254, 817, 1097, 603, 610, 1322, 2044, 1864, 384, 2114, 3193, 1218, - 1994, 2455, 220, 2142, 1670, 2144, 1799, 2051, 794, 1819, 2475, - 2459, 478, 3221, 3021, 996, 991, 958, 1869, 1522, 1628, -} - -// InvNTTReductions keeps track of which coefficients to apply Barrett -// reduction to in Poly.InvNTT(). -// -// Generated in a lazily: once a butterfly is computed which is about to -// overflow the int16, the largest coefficient is reduced. If that is -// not enough, the other coefficient is reduced as well. -// -// This is actually optimal, as proven in https://eprint.iacr.org/2020/1377.pdf -var InvNTTReductions = [...]int{ - -1, // after layer 1 - -1, // after layer 2 - 16, 17, 48, 49, 80, 81, 112, 113, 144, 145, 176, 177, 208, 209, 240, - 241, -1, // after layer 3 - 0, 1, 32, 33, 34, 35, 64, 65, 96, 97, 98, 99, 128, 129, 160, 161, 162, 163, - 192, 193, 224, 225, 226, 227, -1, // after layer 4 - 2, 3, 66, 67, 68, 69, 70, 71, 130, 131, 194, 195, 196, 197, 198, - 199, -1, // after layer 5 - 4, 5, 6, 7, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, - 143, -1, // after layer 6 - -1, // after layer 7 -} - -// Executes an in-place forward "NTT" on p. -// -// Assumes the coefficients are in absolute value ≤q. The resulting -// coefficients are in absolute value ≤7q. If the input is in Montgomery -// form, then the result is in Montgomery form and so (by linearity of the NTT) -// if the input is in regular form, then the result is also in regular form. -// The order of coefficients will be "tangled". These can be put back into -// their proper order by calling Detangle(). -func (p *Poly) nttGeneric() { - // Note that ℤ_q does not have a primitive 512ᵗʰ root of unity (as 512 - // does not divide into q-1) and so we cannot do a regular NTT. ℤ_q - // does have a primitive 256ᵗʰ root of unity, the smallest of which - // is ζ := 17. - // - // Recall that our base ring R := ℤ_q[x] / (x²⁵⁶ + 1). The polynomial - // x²⁵⁶+1 will not split completely (as its roots would be 512ᵗʰ roots - // of unity.) However, it does split almost (using ζ¹²⁸ = -1): - // - // x²⁵⁶ + 1 = (x²)¹²⁸ - ζ¹²⁸ - // = ((x²)⁶⁴ - ζ⁶⁴)((x²)⁶⁴ + ζ⁶⁴) - // = ((x²)³² - ζ³²)((x²)³² + ζ³²)((x²)³² - ζ⁹⁶)((x²)³² + ζ⁹⁶) - // ⋮ - // = (x² - ζ)(x² + ζ)(x² - ζ⁶⁵)(x² + ζ⁶⁵) … (x² + ζ¹²⁷) - // - // Note that the powers of ζ that appear (from the second line down) are - // in binary - // - // 0100000 1100000 - // 0010000 1010000 0110000 1110000 - // 0001000 1001000 0101000 1101000 0011000 1011000 0111000 1111000 - // … - // - // That is: brv(2), brv(3), brv(4), …, where brv(x) denotes the 7-bit - // bitreversal of x. These powers of ζ are given by the Zetas array. - // - // The polynomials x² ± ζⁱ are irreducible and coprime, hence by - // the Chinese Remainder Theorem we know - // - // ℤ_q[x]/(x²⁵⁶+1) → ℤ_q[x]/(x²-ζ) x … x ℤ_q[x]/(x²+ζ¹²⁷) - // - // given by a ↦ ( a mod x²-ζ, …, a mod x²+ζ¹²⁷ ) - // is an isomorphism, which is the "NTT". It can be efficiently computed by - // - // - // a ↦ ( a mod (x²)⁶⁴ - ζ⁶⁴, a mod (x²)⁶⁴ + ζ⁶⁴ ) - // ↦ ( a mod (x²)³² - ζ³², a mod (x²)³² + ζ³², - // a mod (x²)⁹⁶ - ζ⁹⁶, a mod (x²)⁹⁶ + ζ⁹⁶ ) - // - // et cetera - // - // If N was 8 then this can be pictured in the following diagram: - // - // https://cnx.org/resources/17ee4dfe517a6adda05377b25a00bf6e6c93c334/File0026.png - // - // Each cross is a Cooley-Tukey butterfly: it's the map - // - // (a, b) ↦ (a + ζb, a - ζb) - // - // for the appropriate power ζ for that column and row group. - - k := 0 // Index into Zetas - - // l runs effectively over the columns in the diagram above; it is half the - // height of a row group, i.e. the number of butterflies in each row group. - // In the diagram above it would be 4, 2, 1. - for l := N / 2; l > 1; l >>= 1 { - // On the nᵗʰ iteration of the l-loop, the absolute value of the - // coefficients are bounded by nq. - - // offset effectively loops over the row groups in this column; it is - // the first row in the row group. - for offset := 0; offset < N-l; offset += 2 * l { - k++ - zeta := int32(Zetas[k]) - - // j loops over each butterfly in the row group. - for j := offset; j < offset+l; j++ { - t := montReduce(zeta * int32(p[j+l])) - p[j+l] = p[j] - t - p[j] += t - } - } - } -} - -// Executes an in-place inverse "NTT" on p and multiply by the Montgomery -// factor R. -// -// Requires coefficients to be in "tangled" order, see Tangle(). -// Assumes the coefficients are in absolute value ≤q. The resulting -// coefficients are in absolute value ≤q. If the input is in Montgomery -// form, then the result is in Montgomery form and so (by linearity) -// if the input is in regular form, then the result is also in regular form. -func (p *Poly) invNTTGeneric() { - k := 127 // Index into Zetas - r := -1 // Index into InvNTTReductions. - - // We basically do the opposite of NTT, but postpone dividing by 2 in the - // inverse of the Cooley-Tukey butterfly and accumulate that into a big - // division by 2⁷ at the end. See the comments in the NTT() function. - - for l := 2; l < N; l <<= 1 { - for offset := 0; offset < N-l; offset += 2 * l { - // As we're inverting, we need powers of ζ⁻¹ (instead of ζ). - // To be precise, we need ζᵇʳᵛ⁽ᵏ⁾⁻¹²⁸. However, as ζ⁻¹²⁸ = -1, - // we can use the existing Zetas table instead of - // keeping a separate InvZetas table as in Dilithium. - - minZeta := int32(Zetas[k]) - k-- - - for j := offset; j < offset+l; j++ { - // Gentleman-Sande butterfly: (a, b) ↦ (a + b, ζ(a-b)) - t := p[j+l] - p[j] - p[j] += p[j+l] - p[j+l] = montReduce(minZeta * int32(t)) - - // Note that if we had |a| < αq and |b| < βq before the - // butterfly, then now we have |a| < (α+β)q and |b| < q. - } - } - - // We let the InvNTTReductions instruct us which coefficients to - // Barrett reduce. See TestInvNTTReductions, which tests whether - // there is an overflow. - for { - r++ - i := InvNTTReductions[r] - if i < 0 { - break - } - p[i] = barrettReduce(p[i]) - } - } - - for j := 0; j < N; j++ { - // Note 1441 = (128)⁻¹ R². The coefficients are bounded by 9q, so - // as 1441 * 9 ≈ 2¹⁴ < 2¹⁵, we're within the required bounds - // for montReduce(). - p[j] = montReduce(1441 * int32(p[j])) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/params.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/params.go deleted file mode 100644 index f04d1aa..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/params.go +++ /dev/null @@ -1,22 +0,0 @@ -package common - -import ( - "github.com/cloudflare/circl/pke/kyber/internal/common/params" -) - -const ( - // Q is the parameter q ≡ 3329 = 2¹¹ + 2¹⁰ + 2⁸ + 1. - Q = params.Q - - // N is the parameter N: the length of the polynomials - N = params.N - - // PolySize is the size of a packed polynomial. - PolySize = params.PolySize - - // PlaintextSize is the size of the plaintext - PlaintextSize = params.PlaintextSize - - // Eta2 is the parameter η₂ - Eta2 = params.Eta2 -) diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/params/params.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/params/params.go deleted file mode 100644 index dee58ee..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/params/params.go +++ /dev/null @@ -1,21 +0,0 @@ -package params - -// We put these parameters in a separate package so that the Go code, -// such as asm/src.go, that generates assembler can import it. - -const ( - // Q is the parameter q ≡ 3329 = 2¹¹ + 2¹⁰ + 2⁸ + 1. - Q int16 = 3329 - - // N is the parameter N: the length of the polynomials - N = 256 - - // PolySize is the size of a packed polynomial. - PolySize = 384 - - // PlaintextSize is the size of the plaintext - PlaintextSize = 32 - - // Eta2 is the parameter η₂ - Eta2 = 2 -) diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/poly.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/poly.go deleted file mode 100644 index f580e91..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/poly.go +++ /dev/null @@ -1,332 +0,0 @@ -package common - -// An element of our base ring R which are polynomials over ℤ_q -// modulo the equation Xᴺ = -1, where q=3329 and N=256. -// -// This type is also used to store NTT-transformed polynomials, -// see Poly.NTT(). -// -// Coefficients aren't always reduced. See Normalize(). -type Poly [N]int16 - -// Sets p to a + b. Does not normalize coefficients. -func (p *Poly) addGeneric(a, b *Poly) { - for i := 0; i < N; i++ { - p[i] = a[i] + b[i] - } -} - -// Sets p to a - b. Does not normalize coefficients. -func (p *Poly) subGeneric(a, b *Poly) { - for i := 0; i < N; i++ { - p[i] = a[i] - b[i] - } -} - -// Almost normalizes coefficients. -// -// Ensures each coefficient is in {0, …, q}. -func (p *Poly) barrettReduceGeneric() { - for i := 0; i < N; i++ { - p[i] = barrettReduce(p[i]) - } -} - -// Normalizes coefficients. -// -// Ensures each coefficient is in {0, …, q-1}. -func (p *Poly) normalizeGeneric() { - for i := 0; i < N; i++ { - p[i] = csubq(barrettReduce(p[i])) - } -} - -// Multiplies p in-place by the Montgomery factor 2¹⁶. -// -// Coefficients of p can be arbitrary. Resulting coefficients are bounded -// in absolute value by q. -func (p *Poly) ToMont() { - for i := 0; i < N; i++ { - p[i] = toMont(p[i]) - } -} - -// Sets p to the "pointwise" multiplication of a and b. -// -// That is: InvNTT(p) = InvNTT(a) * InvNTT(b). Assumes a and b are in -// Montgomery form. Products between coefficients of a and b must be strictly -// bounded in absolute value by 2¹⁵q. p will be in Montgomery form and -// bounded in absolute value by 2q. -// -// Requires a and b to be in "tangled" order, see Tangle(). p will be in -// tangled order as well. -func (p *Poly) mulHatGeneric(a, b *Poly) { - // Recall from the discussion in NTT(), that a transformed polynomial is - // an element of ℤ_q[x]/(x²-ζ) x … x ℤ_q[x]/(x²+ζ¹²⁷); - // that is: 128 degree-one polynomials instead of simply 256 elements - // from ℤ_q as in the regular NTT. So instead of pointwise multiplication, - // we multiply the 128 pairs of degree-one polynomials modulo the - // right equation: - // - // (a₁ + a₂x)(b₁ + b₂x) = a₁b₁ + a₂b₂ζ' + (a₁b₂ + a₂b₁)x, - // - // where ζ' is the appropriate power of ζ. - - k := 64 - for i := 0; i < N; i += 4 { - zeta := int32(Zetas[k]) - k++ - - p0 := montReduce(int32(a[i+1]) * int32(b[i+1])) - p0 = montReduce(int32(p0) * zeta) - p0 += montReduce(int32(a[i]) * int32(b[i])) - - p1 := montReduce(int32(a[i]) * int32(b[i+1])) - p1 += montReduce(int32(a[i+1]) * int32(b[i])) - - p[i] = p0 - p[i+1] = p1 - - p2 := montReduce(int32(a[i+3]) * int32(b[i+3])) - p2 = -montReduce(int32(p2) * zeta) - p2 += montReduce(int32(a[i+2]) * int32(b[i+2])) - - p3 := montReduce(int32(a[i+2]) * int32(b[i+3])) - p3 += montReduce(int32(a[i+3]) * int32(b[i+2])) - - p[i+2] = p2 - p[i+3] = p3 - } -} - -// Packs p into buf. buf should be of length PolySize. -// -// Assumes p is normalized (and not just Barrett reduced) and "tangled", -// see Tangle(). -func (p *Poly) Pack(buf []byte) { - q := *p - q.Detangle() - for i := 0; i < 128; i++ { - t0 := q[2*i] - t1 := q[2*i+1] - buf[3*i] = byte(t0) - buf[3*i+1] = byte(t0>>8) | byte(t1<<4) - buf[3*i+2] = byte(t1 >> 4) - } -} - -// Unpacks p from buf. -// -// buf should be of length PolySize. p will be "tangled", see Detangle(). -// -// p will not be normalized; instead 0 ≤ p[i] < 4096. -func (p *Poly) Unpack(buf []byte) { - for i := 0; i < 128; i++ { - p[2*i] = int16(buf[3*i]) | ((int16(buf[3*i+1]) << 8) & 0xfff) - p[2*i+1] = int16(buf[3*i+1]>>4) | (int16(buf[3*i+2]) << 4) - } - p.Tangle() -} - -// Set p to Decompress_q(m, 1). -// -// p will be normalized. m has to be of PlaintextSize. -func (p *Poly) DecompressMessage(m []byte) { - // Decompress_q(x, 1) = ⌈xq/2⌋ = ⌊xq/2+½⌋ = (xq+1) >> 1 and so - // Decompress_q(0, 1) = 0 and Decompress_q(1, 1) = (q+1)/2. - for i := 0; i < 32; i++ { - for j := 0; j < 8; j++ { - bit := (m[i] >> uint(j)) & 1 - - // Set coefficient to either 0 or (q+1)/2 depending on the bit. - p[8*i+j] = -int16(bit) & ((Q + 1) / 2) - } - } -} - -// Writes Compress_q(p, 1) to m. -// -// Assumes p is normalized. m has to be of length at least PlaintextSize. -func (p *Poly) CompressMessageTo(m []byte) { - // Compress_q(x, 1) is 1 on {833, …, 2496} and zero elsewhere. - for i := 0; i < 32; i++ { - m[i] = 0 - for j := 0; j < 8; j++ { - x := 1664 - p[8*i+j] - // With the previous substitution, we want to return 1 if - // and only if x is in {831, …, -832}. - x = (x >> 15) ^ x - // Note (x >> 15)ˣ if x≥0 and -x-1 otherwise. Thus now we want - // to return 1 iff x ≤ 831, ie. x - 832 < 0. - x -= 832 - m[i] |= ((byte(x >> 15)) & 1) << uint(j) - } - } -} - -// Set p to Decompress_q(m, 1). -// -// Assumes d is in {4, 5, 10, 11}. p will be normalized. -func (p *Poly) Decompress(m []byte, d int) { - // Decompress_q(x, d) = ⌈(q/2ᵈ)x⌋ - // = ⌊(q/2ᵈ)x+½⌋ - // = ⌊(qx + 2ᵈ⁻¹)/2ᵈ⌋ - // = (qx + (1<<(d-1))) >> d - switch d { - case 4: - for i := 0; i < N/2; i++ { - p[2*i] = int16(((1 << 3) + - uint32(m[i]&15)*uint32(Q)) >> 4) - p[2*i+1] = int16(((1 << 3) + - uint32(m[i]>>4)*uint32(Q)) >> 4) - } - case 5: - var t [8]uint16 - idx := 0 - for i := 0; i < N/8; i++ { - t[0] = uint16(m[idx]) - t[1] = (uint16(m[idx]) >> 5) | (uint16(m[idx+1] << 3)) - t[2] = uint16(m[idx+1]) >> 2 - t[3] = (uint16(m[idx+1]) >> 7) | (uint16(m[idx+2] << 1)) - t[4] = (uint16(m[idx+2]) >> 4) | (uint16(m[idx+3] << 4)) - t[5] = uint16(m[idx+3]) >> 1 - t[6] = (uint16(m[idx+3]) >> 6) | (uint16(m[idx+4] << 2)) - t[7] = uint16(m[idx+4]) >> 3 - - for j := 0; j < 8; j++ { - p[8*i+j] = int16(((1 << 4) + - uint32(t[j]&((1<<5)-1))*uint32(Q)) >> 5) - } - - idx += 5 - } - - case 10: - var t [4]uint16 - idx := 0 - for i := 0; i < N/4; i++ { - t[0] = uint16(m[idx]) | (uint16(m[idx+1]) << 8) - t[1] = (uint16(m[idx+1]) >> 2) | (uint16(m[idx+2]) << 6) - t[2] = (uint16(m[idx+2]) >> 4) | (uint16(m[idx+3]) << 4) - t[3] = (uint16(m[idx+3]) >> 6) | (uint16(m[idx+4]) << 2) - - for j := 0; j < 4; j++ { - p[4*i+j] = int16(((1 << 9) + - uint32(t[j]&((1<<10)-1))*uint32(Q)) >> 10) - } - - idx += 5 - } - case 11: - var t [8]uint16 - idx := 0 - for i := 0; i < N/8; i++ { - t[0] = uint16(m[idx]) | (uint16(m[idx+1]) << 8) - t[1] = (uint16(m[idx+1]) >> 3) | (uint16(m[idx+2]) << 5) - t[2] = (uint16(m[idx+2]) >> 6) | (uint16(m[idx+3]) << 2) | (uint16(m[idx+4]) << 10) - t[3] = (uint16(m[idx+4]) >> 1) | (uint16(m[idx+5]) << 7) - t[4] = (uint16(m[idx+5]) >> 4) | (uint16(m[idx+6]) << 4) - t[5] = (uint16(m[idx+6]) >> 7) | (uint16(m[idx+7]) << 1) | (uint16(m[idx+8]) << 9) - t[6] = (uint16(m[idx+8]) >> 2) | (uint16(m[idx+9]) << 6) - t[7] = (uint16(m[idx+9]) >> 5) | (uint16(m[idx+10]) << 3) - - for j := 0; j < 8; j++ { - p[8*i+j] = int16(((1 << 10) + - uint32(t[j]&((1<<11)-1))*uint32(Q)) >> 11) - } - - idx += 11 - } - default: - panic("unsupported d") - } -} - -// Writes Compress_q(p, d) to m. -// -// Assumes p is normalized and d is in {4, 5, 10, 11}. -func (p *Poly) CompressTo(m []byte, d int) { - // Compress_q(x, d) = ⌈(2ᵈ/q)x⌋ mod⁺ 2ᵈ - // = ⌊(2ᵈ/q)x+½⌋ mod⁺ 2ᵈ - // = ⌊((x << d) + q/2) / q⌋ mod⁺ 2ᵈ - // = DIV((x << d) + q/2, q) & ((1<>e, where a/(2^e) ≈ 1/q. - // For d in {10,11} we use 20,642,679/2^36, which computes division by x/q - // correctly for 0 ≤ x < 41,522,616, which fits (q << 11) + q/2 comfortably. - // For d in {4,5} we use 315/2^20, which doesn't compute division by x/q - // correctly for all inputs, but it's close enough that the end result - // of the compression is correct. The advantage is that we do not need - // to use a 64-bit intermediate value. - switch d { - case 4: - var t [8]uint16 - idx := 0 - for i := 0; i < N/8; i++ { - for j := 0; j < 8; j++ { - t[j] = uint16((((uint32(p[8*i+j])<<4)+uint32(Q)/2)*315)>> - 20) & ((1 << 4) - 1) - } - m[idx] = byte(t[0]) | byte(t[1]<<4) - m[idx+1] = byte(t[2]) | byte(t[3]<<4) - m[idx+2] = byte(t[4]) | byte(t[5]<<4) - m[idx+3] = byte(t[6]) | byte(t[7]<<4) - idx += 4 - } - - case 5: - var t [8]uint16 - idx := 0 - for i := 0; i < N/8; i++ { - for j := 0; j < 8; j++ { - t[j] = uint16((((uint32(p[8*i+j])<<5)+uint32(Q)/2)*315)>> - 20) & ((1 << 5) - 1) - } - m[idx] = byte(t[0]) | byte(t[1]<<5) - m[idx+1] = byte(t[1]>>3) | byte(t[2]<<2) | byte(t[3]<<7) - m[idx+2] = byte(t[3]>>1) | byte(t[4]<<4) - m[idx+3] = byte(t[4]>>4) | byte(t[5]<<1) | byte(t[6]<<6) - m[idx+4] = byte(t[6]>>2) | byte(t[7]<<3) - idx += 5 - } - - case 10: - var t [4]uint16 - idx := 0 - for i := 0; i < N/4; i++ { - for j := 0; j < 4; j++ { - t[j] = uint16((uint64((uint32(p[4*i+j])<<10)+uint32(Q)/2)* - 20642679)>>36) & ((1 << 10) - 1) - } - m[idx] = byte(t[0]) - m[idx+1] = byte(t[0]>>8) | byte(t[1]<<2) - m[idx+2] = byte(t[1]>>6) | byte(t[2]<<4) - m[idx+3] = byte(t[2]>>4) | byte(t[3]<<6) - m[idx+4] = byte(t[3] >> 2) - idx += 5 - } - case 11: - var t [8]uint16 - idx := 0 - for i := 0; i < N/8; i++ { - for j := 0; j < 8; j++ { - t[j] = uint16((uint64((uint32(p[8*i+j])<<11)+uint32(Q)/2)* - 20642679)>>36) & ((1 << 11) - 1) - } - m[idx] = byte(t[0]) - m[idx+1] = byte(t[0]>>8) | byte(t[1]<<3) - m[idx+2] = byte(t[1]>>5) | byte(t[2]<<6) - m[idx+3] = byte(t[2] >> 2) - m[idx+4] = byte(t[2]>>10) | byte(t[3]<<1) - m[idx+5] = byte(t[3]>>7) | byte(t[4]<<4) - m[idx+6] = byte(t[4]>>4) | byte(t[5]<<7) - m[idx+7] = byte(t[5] >> 1) - m[idx+8] = byte(t[5]>>9) | byte(t[6]<<2) - m[idx+9] = byte(t[6]>>6) | byte(t[7]<<5) - m[idx+10] = byte(t[7] >> 3) - idx += 11 - } - default: - panic("unsupported d") - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/sample.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/sample.go deleted file mode 100644 index ed5a33d..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/sample.go +++ /dev/null @@ -1,236 +0,0 @@ -package common - -import ( - "encoding/binary" - - "github.com/cloudflare/circl/internal/sha3" - "github.com/cloudflare/circl/simd/keccakf1600" -) - -// DeriveX4Available indicates whether the system supports the quick fourway -// sampling variants like PolyDeriveUniformX4. -var DeriveX4Available = keccakf1600.IsEnabledX4() - -// Samples p from a centered binomial distribution with given η. -// -// Essentially CBD_η(PRF(seed, nonce)) from the specification. -func (p *Poly) DeriveNoise(seed []byte, nonce uint8, eta int) { - switch eta { - case 2: - p.DeriveNoise2(seed, nonce) - case 3: - p.DeriveNoise3(seed, nonce) - default: - panic("unsupported eta") - } -} - -// Sample p from a centered binomial distribution with n=6 and p=½ - that is: -// coefficients are in {-3, -2, -1, 0, 1, 2, 3} with probabilities {1/64, 3/32, -// 15/64, 5/16, 16/64, 3/32, 1/64}. -func (p *Poly) DeriveNoise3(seed []byte, nonce uint8) { - keySuffix := [1]byte{nonce} - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - _, _ = h.Write(keySuffix[:]) - - // The distribution at hand is exactly the same as that - // of (a₁ + a₂ + a₃) - (b₁ + b₂+b₃) where a_i,b_i~U(1). Thus we need - // 6 bits per coefficients, thus 192 bytes of input entropy. - - // We add two extra zero bytes in the buffer to be able to read 8 bytes - // at the same time (while using only 6.) - var buf [192 + 2]byte - _, _ = h.Read(buf[:192]) - - for i := 0; i < 32; i++ { - // t is interpreted as a₁ + 2a₂ + 4a₃ + 8b₁ + 16b₂ + …. - t := binary.LittleEndian.Uint64(buf[6*i:]) - - d := t & 0x249249249249 // a₁ + 8b₁ + … - d += (t >> 1) & 0x249249249249 // a₁ + a₂ + 8(b₁ + b₂) + … - d += (t >> 2) & 0x249249249249 // a₁ + a₂ + a₃ + 4(b₁ + b₂ + b₃) + … - - for j := 0; j < 8; j++ { - a := int16(d) & 0x7 // a₁ + a₂ + a₃ - d >>= 3 - b := int16(d) & 0x7 // b₁ + b₂ + b₃ - d >>= 3 - p[8*i+j] = a - b - } - } -} - -// Sample p from a centered binomial distribution with n=4 and p=½ - that is: -// coefficients are in {-2, -1, 0, 1, 2} with probabilities {1/16, 1/4, -// 3/8, 1/4, 1/16}. -func (p *Poly) DeriveNoise2(seed []byte, nonce uint8) { - keySuffix := [1]byte{nonce} - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - _, _ = h.Write(keySuffix[:]) - - // The distribution at hand is exactly the same as that - // of (a + a') - (b + b') where a,a',b,b'~U(1). Thus we need 4 bits per - // coefficients, thus 128 bytes of input entropy. - - var buf [128]byte - _, _ = h.Read(buf[:]) - - for i := 0; i < 16; i++ { - // t is interpreted as a + 2a' + 4b + 8b' + …. - t := binary.LittleEndian.Uint64(buf[8*i:]) - - d := t & 0x5555555555555555 // a + 4b + … - d += (t >> 1) & 0x5555555555555555 // a+a' + 4(b + b') + … - - for j := 0; j < 16; j++ { - a := int16(d) & 0x3 - d >>= 2 - b := int16(d) & 0x3 - d >>= 2 - p[16*i+j] = a - b - } - } -} - -// For each i, sample ps[i] uniformly from the given seed for coordinates -// xs[i] and ys[i]. ps[i] may be nil and is ignored in that case. -// -// Can only be called when DeriveX4Available is true. -func PolyDeriveUniformX4(ps [4]*Poly, seed *[32]byte, xs, ys [4]uint8) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < 4; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // Absorb the coordinates, the SHAKE128 domain separator (0b1111), the - // start of the padding (0b…001) and the end of the padding 0b100…. - // Recall that the rate of SHAKE128 is 168; ie. 21 uint64s. - for j := 0; j < 4; j++ { - state[4*4+j] = uint64(xs[j]) | (uint64(ys[j]) << 8) | (0x1f << 16) - state[20*4+j] = 0x80 << 56 - } - - var idx [4]int // indices into ps - for j := 0; j < 4; j++ { - if ps[j] == nil { - idx[j] = N // mark nil polynomials as completed - } - } - - done := false - for !done { - // Applies KeccaK-f[1600] to state to get the next 21 uint64s of each of - // the four SHAKE128 streams. - perm.Permute() - - done = true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == N { - continue - } - for i := 0; i < 7; i++ { - var t [16]uint16 - - v1 := state[i*3*4+j] - v2 := state[(i*3+1)*4+j] - v3 := state[(i*3+2)*4+j] - - t[0] = uint16(v1) & 0xfff - t[1] = uint16(v1>>12) & 0xfff - t[2] = uint16(v1>>24) & 0xfff - t[3] = uint16(v1>>36) & 0xfff - t[4] = uint16(v1>>48) & 0xfff - t[5] = uint16((v1>>60)|(v2<<4)) & 0xfff - - t[6] = uint16(v2>>8) & 0xfff - t[7] = uint16(v2>>20) & 0xfff - t[8] = uint16(v2>>32) & 0xfff - t[9] = uint16(v2>>44) & 0xfff - t[10] = uint16((v2>>56)|(v3<<8)) & 0xfff - - t[11] = uint16(v3>>4) & 0xfff - t[12] = uint16(v3>>16) & 0xfff - t[13] = uint16(v3>>28) & 0xfff - t[14] = uint16(v3>>40) & 0xfff - t[15] = uint16(v3>>52) & 0xfff - - for k := 0; k < 16; k++ { - if t[k] < uint16(Q) { - ps[j][idx[j]] = int16(t[k]) - idx[j]++ - if idx[j] == N { - continue PolyLoop - } - } - } - } - - done = false - } - } - - for i := 0; i < 4; i++ { - if ps[i] != nil { - ps[i].Tangle() - } - } -} - -// Sample p uniformly from the given seed and x and y coordinates. -// -// Coefficients are reduced and will be in "tangled" order. See Tangle(). -func (p *Poly) DeriveUniform(seed *[32]byte, x, y uint8) { - var seedSuffix [2]byte - var buf [168]byte // rate of SHAKE-128 - - seedSuffix[0] = x - seedSuffix[1] = y - - h := sha3.NewShake128() - _, _ = h.Write(seed[:]) - _, _ = h.Write(seedSuffix[:]) - - i := 0 - for { - _, _ = h.Read(buf[:]) - - for j := 0; j < 168; j += 3 { - t1 := (uint16(buf[j]) | (uint16(buf[j+1]) << 8)) & 0xfff - t2 := (uint16(buf[j+1]>>4) | (uint16(buf[j+2]) << 4)) & 0xfff - - if t1 < uint16(Q) { - p[i] = int16(t1) - i++ - - if i == N { - break - } - } - - if t2 < uint16(Q) { - p[i] = int16(t2) - i++ - - if i == N { - break - } - } - } - - if i == N { - break - } - } - - p.Tangle() -} diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/stubs_amd64.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/stubs_amd64.go deleted file mode 100644 index 4b4700d..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/internal/common/stubs_amd64.go +++ /dev/null @@ -1,32 +0,0 @@ -// Code generated by command: go run src.go -out ../amd64.s -stubs ../stubs_amd64.go -pkg common. DO NOT EDIT. - -//go:build amd64 && !purego - -package common - -//go:noescape -func addAVX2(p *[256]int16, a *[256]int16, b *[256]int16) - -//go:noescape -func subAVX2(p *[256]int16, a *[256]int16, b *[256]int16) - -//go:noescape -func nttAVX2(p *[256]int16) - -//go:noescape -func invNttAVX2(p *[256]int16) - -//go:noescape -func mulHatAVX2(p *[256]int16, a *[256]int16, b *[256]int16) - -//go:noescape -func detangleAVX2(p *[256]int16) - -//go:noescape -func tangleAVX2(p *[256]int16) - -//go:noescape -func barrettReduceAVX2(p *[256]int16) - -//go:noescape -func normalizeAVX2(p *[256]int16) diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/cpapke.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/cpapke.go deleted file mode 100644 index bea07e8..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/cpapke.go +++ /dev/null @@ -1,192 +0,0 @@ -// Code generated from kyber512/internal/cpapke.go by gen.go - -package internal - -import ( - "bytes" - - "github.com/cloudflare/circl/internal/sha3" - "github.com/cloudflare/circl/kem" - "github.com/cloudflare/circl/pke/kyber/internal/common" -) - -// A Kyber.CPAPKE private key. -type PrivateKey struct { - sh Vec // NTT(s), normalized -} - -// A Kyber.CPAPKE public key. -type PublicKey struct { - rho [32]byte // ρ, the seed for the matrix A - th Vec // NTT(t), normalized - - // cached values - aT Mat // the matrix Aᵀ -} - -// Packs the private key to buf. -func (sk *PrivateKey) Pack(buf []byte) { - sk.sh.Pack(buf) -} - -// Unpacks the private key from buf. -func (sk *PrivateKey) Unpack(buf []byte) { - sk.sh.Unpack(buf) - sk.sh.Normalize() -} - -// Packs the public key to buf. -func (pk *PublicKey) Pack(buf []byte) { - pk.th.Pack(buf) - copy(buf[K*common.PolySize:], pk.rho[:]) -} - -// Unpacks the public key from buf. Checks if the public key is normalized. -func (pk *PublicKey) UnpackMLKEM(buf []byte) error { - pk.Unpack(buf) - - // FIPS 203 §7.2 "encapsulation key check" (2). - var buf2 [K * common.PolySize]byte - pk.th.Pack(buf2[:]) - if !bytes.Equal(buf[:len(buf2)], buf2[:]) { - return kem.ErrPubKey - } - return nil -} - -// Unpacks the public key from buf. -func (pk *PublicKey) Unpack(buf []byte) { - pk.th.Unpack(buf) - pk.th.Normalize() - copy(pk.rho[:], buf[K*common.PolySize:]) - pk.aT.Derive(&pk.rho, true) -} - -// Derives a new Kyber.CPAPKE keypair from the given seed. -func NewKeyFromSeed(seed []byte) (*PublicKey, *PrivateKey) { - var pk PublicKey - var sk PrivateKey - - var expandedSeed [64]byte - - h := sha3.New512() - _, _ = h.Write(seed) - - // This writes hash into expandedSeed. Yes, this is idiomatic Go. - _, _ = h.Read(expandedSeed[:]) - - copy(pk.rho[:], expandedSeed[:32]) - sigma := expandedSeed[32:] // σ, the noise seed - - pk.aT.Derive(&pk.rho, false) // Expand ρ to matrix A; we'll transpose later - - var eh Vec - sk.sh.DeriveNoise(sigma, 0, Eta1) // Sample secret vector s - sk.sh.NTT() - sk.sh.Normalize() - - eh.DeriveNoise(sigma, K, Eta1) // Sample blind e - eh.NTT() - - // Next, we compute t = A s + e. - for i := 0; i < K; i++ { - // Note that coefficients of s are bounded by q and those of A - // are bounded by 4.5q and so their product is bounded by 2¹⁵q - // as required for multiplication. - PolyDotHat(&pk.th[i], &pk.aT[i], &sk.sh) - - // A and s were not in Montgomery form, so the Montgomery - // multiplications in the inner product added a factor R⁻¹ which - // we'll cancel out now. This will also ensure the coefficients of - // t are bounded in absolute value by q. - pk.th[i].ToMont() - } - - pk.th.Add(&pk.th, &eh) // bounded by 8q. - pk.th.Normalize() - pk.aT.Transpose() - - return &pk, &sk -} - -// Decrypts ciphertext ct meant for private key sk to plaintext pt. -func (sk *PrivateKey) DecryptTo(pt, ct []byte) { - var u Vec - var v, m common.Poly - - u.Decompress(ct, DU) - v.Decompress(ct[K*compressedPolySize(DU):], DV) - - // Compute m = v - - u.NTT() - PolyDotHat(&m, &sk.sh, &u) - m.BarrettReduce() - m.InvNTT() - m.Sub(&v, &m) - m.Normalize() - - // Compress polynomial m to original message - m.CompressMessageTo(pt) -} - -// Encrypts message pt for the public key to ciphertext ct using randomness -// from seed. -// -// seed has to be of length SeedSize, pt of PlaintextSize and ct of -// CiphertextSize. -func (pk *PublicKey) EncryptTo(ct, pt, seed []byte) { - var rh, e1, u Vec - var e2, v, m common.Poly - - // Sample r, e₁ and e₂ from B_η - rh.DeriveNoise(seed, 0, Eta1) - rh.NTT() - rh.BarrettReduce() - - e1.DeriveNoise(seed, K, common.Eta2) - e2.DeriveNoise(seed, 2*K, common.Eta2) - - // Next we compute u = Aᵀ r + e₁. First Aᵀ. - for i := 0; i < K; i++ { - // Note that coefficients of r are bounded by q and those of Aᵀ - // are bounded by 4.5q and so their product is bounded by 2¹⁵q - // as required for multiplication. - PolyDotHat(&u[i], &pk.aT[i], &rh) - } - - u.BarrettReduce() - - // Aᵀ and r were not in Montgomery form, so the Montgomery - // multiplications in the inner product added a factor R⁻¹ which - // the InvNTT cancels out. - u.InvNTT() - - u.Add(&u, &e1) // u = Aᵀ r + e₁ - - // Next compute v = + e₂ + Decompress_q(m, 1). - PolyDotHat(&v, &pk.th, &rh) - v.BarrettReduce() - v.InvNTT() - - m.DecompressMessage(pt) - v.Add(&v, &m) - v.Add(&v, &e2) // v = + e₂ + Decompress_q(m, 1) - - // Pack ciphertext - u.Normalize() - v.Normalize() - - u.CompressTo(ct, DU) - v.CompressTo(ct[K*compressedPolySize(DU):], DV) -} - -// Returns whether sk equals other. -func (sk *PrivateKey) Equal(other *PrivateKey) bool { - ret := int16(0) - for i := 0; i < K; i++ { - for j := 0; j < common.N; j++ { - ret |= sk.sh[i][j] ^ other.sh[i][j] - } - } - return ret == 0 -} diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/mat.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/mat.go deleted file mode 100644 index 404aacf..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/mat.go +++ /dev/null @@ -1,85 +0,0 @@ -// Code generated from kyber512/internal/mat.go by gen.go - -package internal - -import ( - "github.com/cloudflare/circl/pke/kyber/internal/common" -) - -// A k by k matrix of polynomials. -type Mat [K]Vec - -// Expands the given seed to the corresponding matrix A or its transpose Aᵀ. -func (m *Mat) Derive(seed *[32]byte, transpose bool) { - if !common.DeriveX4Available { - if transpose { - for i := 0; i < K; i++ { - for j := 0; j < K; j++ { - m[i][j].DeriveUniform(seed, uint8(i), uint8(j)) - } - } - } else { - for i := 0; i < K; i++ { - for j := 0; j < K; j++ { - m[i][j].DeriveUniform(seed, uint8(j), uint8(i)) - } - } - } - return - } - - var ps [4]*common.Poly - var xs [4]uint8 - var ys [4]uint8 - x := uint8(0) - y := uint8(0) - - for x != K { - idx := 0 - for ; idx < 4; idx++ { - ps[idx] = &m[x][y] - - if transpose { - xs[idx] = x - ys[idx] = y - } else { - xs[idx] = y - ys[idx] = x - } - - y++ - if y == K { - x++ - y = 0 - - if x == K { - if idx == 0 { - // If there is just one left, then a plain DeriveUniform - // is quicker than the X4 variant. - ps[0].DeriveUniform(seed, xs[0], ys[0]) - return - } - - for idx++; idx < 4; idx++ { - ps[idx] = nil - } - - break - } - } - } - - common.PolyDeriveUniformX4(ps, seed, xs, ys) - } -} - -// Transposes A in place. -func (m *Mat) Transpose() { - for i := 0; i < K-1; i++ { - for j := i + 1; j < K; j++ { - t := m[i][j] - m[i][j] = m[j][i] - m[j][i] = t - } - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/params.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/params.go deleted file mode 100644 index 27cdb1a..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/params.go +++ /dev/null @@ -1,21 +0,0 @@ -// Code generated from params.templ.go. DO NOT EDIT. - -package internal - -import ( - "github.com/cloudflare/circl/pke/kyber/internal/common" -) - -const ( - K = 3 - Eta1 = 2 - DU = 10 - DV = 4 - PublicKeySize = 32 + K*common.PolySize - - PrivateKeySize = K * common.PolySize - - PlaintextSize = common.PlaintextSize - SeedSize = 32 - CiphertextSize = 1088 -) diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/vec.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/vec.go deleted file mode 100644 index 6681895..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/internal/vec.go +++ /dev/null @@ -1,125 +0,0 @@ -// Code generated from kyber512/internal/vec.go by gen.go - -package internal - -import ( - "github.com/cloudflare/circl/pke/kyber/internal/common" -) - -// A vector of K polynomials -type Vec [K]common.Poly - -// Samples v[i] from a centered binomial distribution with given η, -// seed and nonce+i. -// -// Essentially CBD_η(PRF(seed, nonce+i)) from the specification. -func (v *Vec) DeriveNoise(seed []byte, nonce uint8, eta int) { - for i := 0; i < K; i++ { - v[i].DeriveNoise(seed, nonce+uint8(i), eta) - } -} - -// Sets p to the inner product of a and b using "pointwise" multiplication. -// -// See MulHat() and NTT() for a description of the multiplication. -// Assumes a and b are in Montgomery form. p will be in Montgomery form, -// and its coefficients will be bounded in absolute value by 2kq. -// If a and b are not in Montgomery form, then the action is the same -// as "pointwise" multiplication followed by multiplying by R⁻¹, the inverse -// of the Montgomery factor. -func PolyDotHat(p *common.Poly, a, b *Vec) { - var t common.Poly - *p = common.Poly{} // set p to zero - for i := 0; i < K; i++ { - t.MulHat(&a[i], &b[i]) - p.Add(&t, p) - } -} - -// Almost normalizes coefficients in-place. -// -// Ensures each coefficient is in {0, …, q}. -func (v *Vec) BarrettReduce() { - for i := 0; i < K; i++ { - v[i].BarrettReduce() - } -} - -// Normalizes coefficients in-place. -// -// Ensures each coefficient is in {0, …, q-1}. -func (v *Vec) Normalize() { - for i := 0; i < K; i++ { - v[i].Normalize() - } -} - -// Applies in-place inverse NTT(). See Poly.InvNTT() for assumptions. -func (v *Vec) InvNTT() { - for i := 0; i < K; i++ { - v[i].InvNTT() - } -} - -// Applies in-place forward NTT(). See Poly.NTT() for assumptions. -func (v *Vec) NTT() { - for i := 0; i < K; i++ { - v[i].NTT() - } -} - -// Sets v to a + b. -func (v *Vec) Add(a, b *Vec) { - for i := 0; i < K; i++ { - v[i].Add(&a[i], &b[i]) - } -} - -// Packs v into buf, which must be of length K*PolySize. -func (v *Vec) Pack(buf []byte) { - for i := 0; i < K; i++ { - v[i].Pack(buf[common.PolySize*i:]) - } -} - -// Unpacks v from buf which must be of length K*PolySize. -func (v *Vec) Unpack(buf []byte) { - for i := 0; i < K; i++ { - v[i].Unpack(buf[common.PolySize*i:]) - } -} - -// Writes Compress_q(v, d) to m. -// -// Assumes v is normalized and d is in {3, 4, 5, 10, 11}. -func (v *Vec) CompressTo(m []byte, d int) { - size := compressedPolySize(d) - for i := 0; i < K; i++ { - v[i].CompressTo(m[size*i:], d) - } -} - -// Set v to Decompress_q(m, 1). -// -// Assumes d is in {3, 4, 5, 10, 11}. v will be normalized. -func (v *Vec) Decompress(m []byte, d int) { - size := compressedPolySize(d) - for i := 0; i < K; i++ { - v[i].Decompress(m[size*i:], d) - } -} - -// ⌈(256 d)/8⌉ -func compressedPolySize(d int) int { - switch d { - case 4: - return 128 - case 5: - return 160 - case 10: - return 320 - case 11: - return 352 - } - panic("unsupported d") -} diff --git a/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/kyber.go b/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/kyber.go deleted file mode 100644 index 75bb7bd..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pke/kyber/kyber768/kyber.go +++ /dev/null @@ -1,175 +0,0 @@ -// Code generated from pkg.templ.go. DO NOT EDIT. - -// kyber768 implements the IND-CPA-secure Public Key Encryption -// scheme Kyber768.CPAPKE as submitted to round 3 of the NIST PQC competition -// and described in -// -// https://pq-crystals.org/kyber/data/kyber-specification-round3.pdf -package kyber768 - -import ( - cryptoRand "crypto/rand" - "io" - - "github.com/cloudflare/circl/kem" - "github.com/cloudflare/circl/pke/kyber/kyber768/internal" -) - -const ( - // Size of seed for NewKeyFromSeed - KeySeedSize = internal.SeedSize - - // Size of seed for EncryptTo - EncryptionSeedSize = internal.SeedSize - - // Size of a packed PublicKey - PublicKeySize = internal.PublicKeySize - - // Size of a packed PrivateKey - PrivateKeySize = internal.PrivateKeySize - - // Size of a ciphertext - CiphertextSize = internal.CiphertextSize - - // Size of a plaintext - PlaintextSize = internal.PlaintextSize -) - -// PublicKey is the type of Kyber768.CPAPKE public key -type PublicKey internal.PublicKey - -// PrivateKey is the type of Kyber768.CPAPKE private key -type PrivateKey internal.PrivateKey - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - var seed [KeySeedSize]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - pk, sk := internal.NewKeyFromSeed(seed[:]) - return (*PublicKey)(pk), (*PrivateKey)(sk), nil -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -// -// Note: does not include the domain separation of ML-KEM (line 1, algorithm 13 -// of FIPS 203). For that use NewKeyFromSeedMLKEM(). -// -// Panics if seed is not of length KeySeedSize. -func NewKeyFromSeed(seed []byte) (*PublicKey, *PrivateKey) { - if len(seed) != KeySeedSize { - panic("seed must be of length KeySeedSize") - } - pk, sk := internal.NewKeyFromSeed(seed) - return (*PublicKey)(pk), (*PrivateKey)(sk) -} - -// NewKeyFromSeedMLKEM derives a public/private key pair using the given seed -// using the domain separation of ML-KEM. -// -// Panics if seed is not of length KeySeedSize. -func NewKeyFromSeedMLKEM(seed []byte) (*PublicKey, *PrivateKey) { - if len(seed) != KeySeedSize { - panic("seed must be of length KeySeedSize") - } - var seed2 [33]byte - copy(seed2[:32], seed) - seed2[32] = byte(internal.K) - pk, sk := internal.NewKeyFromSeed(seed2[:]) - return (*PublicKey)(pk), (*PrivateKey)(sk) -} - -// EncryptTo encrypts message pt for the public key and writes the ciphertext -// to ct using randomness from seed. -// -// This function panics if the lengths of pt, seed, and ct are not -// PlaintextSize, EncryptionSeedSize, and CiphertextSize respectively. -func (pk *PublicKey) EncryptTo(ct []byte, pt []byte, seed []byte) { - if len(pt) != PlaintextSize { - panic("pt must be of length PlaintextSize") - } - if len(ct) != CiphertextSize { - panic("ct must be of length CiphertextSize") - } - if len(seed) != EncryptionSeedSize { - panic("seed must be of length EncryptionSeedSize") - } - (*internal.PublicKey)(pk).EncryptTo(ct, pt, seed) -} - -// DecryptTo decrypts message ct for the private key and writes the -// plaintext to pt. -// -// This function panics if the lengths of ct and pt are not -// CiphertextSize and PlaintextSize respectively. -func (sk *PrivateKey) DecryptTo(pt []byte, ct []byte) { - if len(pt) != PlaintextSize { - panic("pt must be of length PlaintextSize") - } - if len(ct) != CiphertextSize { - panic("ct must be of length CiphertextSize") - } - (*internal.PrivateKey)(sk).DecryptTo(pt, ct) -} - -// Packs pk into the given buffer. -// -// Panics if buf is not of length PublicKeySize. -func (pk *PublicKey) Pack(buf []byte) { - if len(buf) != PublicKeySize { - panic("buf must be of size PublicKeySize") - } - (*internal.PublicKey)(pk).Pack(buf) -} - -// Packs sk into the given buffer. -// -// Panics if buf is not of length PrivateKeySize. -func (sk *PrivateKey) Pack(buf []byte) { - if len(buf) != PrivateKeySize { - panic("buf must be of size PrivateKeySize") - } - (*internal.PrivateKey)(sk).Pack(buf) -} - -// Unpacks pk from the given buffer. -// -// Panics if buf is not of length PublicKeySize. -func (pk *PublicKey) Unpack(buf []byte) { - if len(buf) != PublicKeySize { - panic("buf must be of size PublicKeySize") - } - (*internal.PublicKey)(pk).Unpack(buf) -} - -// Unpacks pk from the given buffer. -// -// Returns an error if the buffer is not of the right size, or the public -// key is not normalized. -func (pk *PublicKey) UnpackMLKEM(buf []byte) error { - if len(buf) != PublicKeySize { - return kem.ErrPubKeySize - } - return (*internal.PublicKey)(pk).UnpackMLKEM(buf) -} - -// Unpacks sk from the given buffer. -// -// Panics if buf is not of length PrivateKeySize. -func (sk *PrivateKey) Unpack(buf []byte) { - if len(buf) != PrivateKeySize { - panic("buf must be of size PrivateKeySize") - } - (*internal.PrivateKey)(sk).Unpack(buf) -} - -// Returns whether the two private keys are equal. -func (sk *PrivateKey) Equal(other *PrivateKey) bool { - return (*internal.PrivateKey)(sk).Equal((*internal.PrivateKey)(other)) -} diff --git a/backend/vendor/github.com/cloudflare/circl/pki/pki.go b/backend/vendor/github.com/cloudflare/circl/pki/pki.go deleted file mode 100644 index a2edebd..0000000 --- a/backend/vendor/github.com/cloudflare/circl/pki/pki.go +++ /dev/null @@ -1,182 +0,0 @@ -package pki - -import ( - "crypto/x509/pkix" - "encoding/asn1" - "encoding/pem" - "errors" - "strings" - - "github.com/cloudflare/circl/sign" - "github.com/cloudflare/circl/sign/schemes" -) - -var ( - allSchemesByOID map[string]sign.Scheme - allSchemesByTLS map[uint]sign.Scheme -) - -type pkixPrivKey struct { - Version int - Algorithm pkix.AlgorithmIdentifier - PrivateKey []byte -} - -func init() { - allSchemesByOID = make(map[string]sign.Scheme) - allSchemesByTLS = make(map[uint]sign.Scheme) - for _, scheme := range schemes.All() { - if cert, ok := scheme.(CertificateScheme); ok { - allSchemesByOID[cert.Oid().String()] = scheme - } - if tlsScheme, ok := scheme.(TLSScheme); ok { - allSchemesByTLS[tlsScheme.TLSIdentifier()] = scheme - } - } -} - -func SchemeByOid(oid asn1.ObjectIdentifier) sign.Scheme { return allSchemesByOID[oid.String()] } - -func SchemeByTLSID(id uint) sign.Scheme { return allSchemesByTLS[id] } - -// Additional methods when the signature scheme is supported in X509. -type CertificateScheme interface { - // Return the appropriate OIDs for this instance. It is implicitly - // assumed that the encoding is simple: e.g. uses the same OID for - // signature and public key like Ed25519. - Oid() asn1.ObjectIdentifier -} - -// Additional methods when the signature scheme is supported in TLS. -type TLSScheme interface { - TLSIdentifier() uint -} - -func UnmarshalPEMPublicKey(data []byte) (sign.PublicKey, error) { - block, rest := pem.Decode(data) - if len(rest) != 0 { - return nil, errors.New("trailing data") - } - if !strings.HasSuffix(block.Type, "PUBLIC KEY") { - return nil, errors.New("pem block type is not public key") - } - - return UnmarshalPKIXPublicKey(block.Bytes) -} - -func UnmarshalPKIXPublicKey(data []byte) (sign.PublicKey, error) { - var pkix struct { - Raw asn1.RawContent - Algorithm pkix.AlgorithmIdentifier - PublicKey asn1.BitString - } - if rest, err := asn1.Unmarshal(data, &pkix); err != nil { - return nil, err - } else if len(rest) != 0 { - return nil, errors.New("trailing data") - } - scheme := SchemeByOid(pkix.Algorithm.Algorithm) - if scheme == nil { - return nil, errors.New("unsupported public key algorithm") - } - return scheme.UnmarshalBinaryPublicKey(pkix.PublicKey.RightAlign()) -} - -func UnmarshalPEMPrivateKey(data []byte) (sign.PrivateKey, error) { - block, rest := pem.Decode(data) - if len(rest) != 0 { - return nil, errors.New("trailing") - } - if !strings.HasSuffix(block.Type, "PRIVATE KEY") { - return nil, errors.New("pem block type is not private key") - } - - return UnmarshalPKIXPrivateKey(block.Bytes) -} - -func UnmarshalPKIXPrivateKey(data []byte) (sign.PrivateKey, error) { - var pkix pkixPrivKey - if rest, err := asn1.Unmarshal(data, &pkix); err != nil { - return nil, err - } else if len(rest) != 0 { - return nil, errors.New("trailing data") - } - scheme := SchemeByOid(pkix.Algorithm.Algorithm) - if scheme == nil { - return nil, errors.New("unsupported public key algorithm") - } - var sk []byte - if rest, err := asn1.Unmarshal(pkix.PrivateKey, &sk); err != nil { - return nil, err - } else if len(rest) > 0 { - return nil, errors.New("trailing data") - } - return scheme.UnmarshalBinaryPrivateKey(sk) -} - -func MarshalPEMPublicKey(pk sign.PublicKey) ([]byte, error) { - data, err := MarshalPKIXPublicKey(pk) - if err != nil { - return nil, err - } - str := pem.EncodeToMemory(&pem.Block{ - Type: "PUBLIC KEY", - Bytes: data, - }) - return str, nil -} - -func MarshalPKIXPublicKey(pk sign.PublicKey) ([]byte, error) { - data, err := pk.MarshalBinary() - if err != nil { - return nil, err - } - - scheme := pk.Scheme() - return asn1.Marshal(struct { - pkix.AlgorithmIdentifier - asn1.BitString - }{ - pkix.AlgorithmIdentifier{ - Algorithm: scheme.(CertificateScheme).Oid(), - }, - asn1.BitString{ - Bytes: data, - BitLength: len(data) * 8, - }, - }) -} - -func MarshalPEMPrivateKey(sk sign.PrivateKey) ([]byte, error) { - data, err := MarshalPKIXPrivateKey(sk) - if err != nil { - return nil, err - } - str := pem.EncodeToMemory(&pem.Block{ - Type: sk.Scheme().Name() + " PRIVATE KEY", - Bytes: data, - }, - ) - return str, nil -} - -func MarshalPKIXPrivateKey(sk sign.PrivateKey) ([]byte, error) { - data, err := sk.MarshalBinary() - if err != nil { - return nil, err - } - - data, err = asn1.Marshal(data) - if err != nil { - return nil, err - } - - scheme := sk.Scheme() - return asn1.Marshal(pkixPrivKey{ - 0, - pkix.AlgorithmIdentifier{ - Algorithm: scheme.(CertificateScheme).Oid(), - }, - data, - }) -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/dilithium.go deleted file mode 100644 index 5e69389..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/dilithium.go +++ /dev/null @@ -1,295 +0,0 @@ -// Code generated from pkg.templ.go. DO NOT EDIT. - -// mode2 implements the CRYSTALS-Dilithium signature scheme Dilithium2 -// as submitted to round3 of the NIST PQC competition and described in -// -// https://pq-crystals.org/dilithium/data/dilithium-specification-round3-20210208.pdf -package mode2 - -import ( - "crypto" - "errors" - "io" - - "github.com/cloudflare/circl/sign" - "github.com/cloudflare/circl/sign/dilithium/mode2/internal" - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -const ( - // Size of seed for NewKeyFromSeed - SeedSize = common.SeedSize - - // Size of a packed PublicKey - PublicKeySize = internal.PublicKeySize - - // Size of a packed PrivateKey - PrivateKeySize = internal.PrivateKeySize - - // Size of a signature - SignatureSize = internal.SignatureSize -) - -// PublicKey is the type of Dilithium2 public key -type PublicKey internal.PublicKey - -// PrivateKey is the type of Dilithium2 private key -type PrivateKey internal.PrivateKey - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - pk, sk, err := internal.GenerateKey(rand) - return (*PublicKey)(pk), (*PrivateKey)(sk), err -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[SeedSize]byte) (*PublicKey, *PrivateKey) { - pk, sk := internal.NewKeyFromSeed(seed) - return (*PublicKey)(pk), (*PrivateKey)(sk) -} - -// SignTo signs the given message and writes the signature into signature. -// It will panic if signature is not of length at least SignatureSize. -func SignTo(sk *PrivateKey, msg, sig []byte) { - var rnd [32]byte - - internal.SignTo( - (*internal.PrivateKey)(sk), - func(w io.Writer) { - w.Write(msg) - }, - rnd, - sig, - ) -} - -// Verify checks whether the given signature by pk on msg is valid. -func Verify(pk *PublicKey, msg, sig []byte) bool { - return internal.Verify( - (*internal.PublicKey)(pk), - func(w io.Writer) { - _, _ = w.Write(msg) - }, - sig, - ) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Unpack(buf) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Unpack(buf) -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Pack(buf) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Pack(buf) -} - -// Packs the public key. -func (pk *PublicKey) Bytes() []byte { - var buf [PublicKeySize]byte - pk.Pack(&buf) - return buf[:] -} - -// Packs the private key. -func (sk *PrivateKey) Bytes() []byte { - var buf [PrivateKeySize]byte - sk.Pack(&buf) - return buf[:] -} - -// Packs the public key. -func (pk *PublicKey) MarshalBinary() ([]byte, error) { - return pk.Bytes(), nil -} - -// Packs the private key. -func (sk *PrivateKey) MarshalBinary() ([]byte, error) { - return sk.Bytes(), nil -} - -// Unpacks the public key from data. -func (pk *PublicKey) UnmarshalBinary(data []byte) error { - if len(data) != PublicKeySize { - return errors.New("packed public key must be of mode2.PublicKeySize bytes") - } - var buf [PublicKeySize]byte - copy(buf[:], data) - pk.Unpack(&buf) - return nil -} - -// Unpacks the private key from data. -func (sk *PrivateKey) UnmarshalBinary(data []byte) error { - if len(data) != PrivateKeySize { - return errors.New("packed private key must be of mode2.PrivateKeySize bytes") - } - var buf [PrivateKeySize]byte - copy(buf[:], data) - sk.Unpack(&buf) - return nil -} - -// Sign signs the given message. -// -// opts.HashFunc() must return zero, which can be achieved by passing -// crypto.Hash(0) for opts. rand is ignored. Will only return an error -// if opts.HashFunc() is non-zero. -// -// This function is used to make PrivateKey implement the crypto.Signer -// interface. The package-level SignTo function might be more convenient -// to use. -func (sk *PrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ( - sig []byte, err error) { - var ret [SignatureSize]byte - - if opts.HashFunc() != crypto.Hash(0) { - return nil, errors.New("dilithium: cannot sign hashed message") - } - SignTo(sk, msg, ret[:]) - - return ret[:], nil -} - -// Computes the public key corresponding to this private key. -// -// Returns a *PublicKey. The type crypto.PublicKey is used to make -// PrivateKey implement the crypto.Signer interface. -func (sk *PrivateKey) Public() crypto.PublicKey { - return (*PublicKey)((*internal.PrivateKey)(sk).Public()) -} - -// Equal returns whether the two private keys equal. -func (sk *PrivateKey) Equal(other crypto.PrivateKey) bool { - castOther, ok := other.(*PrivateKey) - if !ok { - return false - } - return (*internal.PrivateKey)(sk).Equal((*internal.PrivateKey)(castOther)) -} - -// Equal returns whether the two public keys equal. -func (pk *PublicKey) Equal(other crypto.PublicKey) bool { - castOther, ok := other.(*PublicKey) - if !ok { - return false - } - return (*internal.PublicKey)(pk).Equal((*internal.PublicKey)(castOther)) -} - -// Boilerplate for generic signatures API - -type scheme struct{} - -var sch sign.Scheme = &scheme{} - -// Scheme returns a generic signature interface for Dilithium2. -func Scheme() sign.Scheme { return sch } - -func (*scheme) Name() string { return "Dilithium2" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SignatureSize() int { return SignatureSize } -func (*scheme) SeedSize() int { return SeedSize } - -// TODO TLSIdentifier() - -func (*scheme) SupportsContext() bool { - return false -} - -func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) { - return GenerateKey(nil) -} - -func (*scheme) Sign( - sk sign.PrivateKey, - msg []byte, - opts *sign.SignatureOpts, -) []byte { - sig := make([]byte, SignatureSize) - - priv, ok := sk.(*PrivateKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - SignTo(priv, msg, sig) - - return sig -} - -func (*scheme) Verify( - pk sign.PublicKey, - msg, sig []byte, - opts *sign.SignatureOpts, -) bool { - pub, ok := pk.(*PublicKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - return Verify(pub, msg, sig) -} - -func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) { - if len(seed) != SeedSize { - panic(sign.ErrSeedSize) - } - var seed2 [SeedSize]byte - copy(seed2[:], seed) - return NewKeyFromSeed(&seed2) -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) { - if len(buf) != PublicKeySize { - return nil, sign.ErrPubKeySize - } - - var ( - buf2 [PublicKeySize]byte - ret PublicKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) { - if len(buf) != PrivateKeySize { - return nil, sign.ErrPrivKeySize - } - - var ( - buf2 [PrivateKeySize]byte - ret PrivateKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (sk *PrivateKey) Scheme() sign.Scheme { - return sch -} - -func (sk *PublicKey) Scheme() sign.Scheme { - return sch -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/dilithium.go deleted file mode 100644 index 8f1c8e5..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/dilithium.go +++ /dev/null @@ -1,491 +0,0 @@ -// Code generated from mode3/internal/dilithium.go by gen.go - -package internal - -import ( - cryptoRand "crypto/rand" - "crypto/subtle" - "io" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -const ( - // Size of a packed polynomial of norm ≤η. - // (Note that the formula is not valid in general.) - PolyLeqEtaSize = (common.N * DoubleEtaBits) / 8 - - // β = τη, the maximum size of c s₂. - Beta = Tau * Eta - - // γ₁ range of y - Gamma1 = 1 << Gamma1Bits - - // Size of packed polynomial of norm <γ₁ such as z - PolyLeGamma1Size = (Gamma1Bits + 1) * common.N / 8 - - // α = 2γ₂ parameter for decompose - Alpha = 2 * Gamma2 - - // Size of a packed private key - PrivateKeySize = 32 + 32 + TRSize + PolyLeqEtaSize*(L+K) + common.PolyT0Size*K - - // Size of a packed public key - PublicKeySize = 32 + common.PolyT1Size*K - - // Size of a packed signature - SignatureSize = L*PolyLeGamma1Size + Omega + K + CTildeSize - - // Size of packed w₁ - PolyW1Size = (common.N * (common.QBits - Gamma1Bits)) / 8 -) - -// PublicKey is the type of Dilithium public keys. -type PublicKey struct { - rho [32]byte - t1 VecK - - // Cached values - t1p [common.PolyT1Size * K]byte - A *Mat - tr *[TRSize]byte -} - -// PrivateKey is the type of Dilithium private keys. -type PrivateKey struct { - rho [32]byte - key [32]byte - s1 VecL - s2 VecK - t0 VecK - tr [TRSize]byte - - // Cached values - A Mat // ExpandA(ρ) - s1h VecL // NTT(s₁) - s2h VecK // NTT(s₂) - t0h VecK // NTT(t₀) -} - -type unpackedSignature struct { - z VecL - hint VecK - c [CTildeSize]byte -} - -// Packs the signature into buf. -func (sig *unpackedSignature) Pack(buf []byte) { - copy(buf[:], sig.c[:]) - sig.z.PackLeGamma1(buf[CTildeSize:]) - sig.hint.PackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) -} - -// Sets sig to the signature encoded in the buffer. -// -// Returns whether buf contains a properly packed signature. -func (sig *unpackedSignature) Unpack(buf []byte) bool { - if len(buf) < SignatureSize { - return false - } - copy(sig.c[:], buf[:]) - sig.z.UnpackLeGamma1(buf[CTildeSize:]) - if sig.z.Exceeds(Gamma1 - Beta) { - return false - } - if !sig.hint.UnpackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) { - return false - } - return true -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - copy(buf[:32], pk.rho[:]) - copy(buf[32:], pk.t1p[:]) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - copy(pk.rho[:], buf[:32]) - copy(pk.t1p[:], buf[32:]) - - pk.t1.UnpackT1(pk.t1p[:]) - pk.A = new(Mat) - pk.A.Derive(&pk.rho) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - pk.tr = new([TRSize]byte) - h := sha3.NewShake256() - _, _ = h.Write(buf[:]) - _, _ = h.Read(pk.tr[:]) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - copy(buf[:32], sk.rho[:]) - copy(buf[32:64], sk.key[:]) - copy(buf[64:64+TRSize], sk.tr[:]) - offset := 64 + TRSize - sk.s1.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.PackT0(buf[offset:]) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - copy(sk.rho[:], buf[:32]) - copy(sk.key[:], buf[32:64]) - copy(sk.tr[:], buf[64:64+TRSize]) - offset := 64 + TRSize - sk.s1.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.UnpackT0(buf[offset:]) - - // Cached values - sk.A.Derive(&sk.rho) - sk.t0h = sk.t0 - sk.t0h.NTT() - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() -} - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - var seed [32]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - pk, sk := NewKeyFromSeed(&seed) - return pk, sk, nil -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[common.SeedSize]byte) (*PublicKey, *PrivateKey) { - var eSeed [128]byte // expanded seed - var pk PublicKey - var sk PrivateKey - var sSeed [64]byte - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - - if NIST { - _, _ = h.Write([]byte{byte(K), byte(L)}) - } - - _, _ = h.Read(eSeed[:]) - - copy(pk.rho[:], eSeed[:32]) - copy(sSeed[:], eSeed[32:96]) - copy(sk.key[:], eSeed[96:]) - copy(sk.rho[:], pk.rho[:]) - - sk.A.Derive(&pk.rho) - - for i := uint16(0); i < L; i++ { - PolyDeriveUniformLeqEta(&sk.s1[i], &sSeed, i) - } - - for i := uint16(0); i < K; i++ { - PolyDeriveUniformLeqEta(&sk.s2[i], &sSeed, i+L) - } - - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() - - sk.computeT0andT1(&sk.t0, &pk.t1) - - sk.t0h = sk.t0 - sk.t0h.NTT() - - // Complete public key far enough to be packed - pk.t1.PackT1(pk.t1p[:]) - pk.A = &sk.A - - // Finish private key - var packedPk [PublicKeySize]byte - pk.Pack(&packedPk) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - h.Reset() - _, _ = h.Write(packedPk[:]) - _, _ = h.Read(sk.tr[:]) - - // Finish cache of public key - pk.tr = &sk.tr - - return &pk, &sk -} - -// Computes t0 and t1 from sk.s1h, sk.s2 and sk.A. -func (sk *PrivateKey) computeT0andT1(t0, t1 *VecK) { - var t VecK - - // Set t to A s₁ + s₂ - for i := 0; i < K; i++ { - PolyDotHat(&t[i], &sk.A[i], &sk.s1h) - t[i].ReduceLe2Q() - t[i].InvNTT() - } - t.Add(&t, &sk.s2) - t.Normalize() - - // Compute t₀, t₁ = Power2Round(t) - t.Power2Round(t0, t1) -} - -// Verify checks whether the given signature by pk on msg is valid. -// -// For Dilithium this is the top-level verification function. -// In ML-DSA, this is ML-DSA.Verify_internal. -func Verify(pk *PublicKey, msg func(io.Writer), signature []byte) bool { - var sig unpackedSignature - var mu [64]byte - var zh VecL - var Az, Az2dct1, w1 VecK - var ch common.Poly - var cp [CTildeSize]byte - var w1Packed [PolyW1Size * K]byte - - // Note that Unpack() checked whether ‖z‖_∞ < γ₁ - β - // and ensured that there at most ω ones in pk.hint. - if !sig.Unpack(signature) { - return false - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(pk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // Compute Az - zh = sig.z - zh.NTT() - - for i := 0; i < K; i++ { - PolyDotHat(&Az[i], &pk.A[i], &zh) - } - - // Next, we compute Az - 2ᵈ·c·t₁. - // Note that the coefficients of t₁ are bounded by 256 = 2⁹, - // so the coefficients of Az2dct1 will bounded by 2⁹⁺ᵈ = 2²³ < 2q, - // which is small enough for NTT(). - Az2dct1.MulBy2toD(&pk.t1) - Az2dct1.NTT() - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - for i := 0; i < K; i++ { - Az2dct1[i].MulHat(&Az2dct1[i], &ch) - } - Az2dct1.Sub(&Az, &Az2dct1) - Az2dct1.ReduceLe2Q() - Az2dct1.InvNTT() - Az2dct1.NormalizeAssumingLe2Q() - - // UseHint(pk.hint, Az - 2ᵈ·c·t₁) - // = UseHint(pk.hint, w - c·s₂ + c·t₀) - // = UseHint(pk.hint, r + c·t₀) - // = r₁ = w₁. - w1.UseHint(&Az2dct1, &sig.hint) - w1.PackW1(w1Packed[:]) - - // c' = H(μ, w₁) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(cp[:]) - - return sig.c == cp -} - -// SignTo signs the given message and writes the signature into signature. -// -// For Dilithium this is the top-level signing function. For ML-DSA -// this is ML-DSA.Sign_internal. -// -//nolint:funlen -func SignTo(sk *PrivateKey, msg func(io.Writer), rnd [32]byte, signature []byte) { - var mu, rhop [64]byte - var w1Packed [PolyW1Size * K]byte - var y, yh VecL - var w, w0, w1, w0mcs2, ct0, w0mcs2pct0 VecK - var ch common.Poly - var yNonce uint16 - var sig unpackedSignature - - if len(signature) < SignatureSize { - panic("Signature does not fit in that byteslice") - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(sk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // ρ' = CRH(key ‖ μ) - h.Reset() - _, _ = h.Write(sk.key[:]) - if NIST { - _, _ = h.Write(rnd[:]) - } - _, _ = h.Write(mu[:]) - _, _ = h.Read(rhop[:]) - - // Main rejection loop - attempt := 0 - for { - attempt++ - if attempt >= 576 { - // Depending on the mode, one try has a chance between 1/7 and 1/4 - // of succeeding. Thus it is safe to say that 576 iterations - // are enough as (6/7)⁵⁷⁶ < 2⁻¹²⁸. - panic("This should only happen 1 in 2^{128}: something is wrong.") - } - - // y = ExpandMask(ρ', key) - VecLDeriveUniformLeGamma1(&y, &rhop, yNonce) - yNonce += uint16(L) - - // Set w to A y - yh = y - yh.NTT() - for i := 0; i < K; i++ { - PolyDotHat(&w[i], &sk.A[i], &yh) - w[i].ReduceLe2Q() - w[i].InvNTT() - } - - // Decompose w into w₀ and w₁ - w.NormalizeAssumingLe2Q() - w.Decompose(&w0, &w1) - - // c~ = H(μ ‖ w₁) - w1.PackW1(w1Packed[:]) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(sig.c[:]) - - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - - // Ensure ‖ w₀ - c·s2 ‖_∞ < γ₂ - β. - // - // By Lemma 3 of the specification this is equivalent to checking that - // both ‖ r₀ ‖_∞ < γ₂ - β and r₁ = w₁, for the decomposition - // w - c·s₂ = r₁ α + r₀ as computed by decompose(). - // See also §4.1 of the specification. - for i := 0; i < K; i++ { - w0mcs2[i].MulHat(&ch, &sk.s2h[i]) - w0mcs2[i].InvNTT() - } - w0mcs2.Sub(&w0, &w0mcs2) - w0mcs2.Normalize() - - if w0mcs2.Exceeds(Gamma2 - Beta) { - continue - } - - // z = y + c·s₁ - for i := 0; i < L; i++ { - sig.z[i].MulHat(&ch, &sk.s1h[i]) - sig.z[i].InvNTT() - } - sig.z.Add(&sig.z, &y) - sig.z.Normalize() - - // Ensure ‖z‖_∞ < γ₁ - β - if sig.z.Exceeds(Gamma1 - Beta) { - continue - } - - // Compute c·t₀ - for i := 0; i < K; i++ { - ct0[i].MulHat(&ch, &sk.t0h[i]) - ct0[i].InvNTT() - } - ct0.NormalizeAssumingLe2Q() - - // Ensure ‖c·t₀‖_∞ < γ₂. - if ct0.Exceeds(Gamma2) { - continue - } - - // Create the hint to be able to reconstruct w₁ from w - c·s₂ + c·t0. - // Note that we're not using makeHint() in the obvious way as we - // do not know whether ‖ sc·s₂ - c·t₀ ‖_∞ < γ₂. Instead we note - // that our makeHint() is actually the same as a makeHint for a - // different decomposition: - // - // Earlier we ensured indirectly with a check that r₁ = w₁ where - // r = w - c·s₂. Hence r₀ = r - r₁ α = w - c·s₂ - w₁ α = w₀ - c·s₂. - // Thus MakeHint(w₀ - c·s₂ + c·t₀, w₁) = MakeHint(r0 + c·t₀, r₁) - // and UseHint(w - c·s₂ + c·t₀, w₁) = UseHint(r + c·t₀, r₁). - // As we just ensured that ‖ c·t₀ ‖_∞ < γ₂ our usage is correct. - w0mcs2pct0.Add(&w0mcs2, &ct0) - w0mcs2pct0.NormalizeAssumingLe2Q() - hintPop := sig.hint.MakeHint(&w0mcs2pct0, &w1) - if hintPop > Omega { - continue - } - - break - } - - sig.Pack(signature[:]) -} - -// Computes the public key corresponding to this private key. -func (sk *PrivateKey) Public() *PublicKey { - var t0 VecK - pk := &PublicKey{ - rho: sk.rho, - A: &sk.A, - tr: &sk.tr, - } - sk.computeT0andT1(&t0, &pk.t1) - pk.t1.PackT1(pk.t1p[:]) - return pk -} - -// Equal returns whether the two public keys are equal -func (pk *PublicKey) Equal(other *PublicKey) bool { - return pk.rho == other.rho && pk.t1 == other.t1 -} - -// Equal returns whether the two private keys are equal -func (sk *PrivateKey) Equal(other *PrivateKey) bool { - ret := (subtle.ConstantTimeCompare(sk.rho[:], other.rho[:]) & - subtle.ConstantTimeCompare(sk.key[:], other.key[:]) & - subtle.ConstantTimeCompare(sk.tr[:], other.tr[:])) - - acc := uint32(0) - for i := 0; i < L; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s1[i][j] ^ other.s1[i][j] - } - } - for i := 0; i < K; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s2[i][j] ^ other.s2[i][j] - acc |= sk.t0[i][j] ^ other.t0[i][j] - } - } - return (ret & subtle.ConstantTimeEq(int32(acc), 0)) == 1 -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/mat.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/mat.go deleted file mode 100644 index ceaf634..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/mat.go +++ /dev/null @@ -1,59 +0,0 @@ -// Code generated from mode3/internal/mat.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A k by l matrix of polynomials. -type Mat [K]VecL - -// Expands the given seed to a complete matrix. -// -// This function is called ExpandA in the specification. -func (m *Mat) Derive(seed *[32]byte) { - if !DeriveX4Available { - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - PolyDeriveUniform(&m[i][j], seed, (i<<8)+j) - } - } - return - } - - idx := 0 - var nonces [4]uint16 - var ps [4]*common.Poly - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - nonces[idx] = (i << 8) + j - ps[idx] = &m[i][j] - idx++ - if idx == 4 { - idx = 0 - PolyDeriveUniformX4(ps, seed, nonces) - } - } - } - if idx != 0 { - for i := idx; i < 4; i++ { - ps[i] = nil - } - PolyDeriveUniformX4(ps, seed, nonces) - } -} - -// Set p to the inner product of a and b using pointwise multiplication. -// -// Assumes a and b are in Montgomery form and their coefficients are -// pairwise sufficiently small to multiply, see Poly.MulHat(). Resulting -// coefficients are bounded by 2Lq. -func PolyDotHat(p *common.Poly, a, b *VecL) { - var t common.Poly - *p = common.Poly{} // zero p - for i := 0; i < L; i++ { - t.MulHat(&a[i], &b[i]) - p.Add(&t, p) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/pack.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/pack.go deleted file mode 100644 index 1854b41..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/pack.go +++ /dev/null @@ -1,270 +0,0 @@ -// Code generated from mode3/internal/pack.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Writes p with norm less than or equal η into buf, which must be of -// size PolyLeqEtaSize. -// -// Assumes coefficients of p are not normalized, but in [q-η,q+η]. -func PolyPackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - buf[i] = (byte(common.Q+Eta-p[j]) | - byte(common.Q+Eta-p[j+1])<<4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - buf[i] = (byte(common.Q+Eta-p[j]) | - (byte(common.Q+Eta-p[j+1]) << 3) | - (byte(common.Q+Eta-p[j+2]) << 6)) - buf[i+1] = ((byte(common.Q+Eta-p[j+2]) >> 2) | - (byte(common.Q+Eta-p[j+3]) << 1) | - (byte(common.Q+Eta-p[j+4]) << 4) | - (byte(common.Q+Eta-p[j+5]) << 7)) - buf[i+2] = ((byte(common.Q+Eta-p[j+5]) >> 1) | - (byte(common.Q+Eta-p[j+6]) << 2) | - (byte(common.Q+Eta-p[j+7]) << 5)) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Sets p to the polynomial of norm less than or equal η encoded in the -// given buffer of size PolyLeqEtaSize. -// -// Output coefficients of p are not normalized, but in [q-η,q+η] provided -// buf was created using PackLeqEta. -// -// Beware, for arbitrary buf the coefficients of p might end up in -// the interval [q-2^b,q+2^b] where b is the least b with η≤2^b. -func PolyUnpackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - p[j] = common.Q + Eta - uint32(buf[i]&15) - p[j+1] = common.Q + Eta - uint32(buf[i]>>4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - p[j] = common.Q + Eta - uint32(buf[i]&7) - p[j+1] = common.Q + Eta - uint32((buf[i]>>3)&7) - p[j+2] = common.Q + Eta - uint32((buf[i]>>6)|((buf[i+1]<<2)&7)) - p[j+3] = common.Q + Eta - uint32((buf[i+1]>>1)&7) - p[j+4] = common.Q + Eta - uint32((buf[i+1]>>4)&7) - p[j+5] = common.Q + Eta - uint32((buf[i+1]>>7)|((buf[i+2]<<1)&7)) - p[j+6] = common.Q + Eta - uint32((buf[i+2]>>2)&7) - p[j+7] = common.Q + Eta - uint32((buf[i+2]>>5)&7) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Writes v with coefficients in {0, 1} of which at most ω non-zero -// to buf, which must have length ω+k. -func (v *VecK) PackHint(buf []byte) { - // The packed hint starts with the indices of the non-zero coefficients - // For instance: - // - // (x⁵⁶ + x¹⁰⁰, x²⁵⁵, 0, x² + x²³, x¹) - // - // Yields - // - // 56, 100, 255, 2, 23, 1 - // - // Then we pad with zeroes until we have a list of ω items: - // // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0 - // - // Then we finish with a list of the switch-over-indices in this - // list between polynomials, so: - // - // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0, 2, 3, 3, 5, 6 - - off := uint8(0) - for i := 0; i < K; i++ { - for j := uint16(0); j < common.N; j++ { - if v[i][j] != 0 { - buf[off] = uint8(j) - off++ - } - } - buf[Omega+i] = off - } - for ; off < Omega; off++ { - buf[off] = 0 - } -} - -// Sets v to the vector encoded using VecK.PackHint() -// -// Returns whether unpacking was successful. -func (v *VecK) UnpackHint(buf []byte) bool { - // A priori, there would be several reasonable ways to encode the same - // hint vector. We take care to only allow only one encoding, to ensure - // "strong unforgeability". - // - // See PackHint() source for description of the encoding. - *v = VecK{} // zero v - prevSOP := uint8(0) // previous switch-over-point - for i := 0; i < K; i++ { - SOP := buf[Omega+i] - if SOP < prevSOP || SOP > Omega { - return false // ensures switch-over-points are increasing - } - for j := prevSOP; j < SOP; j++ { - if j > prevSOP && buf[j] <= buf[j-1] { - return false // ensures indices are increasing (within a poly) - } - v[i][buf[j]] = 1 - } - prevSOP = SOP - } - for j := prevSOP; j < Omega; j++ { - if buf[j] != 0 { - return false // ensures padding indices are zero - } - } - - return true -} - -// Sets p to the polynomial packed into buf by PolyPackLeGamma1. -// -// p will be normalized. -func PolyUnpackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0x3) << 16) - p1 := uint32(buf[i+2]>>2) | (uint32(buf[i+3]) << 6) | - (uint32(buf[i+4]&0xf) << 14) - p2 := uint32(buf[i+4]>>4) | (uint32(buf[i+5]) << 4) | - (uint32(buf[i+6]&0x3f) << 12) - p3 := uint32(buf[i+6]>>6) | (uint32(buf[i+7]) << 2) | - (uint32(buf[i+8]) << 10) - - // coefficients in [0,…,2γ₁) - p0 = Gamma1 - p0 // (-γ₁,…,γ₁] - p1 = Gamma1 - p1 - p2 = Gamma1 - p2 - p3 = Gamma1 - p3 - - p0 += uint32(int32(p0)>>31) & common.Q // normalize - p1 += uint32(int32(p1)>>31) & common.Q - p2 += uint32(int32(p2)>>31) & common.Q - p3 += uint32(int32(p3)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - p[j+2] = p2 - p[j+3] = p3 - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0xf) << 16) - p1 := uint32(buf[i+2]>>4) | (uint32(buf[i+3]) << 4) | - (uint32(buf[i+4]) << 12) - - p0 = Gamma1 - p0 - p1 = Gamma1 - p1 - - p0 += uint32(int32(p0)>>31) & common.Q - p1 += uint32(int32(p1)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Writes p whose coefficients are in (-γ₁,γ₁] into buf -// which has to be of length PolyLeGamma1Size. -// -// Assumes p is normalized. -func PolyPackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - // coefficients in [0,…,γ₁] ∪ (q-γ₁,…,q) - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := Gamma1 - p[j] // [0,…,γ₁] ∪ (γ₁-q,…,2γ₁-q) - p0 += uint32(int32(p0)>>31) & common.Q // [0,…,2γ₁) - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - p2 := Gamma1 - p[j+2] - p2 += uint32(int32(p2)>>31) & common.Q - p3 := Gamma1 - p[j+3] - p3 += uint32(int32(p3)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<2) - buf[i+3] = byte(p1 >> 6) - buf[i+4] = byte(p1>>14) | byte(p2<<4) - buf[i+5] = byte(p2 >> 4) - buf[i+6] = byte(p2>>12) | byte(p3<<6) - buf[i+7] = byte(p3 >> 2) - buf[i+8] = byte(p3 >> 10) - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - // Coefficients are in [0, γ₁] ∪ (Q-γ₁, Q) - p0 := Gamma1 - p[j] - p0 += uint32(int32(p0)>>31) & common.Q - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<4) - buf[i+3] = byte(p1 >> 4) - buf[i+4] = byte(p1 >> 12) - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Pack w₁ into buf, which must be of length PolyW1Size. -// -// Assumes w₁ is normalized. -func PolyPackW1(p *common.Poly, buf []byte) { - if Gamma1Bits == 19 { - p.PackLe16(buf) - } else if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyW1Size; i += 3 { - buf[i] = byte(p[j]) | byte(p[j+1]<<6) - buf[i+1] = byte(p[j+1]>>2) | byte(p[j+2]<<4) - buf[i+2] = byte(p[j+2]>>4) | byte(p[j+3]<<2) - j += 4 - } - } else { - panic("unsupported γ₁") - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/params.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/params.go deleted file mode 100644 index c3341f6..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/params.go +++ /dev/null @@ -1,18 +0,0 @@ -// Code generated from params.templ.go. DO NOT EDIT. - -package internal - -const ( - Name = "Dilithium2" - K = 4 - L = 4 - Eta = 2 - DoubleEtaBits = 3 - Omega = 80 - Tau = 39 - Gamma1Bits = 17 - Gamma2 = 95232 - NIST = false - TRSize = 32 - CTildeSize = 32 -) diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/rounding.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/rounding.go deleted file mode 100644 index 58123c0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/rounding.go +++ /dev/null @@ -1,142 +0,0 @@ -// Code generated from mode3/internal/rounding.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, -// except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken -// and -α/2 ≤ a₀ < 0. Returns a₀ + q. Note 0 ≤ a₁ < (q-1)/α. -// Recall α = 2γ₂. -func decompose(a uint32) (a0plusQ, a1 uint32) { - // a₁ = ⌈a / 128⌉ - a1 = (a + 127) >> 7 - - if Alpha == 523776 { - // 1025/2²² is close enough to 1/4092 so that a₁ - // becomes a/α rounded down. - a1 = ((a1*1025 + (1 << 21)) >> 22) - - // For the corner-case a₁ = (q-1)/α = 16, we have to set a₁=0. - a1 &= 15 - } else if Alpha == 190464 { - // 1488/2²⁴ is close enough to 1/1488 so that a₁ - // becomes a/α rounded down. - a1 = ((a1 * 11275) + (1 << 23)) >> 24 - - // For the corner-case a₁ = (q-1)/α = 44, we have to set a₁=0. - a1 ^= uint32(int32(43-a1)>>31) & a1 - } else { - panic("unsupported α") - } - - a0plusQ = a - a1*Alpha - - // In the corner-case, when we set a₁=0, we will incorrectly - // have a₀ > (q-1)/2 and we'll need to subtract q. As we - // return a₀ + q, that comes down to adding q if a₀ < (q-1)/2. - a0plusQ += uint32(int32(a0plusQ-(common.Q-1)/2)>>31) & common.Q - - return -} - -// Assume 0 ≤ r, f < Q with ‖f‖_∞ ≤ α/2. Decompose r as r = r1*α + r0 as -// computed by decompose(). Write r' := r - f (mod Q). Now, decompose -// r'=r-f again as r' = r'1*α + r'0 using decompose(). As f is small, we -// have r'1 = r1 + h, where h ∈ {-1, 0, 1}. makeHint() computes |h| -// given z0 := r0 - f (mod Q) and r1. With |h|, which is called the hint, -// we can reconstruct r1 using only r' = r - f, which is done by useHint(). -// To wit: -// -// useHint( r - f, makeHint( r0 - f, r1 ) ) = r1. -// -// Assumes 0 ≤ z0 < Q. -func makeHint(z0, r1 uint32) uint32 { - // If -α/2 < r0 - f ≤ α/2, then r1*α + r0 - f is a valid decomposition of r' - // with the restrictions of decompose() and so r'1 = r1. So the hint - // should be 0. This is covered by the first two inequalities. - // There is one other case: if r0 - f = -α/2, then r1*α + r0 - f is also - // a valid decomposition if r1 = 0. In the other cases a one is carried - // and the hint should be 1. - if z0 <= Gamma2 || z0 > common.Q-Gamma2 || (z0 == common.Q-Gamma2 && r1 == 0) { - return 0 - } - return 1 -} - -// Uses the hint created by makeHint() to reconstruct r1 from r'=r-f; see -// documentation of makeHint() for context. -// Assumes 0 ≤ r' < Q. -func useHint(rp uint32, hint uint32) uint32 { - rp0plusQ, rp1 := decompose(rp) - if hint == 0 { - return rp1 - } - if rp0plusQ > common.Q { - return (rp1 + 1) & 15 - } - return (rp1 - 1) & 15 -} - -// Sets p to the hint polynomial for p0 the modified low bits and p1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint polynomial. -func PolyMakeHint(p, p0, p1 *common.Poly) (pop uint32) { - for i := 0; i < common.N; i++ { - h := makeHint(p0[i], p1[i]) - pop += h - p[i] = h - } - return -} - -// Computes corrections to the high bits of the polynomial q according -// to the hints in h and sets p to the corrected high bits. Returns p. -func PolyUseHint(p, q, hint *common.Poly) { - var q0PlusQ common.Poly - - // See useHint() and makeHint() for an explanation. We reimplement it - // here so that we can call Poly.Decompose(), which might be way faster - // than calling decompose() in a loop (for instance when having AVX2.) - - PolyDecompose(q, &q0PlusQ, p) - - for i := 0; i < common.N; i++ { - if hint[i] == 0 { - continue - } - if Gamma2 == 261888 { - if q0PlusQ[i] > common.Q { - p[i] = (p[i] + 1) & 15 - } else { - p[i] = (p[i] - 1) & 15 - } - } else if Gamma2 == 95232 { - if q0PlusQ[i] > common.Q { - if p[i] == 43 { - p[i] = 0 - } else { - p[i]++ - } - } else { - if p[i] == 0 { - p[i] = 43 - } else { - p[i]-- - } - } - } else { - panic("unsupported γ₂") - } - } -} - -// Splits each of the coefficients of p using decompose. -func PolyDecompose(p, p0PlusQ, p1 *common.Poly) { - for i := 0; i < common.N; i++ { - p0PlusQ[i], p1[i] = decompose(p[i]) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/sample.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/sample.go deleted file mode 100644 index b37370a..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/sample.go +++ /dev/null @@ -1,339 +0,0 @@ -// Code generated from mode3/internal/sample.go by gen.go - -package internal - -import ( - "encoding/binary" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" - "github.com/cloudflare/circl/simd/keccakf1600" -) - -// DeriveX4Available indicates whether the system supports the quick fourway -// sampling variants like PolyDeriveUniformX4. -var DeriveX4Available = keccakf1600.IsEnabledX4() - -// For each i, sample ps[i] uniformly from the given seed and nonces[i]. -// ps[i] may be nil and is ignored in that case. -// -// Can only be called when DeriveX4Available is true. -func PolyDeriveUniformX4(ps [4]*common.Poly, seed *[32]byte, nonces [4]uint16) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < 4; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // Absorb the nonces, the SHAKE128 domain separator (0b1111), the - // start of the padding (0b...001) and the end of the padding 0b100... - // Recall that the rate of SHAKE128 is 168 --- i.e. 21 uint64s. - for j := 0; j < 4; j++ { - state[4*4+j] = uint64(nonces[j]) | (0x1f << 16) - state[20*4+j] = 0x80 << 56 - } - - var idx [4]int // indices into ps - for j := 0; j < 4; j++ { - if ps[j] == nil { - idx[j] = common.N // mark nil polynomial as completed - } - } - - done := false - for !done { - // Applies KeccaK-f[1600] to state to get the next 21 uint64s of each - // of the four SHAKE128 streams. - perm.Permute() - - done = true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - for i := 0; i < 7; i++ { - var t [8]uint32 - t[0] = uint32(state[i*3*4+j] & 0x7fffff) - t[1] = uint32((state[i*3*4+j] >> 24) & 0x7fffff) - t[2] = uint32((state[i*3*4+j] >> 48) | - ((state[(i*3+1)*4+j] & 0x7f) << 16)) - t[3] = uint32((state[(i*3+1)*4+j] >> 8) & 0x7fffff) - t[4] = uint32((state[(i*3+1)*4+j] >> 32) & 0x7fffff) - t[5] = uint32((state[(i*3+1)*4+j] >> 56) | - ((state[(i*3+2)*4+j] & 0x7fff) << 8)) - t[6] = uint32((state[(i*3+2)*4+j] >> 16) & 0x7fffff) - t[7] = uint32((state[(i*3+2)*4+j] >> 40) & 0x7fffff) - - for k := 0; k < 8; k++ { - if t[k] < common.Q { - ps[j][idx[j]] = t[k] - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - } - done = false - } - } -} - -// Sample p uniformly from the given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniform(p *common.Poly, seed *[32]byte, nonce uint16) { - var i, length int - var buf [12 * 16]byte // fits 168B SHAKE-128 rate - - length = 168 - - sample := func() { - // Note that 3 divides into 168 and 12*16, so we use up buf completely. - for j := 0; j < length && i < common.N; j += 3 { - t := (uint32(buf[j]) | (uint32(buf[j+1]) << 8) | - (uint32(buf[j+2]) << 16)) & 0x7fffff - - // We use rejection sampling - if t < common.Q { - p[i] = t - i++ - } - } - } - - var iv [32 + 2]byte // 32 byte seed + uint16 nonce - h := sha3.NewShake128() - copy(iv[:32], seed[:]) - iv[32] = uint8(nonce) - iv[33] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:168]) - sample() - } -} - -// Sample p uniformly with coefficients of norm less than or equal η, -// using the given seed and nonce. -// -// p will not be normalized, but will have coefficients in [q-η,q+η]. -func PolyDeriveUniformLeqEta(p *common.Poly, seed *[64]byte, nonce uint16) { - // Assumes 2 < η < 8. - var i, length int - var buf [9 * 16]byte // fits 136B SHAKE-256 rate - - length = 136 - - sample := func() { - // We use rejection sampling - for j := 0; j < length && i < common.N; j++ { - t1 := uint32(buf[j]) & 15 - t2 := uint32(buf[j]) >> 4 - if Eta == 2 { // branch is eliminated by compiler - if t1 <= 14 { - t1 -= ((205 * t1) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 14 && i < common.N { - t2 -= ((205 * t2) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t2 - i++ - } - } else if Eta == 4 { - if t1 <= 2*Eta { - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 2*Eta && i < common.N { - p[i] = common.Q + Eta - t2 - i++ - } - } else { - panic("unsupported η") - } - } - } - - var iv [64 + 2]byte // 64 byte seed + uint16 nonce - - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - - // 136 is SHAKE-256 rate - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:136]) - sample() - } -} - -// Sample v[i] uniformly with coefficients in (-γ₁,…,γ₁] using the -// given seed and nonce+i -// -// p will be normalized. -func VecLDeriveUniformLeGamma1(v *VecL, seed *[64]byte, nonce uint16) { - for i := 0; i < L; i++ { - PolyDeriveUniformLeGamma1(&v[i], seed, nonce+uint16(i)) - } -} - -// Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the -// given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniformLeGamma1(p *common.Poly, seed *[64]byte, nonce uint16) { - var buf [PolyLeGamma1Size]byte - - var iv [66]byte - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - _, _ = h.Read(buf[:]) - - PolyUnpackLeGamma1(p, buf[:]) -} - -// For each i, sample ps[i] uniformly with τ non-zero coefficients in {q-1,1} -// using the given seed and w1[i]. ps[i] may be nil and is ignored -// in that case. ps[i] will be normalized. -// -// Can only be called when DeriveX4Available is true. -// -// This function is currently not used (yet). -func PolyDeriveUniformBallX4(ps [4]*common.Poly, seed []byte) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < CTildeSize/8; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // SHAKE256 domain separator and padding - for j := 0; j < 4; j++ { - state[(CTildeSize/8)*4+j] ^= 0x1f - state[16*4+j] ^= 0x80 << 56 - } - perm.Permute() - - var signs [4]uint64 - var idx [4]uint16 // indices into ps - - for j := 0; j < 4; j++ { - if ps[j] != nil { - signs[j] = state[j] - *ps[j] = common.Poly{} // zero ps[j] - idx[j] = common.N - Tau - } else { - idx[j] = common.N // mark as completed - } - } - - stateOffset := 1 - for { - done := true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - - for i := stateOffset; i < 17; i++ { - var bs [8]byte - binary.LittleEndian.PutUint64(bs[:], state[4*i+j]) - for k := 0; k < 8; k++ { - b := uint16(bs[k]) - - if b > idx[j] { - continue - } - - ps[j][idx[j]] = ps[j][b] - ps[j][b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - ps[j][b] ^= uint32((-(signs[j] & 1)) & (1 | (common.Q - 1))) - signs[j] >>= 1 - - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - - done = false - } - - if done { - break - } - - perm.Permute() - stateOffset = 0 - } -} - -// Samples p uniformly with τ non-zero coefficients in {q-1,1}. -// -// The polynomial p will be normalized. -func PolyDeriveUniformBall(p *common.Poly, seed []byte) { - var buf [136]byte // SHAKE-256 rate is 136 - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - _, _ = h.Read(buf[:]) - - // Essentially we generate a sequence of τ ones or minus ones, - // prepend 196 zeroes and shuffle the concatenation using the - // usual algorithm (Fisher--Yates.) - signs := binary.LittleEndian.Uint64(buf[:]) - bufOff := 8 // offset into buf - - *p = common.Poly{} // zero p - for i := uint16(common.N - Tau); i < common.N; i++ { - var b uint16 - - // Find location of where to move the new coefficient to using - // rejection sampling. - for { - if bufOff >= 136 { - _, _ = h.Read(buf[:]) - bufOff = 0 - } - - b = uint16(buf[bufOff]) - bufOff++ - - if b <= i { - break - } - } - - p[i] = p[b] - p[b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - p[b] ^= uint32((-(signs & 1)) & (1 | (common.Q - 1))) - signs >>= 1 - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/vec.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/vec.go deleted file mode 100644 index d07d3b2..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode2/internal/vec.go +++ /dev/null @@ -1,281 +0,0 @@ -// Code generated from mode3/internal/vec.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A vector of L polynomials. -type VecL [L]common.Poly - -// A vector of K polynomials. -type VecK [K]common.Poly - -// Normalize the polynomials in this vector. -func (v *VecL) Normalize() { - for i := 0; i < L; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecL) NormalizeAssumingLe2Q() { - for i := 0; i < L; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecL) Add(w, u *VecL) { - for i := 0; i < L; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecL) NTT() { - for i := 0; i < L; i++ { - v[i].NTT() - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecL) Exceeds(bound uint32) bool { - for i := 0; i < L; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Power2Round(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Decompose(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecL) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeqEta(). -func (v *VecL) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sequentially packs each polynomial using PolyPackLeGamma1(). -func (v *VecL) PackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeGamma1(). -func (v *VecL) UnpackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Normalize the polynomials in this vector. -func (v *VecK) Normalize() { - for i := 0; i < K; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecK) NormalizeAssumingLe2Q() { - for i := 0; i < K; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecK) Add(w, u *VecK) { - for i := 0; i < K; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecK) Exceeds(bound uint32) bool { - for i := 0; i < K; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Power2Round(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Decompose(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sets v to the hint vector for v0 the modified low bits and v1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint vector. -func (v *VecK) MakeHint(v0, v1 *VecK) (pop uint32) { - for i := 0; i < K; i++ { - pop += PolyMakeHint(&v[i], &v0[i], &v1[i]) - } - return -} - -// Computes corrections to the high bits of the polynomials in the vector -// w using the hints in h and sets v to the corrected high bits. Returns v. -// See useHint(). -func (v *VecK) UseHint(q, hint *VecK) *VecK { - for i := 0; i < K; i++ { - PolyUseHint(&v[i], &q[i], &hint[i]) - } - return v -} - -// Sequentially packs each polynomial using Poly.PackT1(). -func (v *VecK) PackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sets v to the vector packed into buf by PackT1(). -func (v *VecK) UnpackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sequentially packs each polynomial using Poly.PackT0(). -func (v *VecK) PackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sets v to the vector packed into buf by PackT0(). -func (v *VecK) UnpackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecK) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecK.PackLeqEta(). -func (v *VecK) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecK) NTT() { - for i := 0; i < K; i++ { - v[i].NTT() - } -} - -// Sequentially packs each polynomial using PolyPackW1(). -func (v *VecK) PackW1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackW1(&v[i], buf[offset:]) - offset += PolyW1Size - } -} - -// Sets v to a - b. -// -// Warning: assumes coefficients of the polynomials of b are less than 2q. -func (v *VecK) Sub(a, b *VecK) { - for i := 0; i < K; i++ { - v[i].Sub(&a[i], &b[i]) - } -} - -// Sets v to 2ᵈ w without reducing. -func (v *VecK) MulBy2toD(w *VecK) { - for i := 0; i < K; i++ { - v[i].MulBy2toD(&w[i]) - } -} - -// Applies InvNTT componentwise. See Poly.InvNTT() for details. -func (v *VecK) InvNTT() { - for i := 0; i < K; i++ { - v[i].InvNTT() - } -} - -// Applies Poly.ReduceLe2Q() componentwise. -func (v *VecK) ReduceLe2Q() { - for i := 0; i < K; i++ { - v[i].ReduceLe2Q() - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/dilithium.go deleted file mode 100644 index 5a33561..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/dilithium.go +++ /dev/null @@ -1,295 +0,0 @@ -// Code generated from pkg.templ.go. DO NOT EDIT. - -// mode3 implements the CRYSTALS-Dilithium signature scheme Dilithium3 -// as submitted to round3 of the NIST PQC competition and described in -// -// https://pq-crystals.org/dilithium/data/dilithium-specification-round3-20210208.pdf -package mode3 - -import ( - "crypto" - "errors" - "io" - - "github.com/cloudflare/circl/sign" - "github.com/cloudflare/circl/sign/dilithium/mode3/internal" - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -const ( - // Size of seed for NewKeyFromSeed - SeedSize = common.SeedSize - - // Size of a packed PublicKey - PublicKeySize = internal.PublicKeySize - - // Size of a packed PrivateKey - PrivateKeySize = internal.PrivateKeySize - - // Size of a signature - SignatureSize = internal.SignatureSize -) - -// PublicKey is the type of Dilithium3 public key -type PublicKey internal.PublicKey - -// PrivateKey is the type of Dilithium3 private key -type PrivateKey internal.PrivateKey - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - pk, sk, err := internal.GenerateKey(rand) - return (*PublicKey)(pk), (*PrivateKey)(sk), err -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[SeedSize]byte) (*PublicKey, *PrivateKey) { - pk, sk := internal.NewKeyFromSeed(seed) - return (*PublicKey)(pk), (*PrivateKey)(sk) -} - -// SignTo signs the given message and writes the signature into signature. -// It will panic if signature is not of length at least SignatureSize. -func SignTo(sk *PrivateKey, msg, sig []byte) { - var rnd [32]byte - - internal.SignTo( - (*internal.PrivateKey)(sk), - func(w io.Writer) { - w.Write(msg) - }, - rnd, - sig, - ) -} - -// Verify checks whether the given signature by pk on msg is valid. -func Verify(pk *PublicKey, msg, sig []byte) bool { - return internal.Verify( - (*internal.PublicKey)(pk), - func(w io.Writer) { - _, _ = w.Write(msg) - }, - sig, - ) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Unpack(buf) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Unpack(buf) -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Pack(buf) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Pack(buf) -} - -// Packs the public key. -func (pk *PublicKey) Bytes() []byte { - var buf [PublicKeySize]byte - pk.Pack(&buf) - return buf[:] -} - -// Packs the private key. -func (sk *PrivateKey) Bytes() []byte { - var buf [PrivateKeySize]byte - sk.Pack(&buf) - return buf[:] -} - -// Packs the public key. -func (pk *PublicKey) MarshalBinary() ([]byte, error) { - return pk.Bytes(), nil -} - -// Packs the private key. -func (sk *PrivateKey) MarshalBinary() ([]byte, error) { - return sk.Bytes(), nil -} - -// Unpacks the public key from data. -func (pk *PublicKey) UnmarshalBinary(data []byte) error { - if len(data) != PublicKeySize { - return errors.New("packed public key must be of mode3.PublicKeySize bytes") - } - var buf [PublicKeySize]byte - copy(buf[:], data) - pk.Unpack(&buf) - return nil -} - -// Unpacks the private key from data. -func (sk *PrivateKey) UnmarshalBinary(data []byte) error { - if len(data) != PrivateKeySize { - return errors.New("packed private key must be of mode3.PrivateKeySize bytes") - } - var buf [PrivateKeySize]byte - copy(buf[:], data) - sk.Unpack(&buf) - return nil -} - -// Sign signs the given message. -// -// opts.HashFunc() must return zero, which can be achieved by passing -// crypto.Hash(0) for opts. rand is ignored. Will only return an error -// if opts.HashFunc() is non-zero. -// -// This function is used to make PrivateKey implement the crypto.Signer -// interface. The package-level SignTo function might be more convenient -// to use. -func (sk *PrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ( - sig []byte, err error) { - var ret [SignatureSize]byte - - if opts.HashFunc() != crypto.Hash(0) { - return nil, errors.New("dilithium: cannot sign hashed message") - } - SignTo(sk, msg, ret[:]) - - return ret[:], nil -} - -// Computes the public key corresponding to this private key. -// -// Returns a *PublicKey. The type crypto.PublicKey is used to make -// PrivateKey implement the crypto.Signer interface. -func (sk *PrivateKey) Public() crypto.PublicKey { - return (*PublicKey)((*internal.PrivateKey)(sk).Public()) -} - -// Equal returns whether the two private keys equal. -func (sk *PrivateKey) Equal(other crypto.PrivateKey) bool { - castOther, ok := other.(*PrivateKey) - if !ok { - return false - } - return (*internal.PrivateKey)(sk).Equal((*internal.PrivateKey)(castOther)) -} - -// Equal returns whether the two public keys equal. -func (pk *PublicKey) Equal(other crypto.PublicKey) bool { - castOther, ok := other.(*PublicKey) - if !ok { - return false - } - return (*internal.PublicKey)(pk).Equal((*internal.PublicKey)(castOther)) -} - -// Boilerplate for generic signatures API - -type scheme struct{} - -var sch sign.Scheme = &scheme{} - -// Scheme returns a generic signature interface for Dilithium3. -func Scheme() sign.Scheme { return sch } - -func (*scheme) Name() string { return "Dilithium3" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SignatureSize() int { return SignatureSize } -func (*scheme) SeedSize() int { return SeedSize } - -// TODO TLSIdentifier() - -func (*scheme) SupportsContext() bool { - return false -} - -func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) { - return GenerateKey(nil) -} - -func (*scheme) Sign( - sk sign.PrivateKey, - msg []byte, - opts *sign.SignatureOpts, -) []byte { - sig := make([]byte, SignatureSize) - - priv, ok := sk.(*PrivateKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - SignTo(priv, msg, sig) - - return sig -} - -func (*scheme) Verify( - pk sign.PublicKey, - msg, sig []byte, - opts *sign.SignatureOpts, -) bool { - pub, ok := pk.(*PublicKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - return Verify(pub, msg, sig) -} - -func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) { - if len(seed) != SeedSize { - panic(sign.ErrSeedSize) - } - var seed2 [SeedSize]byte - copy(seed2[:], seed) - return NewKeyFromSeed(&seed2) -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) { - if len(buf) != PublicKeySize { - return nil, sign.ErrPubKeySize - } - - var ( - buf2 [PublicKeySize]byte - ret PublicKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) { - if len(buf) != PrivateKeySize { - return nil, sign.ErrPrivKeySize - } - - var ( - buf2 [PrivateKeySize]byte - ret PrivateKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (sk *PrivateKey) Scheme() sign.Scheme { - return sch -} - -func (sk *PublicKey) Scheme() sign.Scheme { - return sch -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/dilithium.go deleted file mode 100644 index 0f9b76d..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/dilithium.go +++ /dev/null @@ -1,489 +0,0 @@ -package internal - -import ( - cryptoRand "crypto/rand" - "crypto/subtle" - "io" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -const ( - // Size of a packed polynomial of norm ≤η. - // (Note that the formula is not valid in general.) - PolyLeqEtaSize = (common.N * DoubleEtaBits) / 8 - - // β = τη, the maximum size of c s₂. - Beta = Tau * Eta - - // γ₁ range of y - Gamma1 = 1 << Gamma1Bits - - // Size of packed polynomial of norm <γ₁ such as z - PolyLeGamma1Size = (Gamma1Bits + 1) * common.N / 8 - - // α = 2γ₂ parameter for decompose - Alpha = 2 * Gamma2 - - // Size of a packed private key - PrivateKeySize = 32 + 32 + TRSize + PolyLeqEtaSize*(L+K) + common.PolyT0Size*K - - // Size of a packed public key - PublicKeySize = 32 + common.PolyT1Size*K - - // Size of a packed signature - SignatureSize = L*PolyLeGamma1Size + Omega + K + CTildeSize - - // Size of packed w₁ - PolyW1Size = (common.N * (common.QBits - Gamma1Bits)) / 8 -) - -// PublicKey is the type of Dilithium public keys. -type PublicKey struct { - rho [32]byte - t1 VecK - - // Cached values - t1p [common.PolyT1Size * K]byte - A *Mat - tr *[TRSize]byte -} - -// PrivateKey is the type of Dilithium private keys. -type PrivateKey struct { - rho [32]byte - key [32]byte - s1 VecL - s2 VecK - t0 VecK - tr [TRSize]byte - - // Cached values - A Mat // ExpandA(ρ) - s1h VecL // NTT(s₁) - s2h VecK // NTT(s₂) - t0h VecK // NTT(t₀) -} - -type unpackedSignature struct { - z VecL - hint VecK - c [CTildeSize]byte -} - -// Packs the signature into buf. -func (sig *unpackedSignature) Pack(buf []byte) { - copy(buf[:], sig.c[:]) - sig.z.PackLeGamma1(buf[CTildeSize:]) - sig.hint.PackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) -} - -// Sets sig to the signature encoded in the buffer. -// -// Returns whether buf contains a properly packed signature. -func (sig *unpackedSignature) Unpack(buf []byte) bool { - if len(buf) < SignatureSize { - return false - } - copy(sig.c[:], buf[:]) - sig.z.UnpackLeGamma1(buf[CTildeSize:]) - if sig.z.Exceeds(Gamma1 - Beta) { - return false - } - if !sig.hint.UnpackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) { - return false - } - return true -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - copy(buf[:32], pk.rho[:]) - copy(buf[32:], pk.t1p[:]) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - copy(pk.rho[:], buf[:32]) - copy(pk.t1p[:], buf[32:]) - - pk.t1.UnpackT1(pk.t1p[:]) - pk.A = new(Mat) - pk.A.Derive(&pk.rho) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - pk.tr = new([TRSize]byte) - h := sha3.NewShake256() - _, _ = h.Write(buf[:]) - _, _ = h.Read(pk.tr[:]) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - copy(buf[:32], sk.rho[:]) - copy(buf[32:64], sk.key[:]) - copy(buf[64:64+TRSize], sk.tr[:]) - offset := 64 + TRSize - sk.s1.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.PackT0(buf[offset:]) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - copy(sk.rho[:], buf[:32]) - copy(sk.key[:], buf[32:64]) - copy(sk.tr[:], buf[64:64+TRSize]) - offset := 64 + TRSize - sk.s1.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.UnpackT0(buf[offset:]) - - // Cached values - sk.A.Derive(&sk.rho) - sk.t0h = sk.t0 - sk.t0h.NTT() - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() -} - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - var seed [32]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - pk, sk := NewKeyFromSeed(&seed) - return pk, sk, nil -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[common.SeedSize]byte) (*PublicKey, *PrivateKey) { - var eSeed [128]byte // expanded seed - var pk PublicKey - var sk PrivateKey - var sSeed [64]byte - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - - if NIST { - _, _ = h.Write([]byte{byte(K), byte(L)}) - } - - _, _ = h.Read(eSeed[:]) - - copy(pk.rho[:], eSeed[:32]) - copy(sSeed[:], eSeed[32:96]) - copy(sk.key[:], eSeed[96:]) - copy(sk.rho[:], pk.rho[:]) - - sk.A.Derive(&pk.rho) - - for i := uint16(0); i < L; i++ { - PolyDeriveUniformLeqEta(&sk.s1[i], &sSeed, i) - } - - for i := uint16(0); i < K; i++ { - PolyDeriveUniformLeqEta(&sk.s2[i], &sSeed, i+L) - } - - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() - - sk.computeT0andT1(&sk.t0, &pk.t1) - - sk.t0h = sk.t0 - sk.t0h.NTT() - - // Complete public key far enough to be packed - pk.t1.PackT1(pk.t1p[:]) - pk.A = &sk.A - - // Finish private key - var packedPk [PublicKeySize]byte - pk.Pack(&packedPk) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - h.Reset() - _, _ = h.Write(packedPk[:]) - _, _ = h.Read(sk.tr[:]) - - // Finish cache of public key - pk.tr = &sk.tr - - return &pk, &sk -} - -// Computes t0 and t1 from sk.s1h, sk.s2 and sk.A. -func (sk *PrivateKey) computeT0andT1(t0, t1 *VecK) { - var t VecK - - // Set t to A s₁ + s₂ - for i := 0; i < K; i++ { - PolyDotHat(&t[i], &sk.A[i], &sk.s1h) - t[i].ReduceLe2Q() - t[i].InvNTT() - } - t.Add(&t, &sk.s2) - t.Normalize() - - // Compute t₀, t₁ = Power2Round(t) - t.Power2Round(t0, t1) -} - -// Verify checks whether the given signature by pk on msg is valid. -// -// For Dilithium this is the top-level verification function. -// In ML-DSA, this is ML-DSA.Verify_internal. -func Verify(pk *PublicKey, msg func(io.Writer), signature []byte) bool { - var sig unpackedSignature - var mu [64]byte - var zh VecL - var Az, Az2dct1, w1 VecK - var ch common.Poly - var cp [CTildeSize]byte - var w1Packed [PolyW1Size * K]byte - - // Note that Unpack() checked whether ‖z‖_∞ < γ₁ - β - // and ensured that there at most ω ones in pk.hint. - if !sig.Unpack(signature) { - return false - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(pk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // Compute Az - zh = sig.z - zh.NTT() - - for i := 0; i < K; i++ { - PolyDotHat(&Az[i], &pk.A[i], &zh) - } - - // Next, we compute Az - 2ᵈ·c·t₁. - // Note that the coefficients of t₁ are bounded by 256 = 2⁹, - // so the coefficients of Az2dct1 will bounded by 2⁹⁺ᵈ = 2²³ < 2q, - // which is small enough for NTT(). - Az2dct1.MulBy2toD(&pk.t1) - Az2dct1.NTT() - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - for i := 0; i < K; i++ { - Az2dct1[i].MulHat(&Az2dct1[i], &ch) - } - Az2dct1.Sub(&Az, &Az2dct1) - Az2dct1.ReduceLe2Q() - Az2dct1.InvNTT() - Az2dct1.NormalizeAssumingLe2Q() - - // UseHint(pk.hint, Az - 2ᵈ·c·t₁) - // = UseHint(pk.hint, w - c·s₂ + c·t₀) - // = UseHint(pk.hint, r + c·t₀) - // = r₁ = w₁. - w1.UseHint(&Az2dct1, &sig.hint) - w1.PackW1(w1Packed[:]) - - // c' = H(μ, w₁) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(cp[:]) - - return sig.c == cp -} - -// SignTo signs the given message and writes the signature into signature. -// -// For Dilithium this is the top-level signing function. For ML-DSA -// this is ML-DSA.Sign_internal. -// -//nolint:funlen -func SignTo(sk *PrivateKey, msg func(io.Writer), rnd [32]byte, signature []byte) { - var mu, rhop [64]byte - var w1Packed [PolyW1Size * K]byte - var y, yh VecL - var w, w0, w1, w0mcs2, ct0, w0mcs2pct0 VecK - var ch common.Poly - var yNonce uint16 - var sig unpackedSignature - - if len(signature) < SignatureSize { - panic("Signature does not fit in that byteslice") - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(sk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // ρ' = CRH(key ‖ μ) - h.Reset() - _, _ = h.Write(sk.key[:]) - if NIST { - _, _ = h.Write(rnd[:]) - } - _, _ = h.Write(mu[:]) - _, _ = h.Read(rhop[:]) - - // Main rejection loop - attempt := 0 - for { - attempt++ - if attempt >= 576 { - // Depending on the mode, one try has a chance between 1/7 and 1/4 - // of succeeding. Thus it is safe to say that 576 iterations - // are enough as (6/7)⁵⁷⁶ < 2⁻¹²⁸. - panic("This should only happen 1 in 2^{128}: something is wrong.") - } - - // y = ExpandMask(ρ', key) - VecLDeriveUniformLeGamma1(&y, &rhop, yNonce) - yNonce += uint16(L) - - // Set w to A y - yh = y - yh.NTT() - for i := 0; i < K; i++ { - PolyDotHat(&w[i], &sk.A[i], &yh) - w[i].ReduceLe2Q() - w[i].InvNTT() - } - - // Decompose w into w₀ and w₁ - w.NormalizeAssumingLe2Q() - w.Decompose(&w0, &w1) - - // c~ = H(μ ‖ w₁) - w1.PackW1(w1Packed[:]) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(sig.c[:]) - - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - - // Ensure ‖ w₀ - c·s2 ‖_∞ < γ₂ - β. - // - // By Lemma 3 of the specification this is equivalent to checking that - // both ‖ r₀ ‖_∞ < γ₂ - β and r₁ = w₁, for the decomposition - // w - c·s₂ = r₁ α + r₀ as computed by decompose(). - // See also §4.1 of the specification. - for i := 0; i < K; i++ { - w0mcs2[i].MulHat(&ch, &sk.s2h[i]) - w0mcs2[i].InvNTT() - } - w0mcs2.Sub(&w0, &w0mcs2) - w0mcs2.Normalize() - - if w0mcs2.Exceeds(Gamma2 - Beta) { - continue - } - - // z = y + c·s₁ - for i := 0; i < L; i++ { - sig.z[i].MulHat(&ch, &sk.s1h[i]) - sig.z[i].InvNTT() - } - sig.z.Add(&sig.z, &y) - sig.z.Normalize() - - // Ensure ‖z‖_∞ < γ₁ - β - if sig.z.Exceeds(Gamma1 - Beta) { - continue - } - - // Compute c·t₀ - for i := 0; i < K; i++ { - ct0[i].MulHat(&ch, &sk.t0h[i]) - ct0[i].InvNTT() - } - ct0.NormalizeAssumingLe2Q() - - // Ensure ‖c·t₀‖_∞ < γ₂. - if ct0.Exceeds(Gamma2) { - continue - } - - // Create the hint to be able to reconstruct w₁ from w - c·s₂ + c·t0. - // Note that we're not using makeHint() in the obvious way as we - // do not know whether ‖ sc·s₂ - c·t₀ ‖_∞ < γ₂. Instead we note - // that our makeHint() is actually the same as a makeHint for a - // different decomposition: - // - // Earlier we ensured indirectly with a check that r₁ = w₁ where - // r = w - c·s₂. Hence r₀ = r - r₁ α = w - c·s₂ - w₁ α = w₀ - c·s₂. - // Thus MakeHint(w₀ - c·s₂ + c·t₀, w₁) = MakeHint(r0 + c·t₀, r₁) - // and UseHint(w - c·s₂ + c·t₀, w₁) = UseHint(r + c·t₀, r₁). - // As we just ensured that ‖ c·t₀ ‖_∞ < γ₂ our usage is correct. - w0mcs2pct0.Add(&w0mcs2, &ct0) - w0mcs2pct0.NormalizeAssumingLe2Q() - hintPop := sig.hint.MakeHint(&w0mcs2pct0, &w1) - if hintPop > Omega { - continue - } - - break - } - - sig.Pack(signature[:]) -} - -// Computes the public key corresponding to this private key. -func (sk *PrivateKey) Public() *PublicKey { - var t0 VecK - pk := &PublicKey{ - rho: sk.rho, - A: &sk.A, - tr: &sk.tr, - } - sk.computeT0andT1(&t0, &pk.t1) - pk.t1.PackT1(pk.t1p[:]) - return pk -} - -// Equal returns whether the two public keys are equal -func (pk *PublicKey) Equal(other *PublicKey) bool { - return pk.rho == other.rho && pk.t1 == other.t1 -} - -// Equal returns whether the two private keys are equal -func (sk *PrivateKey) Equal(other *PrivateKey) bool { - ret := (subtle.ConstantTimeCompare(sk.rho[:], other.rho[:]) & - subtle.ConstantTimeCompare(sk.key[:], other.key[:]) & - subtle.ConstantTimeCompare(sk.tr[:], other.tr[:])) - - acc := uint32(0) - for i := 0; i < L; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s1[i][j] ^ other.s1[i][j] - } - } - for i := 0; i < K; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s2[i][j] ^ other.s2[i][j] - acc |= sk.t0[i][j] ^ other.t0[i][j] - } - } - return (ret & subtle.ConstantTimeEq(int32(acc), 0)) == 1 -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/mat.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/mat.go deleted file mode 100644 index 3d6cc47..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/mat.go +++ /dev/null @@ -1,57 +0,0 @@ -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A k by l matrix of polynomials. -type Mat [K]VecL - -// Expands the given seed to a complete matrix. -// -// This function is called ExpandA in the specification. -func (m *Mat) Derive(seed *[32]byte) { - if !DeriveX4Available { - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - PolyDeriveUniform(&m[i][j], seed, (i<<8)+j) - } - } - return - } - - idx := 0 - var nonces [4]uint16 - var ps [4]*common.Poly - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - nonces[idx] = (i << 8) + j - ps[idx] = &m[i][j] - idx++ - if idx == 4 { - idx = 0 - PolyDeriveUniformX4(ps, seed, nonces) - } - } - } - if idx != 0 { - for i := idx; i < 4; i++ { - ps[i] = nil - } - PolyDeriveUniformX4(ps, seed, nonces) - } -} - -// Set p to the inner product of a and b using pointwise multiplication. -// -// Assumes a and b are in Montgomery form and their coefficients are -// pairwise sufficiently small to multiply, see Poly.MulHat(). Resulting -// coefficients are bounded by 2Lq. -func PolyDotHat(p *common.Poly, a, b *VecL) { - var t common.Poly - *p = common.Poly{} // zero p - for i := 0; i < L; i++ { - t.MulHat(&a[i], &b[i]) - p.Add(&t, p) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/pack.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/pack.go deleted file mode 100644 index d9c80d0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/pack.go +++ /dev/null @@ -1,268 +0,0 @@ -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Writes p with norm less than or equal η into buf, which must be of -// size PolyLeqEtaSize. -// -// Assumes coefficients of p are not normalized, but in [q-η,q+η]. -func PolyPackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - buf[i] = (byte(common.Q+Eta-p[j]) | - byte(common.Q+Eta-p[j+1])<<4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - buf[i] = (byte(common.Q+Eta-p[j]) | - (byte(common.Q+Eta-p[j+1]) << 3) | - (byte(common.Q+Eta-p[j+2]) << 6)) - buf[i+1] = ((byte(common.Q+Eta-p[j+2]) >> 2) | - (byte(common.Q+Eta-p[j+3]) << 1) | - (byte(common.Q+Eta-p[j+4]) << 4) | - (byte(common.Q+Eta-p[j+5]) << 7)) - buf[i+2] = ((byte(common.Q+Eta-p[j+5]) >> 1) | - (byte(common.Q+Eta-p[j+6]) << 2) | - (byte(common.Q+Eta-p[j+7]) << 5)) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Sets p to the polynomial of norm less than or equal η encoded in the -// given buffer of size PolyLeqEtaSize. -// -// Output coefficients of p are not normalized, but in [q-η,q+η] provided -// buf was created using PackLeqEta. -// -// Beware, for arbitrary buf the coefficients of p might end up in -// the interval [q-2^b,q+2^b] where b is the least b with η≤2^b. -func PolyUnpackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - p[j] = common.Q + Eta - uint32(buf[i]&15) - p[j+1] = common.Q + Eta - uint32(buf[i]>>4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - p[j] = common.Q + Eta - uint32(buf[i]&7) - p[j+1] = common.Q + Eta - uint32((buf[i]>>3)&7) - p[j+2] = common.Q + Eta - uint32((buf[i]>>6)|((buf[i+1]<<2)&7)) - p[j+3] = common.Q + Eta - uint32((buf[i+1]>>1)&7) - p[j+4] = common.Q + Eta - uint32((buf[i+1]>>4)&7) - p[j+5] = common.Q + Eta - uint32((buf[i+1]>>7)|((buf[i+2]<<1)&7)) - p[j+6] = common.Q + Eta - uint32((buf[i+2]>>2)&7) - p[j+7] = common.Q + Eta - uint32((buf[i+2]>>5)&7) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Writes v with coefficients in {0, 1} of which at most ω non-zero -// to buf, which must have length ω+k. -func (v *VecK) PackHint(buf []byte) { - // The packed hint starts with the indices of the non-zero coefficients - // For instance: - // - // (x⁵⁶ + x¹⁰⁰, x²⁵⁵, 0, x² + x²³, x¹) - // - // Yields - // - // 56, 100, 255, 2, 23, 1 - // - // Then we pad with zeroes until we have a list of ω items: - // // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0 - // - // Then we finish with a list of the switch-over-indices in this - // list between polynomials, so: - // - // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0, 2, 3, 3, 5, 6 - - off := uint8(0) - for i := 0; i < K; i++ { - for j := uint16(0); j < common.N; j++ { - if v[i][j] != 0 { - buf[off] = uint8(j) - off++ - } - } - buf[Omega+i] = off - } - for ; off < Omega; off++ { - buf[off] = 0 - } -} - -// Sets v to the vector encoded using VecK.PackHint() -// -// Returns whether unpacking was successful. -func (v *VecK) UnpackHint(buf []byte) bool { - // A priori, there would be several reasonable ways to encode the same - // hint vector. We take care to only allow only one encoding, to ensure - // "strong unforgeability". - // - // See PackHint() source for description of the encoding. - *v = VecK{} // zero v - prevSOP := uint8(0) // previous switch-over-point - for i := 0; i < K; i++ { - SOP := buf[Omega+i] - if SOP < prevSOP || SOP > Omega { - return false // ensures switch-over-points are increasing - } - for j := prevSOP; j < SOP; j++ { - if j > prevSOP && buf[j] <= buf[j-1] { - return false // ensures indices are increasing (within a poly) - } - v[i][buf[j]] = 1 - } - prevSOP = SOP - } - for j := prevSOP; j < Omega; j++ { - if buf[j] != 0 { - return false // ensures padding indices are zero - } - } - - return true -} - -// Sets p to the polynomial packed into buf by PolyPackLeGamma1. -// -// p will be normalized. -func PolyUnpackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0x3) << 16) - p1 := uint32(buf[i+2]>>2) | (uint32(buf[i+3]) << 6) | - (uint32(buf[i+4]&0xf) << 14) - p2 := uint32(buf[i+4]>>4) | (uint32(buf[i+5]) << 4) | - (uint32(buf[i+6]&0x3f) << 12) - p3 := uint32(buf[i+6]>>6) | (uint32(buf[i+7]) << 2) | - (uint32(buf[i+8]) << 10) - - // coefficients in [0,…,2γ₁) - p0 = Gamma1 - p0 // (-γ₁,…,γ₁] - p1 = Gamma1 - p1 - p2 = Gamma1 - p2 - p3 = Gamma1 - p3 - - p0 += uint32(int32(p0)>>31) & common.Q // normalize - p1 += uint32(int32(p1)>>31) & common.Q - p2 += uint32(int32(p2)>>31) & common.Q - p3 += uint32(int32(p3)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - p[j+2] = p2 - p[j+3] = p3 - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0xf) << 16) - p1 := uint32(buf[i+2]>>4) | (uint32(buf[i+3]) << 4) | - (uint32(buf[i+4]) << 12) - - p0 = Gamma1 - p0 - p1 = Gamma1 - p1 - - p0 += uint32(int32(p0)>>31) & common.Q - p1 += uint32(int32(p1)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Writes p whose coefficients are in (-γ₁,γ₁] into buf -// which has to be of length PolyLeGamma1Size. -// -// Assumes p is normalized. -func PolyPackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - // coefficients in [0,…,γ₁] ∪ (q-γ₁,…,q) - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := Gamma1 - p[j] // [0,…,γ₁] ∪ (γ₁-q,…,2γ₁-q) - p0 += uint32(int32(p0)>>31) & common.Q // [0,…,2γ₁) - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - p2 := Gamma1 - p[j+2] - p2 += uint32(int32(p2)>>31) & common.Q - p3 := Gamma1 - p[j+3] - p3 += uint32(int32(p3)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<2) - buf[i+3] = byte(p1 >> 6) - buf[i+4] = byte(p1>>14) | byte(p2<<4) - buf[i+5] = byte(p2 >> 4) - buf[i+6] = byte(p2>>12) | byte(p3<<6) - buf[i+7] = byte(p3 >> 2) - buf[i+8] = byte(p3 >> 10) - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - // Coefficients are in [0, γ₁] ∪ (Q-γ₁, Q) - p0 := Gamma1 - p[j] - p0 += uint32(int32(p0)>>31) & common.Q - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<4) - buf[i+3] = byte(p1 >> 4) - buf[i+4] = byte(p1 >> 12) - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Pack w₁ into buf, which must be of length PolyW1Size. -// -// Assumes w₁ is normalized. -func PolyPackW1(p *common.Poly, buf []byte) { - if Gamma1Bits == 19 { - p.PackLe16(buf) - } else if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyW1Size; i += 3 { - buf[i] = byte(p[j]) | byte(p[j+1]<<6) - buf[i+1] = byte(p[j+1]>>2) | byte(p[j+2]<<4) - buf[i+2] = byte(p[j+2]>>4) | byte(p[j+3]<<2) - j += 4 - } - } else { - panic("unsupported γ₁") - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/params.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/params.go deleted file mode 100644 index 5aa596d..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/params.go +++ /dev/null @@ -1,18 +0,0 @@ -// Code generated from params.templ.go. DO NOT EDIT. - -package internal - -const ( - Name = "Dilithium3" - K = 6 - L = 5 - Eta = 4 - DoubleEtaBits = 4 - Omega = 55 - Tau = 49 - Gamma1Bits = 19 - Gamma2 = 261888 - NIST = false - TRSize = 32 - CTildeSize = 32 -) diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/rounding.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/rounding.go deleted file mode 100644 index 4005e56..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/rounding.go +++ /dev/null @@ -1,140 +0,0 @@ -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, -// except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken -// and -α/2 ≤ a₀ < 0. Returns a₀ + q. Note 0 ≤ a₁ < (q-1)/α. -// Recall α = 2γ₂. -func decompose(a uint32) (a0plusQ, a1 uint32) { - // a₁ = ⌈a / 128⌉ - a1 = (a + 127) >> 7 - - if Alpha == 523776 { - // 1025/2²² is close enough to 1/4092 so that a₁ - // becomes a/α rounded down. - a1 = ((a1*1025 + (1 << 21)) >> 22) - - // For the corner-case a₁ = (q-1)/α = 16, we have to set a₁=0. - a1 &= 15 - } else if Alpha == 190464 { - // 1488/2²⁴ is close enough to 1/1488 so that a₁ - // becomes a/α rounded down. - a1 = ((a1 * 11275) + (1 << 23)) >> 24 - - // For the corner-case a₁ = (q-1)/α = 44, we have to set a₁=0. - a1 ^= uint32(int32(43-a1)>>31) & a1 - } else { - panic("unsupported α") - } - - a0plusQ = a - a1*Alpha - - // In the corner-case, when we set a₁=0, we will incorrectly - // have a₀ > (q-1)/2 and we'll need to subtract q. As we - // return a₀ + q, that comes down to adding q if a₀ < (q-1)/2. - a0plusQ += uint32(int32(a0plusQ-(common.Q-1)/2)>>31) & common.Q - - return -} - -// Assume 0 ≤ r, f < Q with ‖f‖_∞ ≤ α/2. Decompose r as r = r1*α + r0 as -// computed by decompose(). Write r' := r - f (mod Q). Now, decompose -// r'=r-f again as r' = r'1*α + r'0 using decompose(). As f is small, we -// have r'1 = r1 + h, where h ∈ {-1, 0, 1}. makeHint() computes |h| -// given z0 := r0 - f (mod Q) and r1. With |h|, which is called the hint, -// we can reconstruct r1 using only r' = r - f, which is done by useHint(). -// To wit: -// -// useHint( r - f, makeHint( r0 - f, r1 ) ) = r1. -// -// Assumes 0 ≤ z0 < Q. -func makeHint(z0, r1 uint32) uint32 { - // If -α/2 < r0 - f ≤ α/2, then r1*α + r0 - f is a valid decomposition of r' - // with the restrictions of decompose() and so r'1 = r1. So the hint - // should be 0. This is covered by the first two inequalities. - // There is one other case: if r0 - f = -α/2, then r1*α + r0 - f is also - // a valid decomposition if r1 = 0. In the other cases a one is carried - // and the hint should be 1. - if z0 <= Gamma2 || z0 > common.Q-Gamma2 || (z0 == common.Q-Gamma2 && r1 == 0) { - return 0 - } - return 1 -} - -// Uses the hint created by makeHint() to reconstruct r1 from r'=r-f; see -// documentation of makeHint() for context. -// Assumes 0 ≤ r' < Q. -func useHint(rp uint32, hint uint32) uint32 { - rp0plusQ, rp1 := decompose(rp) - if hint == 0 { - return rp1 - } - if rp0plusQ > common.Q { - return (rp1 + 1) & 15 - } - return (rp1 - 1) & 15 -} - -// Sets p to the hint polynomial for p0 the modified low bits and p1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint polynomial. -func PolyMakeHint(p, p0, p1 *common.Poly) (pop uint32) { - for i := 0; i < common.N; i++ { - h := makeHint(p0[i], p1[i]) - pop += h - p[i] = h - } - return -} - -// Computes corrections to the high bits of the polynomial q according -// to the hints in h and sets p to the corrected high bits. Returns p. -func PolyUseHint(p, q, hint *common.Poly) { - var q0PlusQ common.Poly - - // See useHint() and makeHint() for an explanation. We reimplement it - // here so that we can call Poly.Decompose(), which might be way faster - // than calling decompose() in a loop (for instance when having AVX2.) - - PolyDecompose(q, &q0PlusQ, p) - - for i := 0; i < common.N; i++ { - if hint[i] == 0 { - continue - } - if Gamma2 == 261888 { - if q0PlusQ[i] > common.Q { - p[i] = (p[i] + 1) & 15 - } else { - p[i] = (p[i] - 1) & 15 - } - } else if Gamma2 == 95232 { - if q0PlusQ[i] > common.Q { - if p[i] == 43 { - p[i] = 0 - } else { - p[i]++ - } - } else { - if p[i] == 0 { - p[i] = 43 - } else { - p[i]-- - } - } - } else { - panic("unsupported γ₂") - } - } -} - -// Splits each of the coefficients of p using decompose. -func PolyDecompose(p, p0PlusQ, p1 *common.Poly) { - for i := 0; i < common.N; i++ { - p0PlusQ[i], p1[i] = decompose(p[i]) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/sample.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/sample.go deleted file mode 100644 index f90d211..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/sample.go +++ /dev/null @@ -1,337 +0,0 @@ -package internal - -import ( - "encoding/binary" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" - "github.com/cloudflare/circl/simd/keccakf1600" -) - -// DeriveX4Available indicates whether the system supports the quick fourway -// sampling variants like PolyDeriveUniformX4. -var DeriveX4Available = keccakf1600.IsEnabledX4() - -// For each i, sample ps[i] uniformly from the given seed and nonces[i]. -// ps[i] may be nil and is ignored in that case. -// -// Can only be called when DeriveX4Available is true. -func PolyDeriveUniformX4(ps [4]*common.Poly, seed *[32]byte, nonces [4]uint16) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < 4; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // Absorb the nonces, the SHAKE128 domain separator (0b1111), the - // start of the padding (0b...001) and the end of the padding 0b100... - // Recall that the rate of SHAKE128 is 168 --- i.e. 21 uint64s. - for j := 0; j < 4; j++ { - state[4*4+j] = uint64(nonces[j]) | (0x1f << 16) - state[20*4+j] = 0x80 << 56 - } - - var idx [4]int // indices into ps - for j := 0; j < 4; j++ { - if ps[j] == nil { - idx[j] = common.N // mark nil polynomial as completed - } - } - - done := false - for !done { - // Applies KeccaK-f[1600] to state to get the next 21 uint64s of each - // of the four SHAKE128 streams. - perm.Permute() - - done = true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - for i := 0; i < 7; i++ { - var t [8]uint32 - t[0] = uint32(state[i*3*4+j] & 0x7fffff) - t[1] = uint32((state[i*3*4+j] >> 24) & 0x7fffff) - t[2] = uint32((state[i*3*4+j] >> 48) | - ((state[(i*3+1)*4+j] & 0x7f) << 16)) - t[3] = uint32((state[(i*3+1)*4+j] >> 8) & 0x7fffff) - t[4] = uint32((state[(i*3+1)*4+j] >> 32) & 0x7fffff) - t[5] = uint32((state[(i*3+1)*4+j] >> 56) | - ((state[(i*3+2)*4+j] & 0x7fff) << 8)) - t[6] = uint32((state[(i*3+2)*4+j] >> 16) & 0x7fffff) - t[7] = uint32((state[(i*3+2)*4+j] >> 40) & 0x7fffff) - - for k := 0; k < 8; k++ { - if t[k] < common.Q { - ps[j][idx[j]] = t[k] - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - } - done = false - } - } -} - -// Sample p uniformly from the given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniform(p *common.Poly, seed *[32]byte, nonce uint16) { - var i, length int - var buf [12 * 16]byte // fits 168B SHAKE-128 rate - - length = 168 - - sample := func() { - // Note that 3 divides into 168 and 12*16, so we use up buf completely. - for j := 0; j < length && i < common.N; j += 3 { - t := (uint32(buf[j]) | (uint32(buf[j+1]) << 8) | - (uint32(buf[j+2]) << 16)) & 0x7fffff - - // We use rejection sampling - if t < common.Q { - p[i] = t - i++ - } - } - } - - var iv [32 + 2]byte // 32 byte seed + uint16 nonce - h := sha3.NewShake128() - copy(iv[:32], seed[:]) - iv[32] = uint8(nonce) - iv[33] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:168]) - sample() - } -} - -// Sample p uniformly with coefficients of norm less than or equal η, -// using the given seed and nonce. -// -// p will not be normalized, but will have coefficients in [q-η,q+η]. -func PolyDeriveUniformLeqEta(p *common.Poly, seed *[64]byte, nonce uint16) { - // Assumes 2 < η < 8. - var i, length int - var buf [9 * 16]byte // fits 136B SHAKE-256 rate - - length = 136 - - sample := func() { - // We use rejection sampling - for j := 0; j < length && i < common.N; j++ { - t1 := uint32(buf[j]) & 15 - t2 := uint32(buf[j]) >> 4 - if Eta == 2 { // branch is eliminated by compiler - if t1 <= 14 { - t1 -= ((205 * t1) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 14 && i < common.N { - t2 -= ((205 * t2) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t2 - i++ - } - } else if Eta == 4 { - if t1 <= 2*Eta { - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 2*Eta && i < common.N { - p[i] = common.Q + Eta - t2 - i++ - } - } else { - panic("unsupported η") - } - } - } - - var iv [64 + 2]byte // 64 byte seed + uint16 nonce - - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - - // 136 is SHAKE-256 rate - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:136]) - sample() - } -} - -// Sample v[i] uniformly with coefficients in (-γ₁,…,γ₁] using the -// given seed and nonce+i -// -// p will be normalized. -func VecLDeriveUniformLeGamma1(v *VecL, seed *[64]byte, nonce uint16) { - for i := 0; i < L; i++ { - PolyDeriveUniformLeGamma1(&v[i], seed, nonce+uint16(i)) - } -} - -// Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the -// given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniformLeGamma1(p *common.Poly, seed *[64]byte, nonce uint16) { - var buf [PolyLeGamma1Size]byte - - var iv [66]byte - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - _, _ = h.Read(buf[:]) - - PolyUnpackLeGamma1(p, buf[:]) -} - -// For each i, sample ps[i] uniformly with τ non-zero coefficients in {q-1,1} -// using the given seed and w1[i]. ps[i] may be nil and is ignored -// in that case. ps[i] will be normalized. -// -// Can only be called when DeriveX4Available is true. -// -// This function is currently not used (yet). -func PolyDeriveUniformBallX4(ps [4]*common.Poly, seed []byte) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < CTildeSize/8; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // SHAKE256 domain separator and padding - for j := 0; j < 4; j++ { - state[(CTildeSize/8)*4+j] ^= 0x1f - state[16*4+j] ^= 0x80 << 56 - } - perm.Permute() - - var signs [4]uint64 - var idx [4]uint16 // indices into ps - - for j := 0; j < 4; j++ { - if ps[j] != nil { - signs[j] = state[j] - *ps[j] = common.Poly{} // zero ps[j] - idx[j] = common.N - Tau - } else { - idx[j] = common.N // mark as completed - } - } - - stateOffset := 1 - for { - done := true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - - for i := stateOffset; i < 17; i++ { - var bs [8]byte - binary.LittleEndian.PutUint64(bs[:], state[4*i+j]) - for k := 0; k < 8; k++ { - b := uint16(bs[k]) - - if b > idx[j] { - continue - } - - ps[j][idx[j]] = ps[j][b] - ps[j][b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - ps[j][b] ^= uint32((-(signs[j] & 1)) & (1 | (common.Q - 1))) - signs[j] >>= 1 - - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - - done = false - } - - if done { - break - } - - perm.Permute() - stateOffset = 0 - } -} - -// Samples p uniformly with τ non-zero coefficients in {q-1,1}. -// -// The polynomial p will be normalized. -func PolyDeriveUniformBall(p *common.Poly, seed []byte) { - var buf [136]byte // SHAKE-256 rate is 136 - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - _, _ = h.Read(buf[:]) - - // Essentially we generate a sequence of τ ones or minus ones, - // prepend 196 zeroes and shuffle the concatenation using the - // usual algorithm (Fisher--Yates.) - signs := binary.LittleEndian.Uint64(buf[:]) - bufOff := 8 // offset into buf - - *p = common.Poly{} // zero p - for i := uint16(common.N - Tau); i < common.N; i++ { - var b uint16 - - // Find location of where to move the new coefficient to using - // rejection sampling. - for { - if bufOff >= 136 { - _, _ = h.Read(buf[:]) - bufOff = 0 - } - - b = uint16(buf[bufOff]) - bufOff++ - - if b <= i { - break - } - } - - p[i] = p[b] - p[b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - p[b] ^= uint32((-(signs & 1)) & (1 | (common.Q - 1))) - signs >>= 1 - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/vec.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/vec.go deleted file mode 100644 index 5817acb..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode3/internal/vec.go +++ /dev/null @@ -1,279 +0,0 @@ -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A vector of L polynomials. -type VecL [L]common.Poly - -// A vector of K polynomials. -type VecK [K]common.Poly - -// Normalize the polynomials in this vector. -func (v *VecL) Normalize() { - for i := 0; i < L; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecL) NormalizeAssumingLe2Q() { - for i := 0; i < L; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecL) Add(w, u *VecL) { - for i := 0; i < L; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecL) NTT() { - for i := 0; i < L; i++ { - v[i].NTT() - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecL) Exceeds(bound uint32) bool { - for i := 0; i < L; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Power2Round(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Decompose(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecL) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeqEta(). -func (v *VecL) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sequentially packs each polynomial using PolyPackLeGamma1(). -func (v *VecL) PackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeGamma1(). -func (v *VecL) UnpackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Normalize the polynomials in this vector. -func (v *VecK) Normalize() { - for i := 0; i < K; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecK) NormalizeAssumingLe2Q() { - for i := 0; i < K; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecK) Add(w, u *VecK) { - for i := 0; i < K; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecK) Exceeds(bound uint32) bool { - for i := 0; i < K; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Power2Round(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Decompose(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sets v to the hint vector for v0 the modified low bits and v1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint vector. -func (v *VecK) MakeHint(v0, v1 *VecK) (pop uint32) { - for i := 0; i < K; i++ { - pop += PolyMakeHint(&v[i], &v0[i], &v1[i]) - } - return -} - -// Computes corrections to the high bits of the polynomials in the vector -// w using the hints in h and sets v to the corrected high bits. Returns v. -// See useHint(). -func (v *VecK) UseHint(q, hint *VecK) *VecK { - for i := 0; i < K; i++ { - PolyUseHint(&v[i], &q[i], &hint[i]) - } - return v -} - -// Sequentially packs each polynomial using Poly.PackT1(). -func (v *VecK) PackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sets v to the vector packed into buf by PackT1(). -func (v *VecK) UnpackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sequentially packs each polynomial using Poly.PackT0(). -func (v *VecK) PackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sets v to the vector packed into buf by PackT0(). -func (v *VecK) UnpackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecK) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecK.PackLeqEta(). -func (v *VecK) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecK) NTT() { - for i := 0; i < K; i++ { - v[i].NTT() - } -} - -// Sequentially packs each polynomial using PolyPackW1(). -func (v *VecK) PackW1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackW1(&v[i], buf[offset:]) - offset += PolyW1Size - } -} - -// Sets v to a - b. -// -// Warning: assumes coefficients of the polynomials of b are less than 2q. -func (v *VecK) Sub(a, b *VecK) { - for i := 0; i < K; i++ { - v[i].Sub(&a[i], &b[i]) - } -} - -// Sets v to 2ᵈ w without reducing. -func (v *VecK) MulBy2toD(w *VecK) { - for i := 0; i < K; i++ { - v[i].MulBy2toD(&w[i]) - } -} - -// Applies InvNTT componentwise. See Poly.InvNTT() for details. -func (v *VecK) InvNTT() { - for i := 0; i < K; i++ { - v[i].InvNTT() - } -} - -// Applies Poly.ReduceLe2Q() componentwise. -func (v *VecK) ReduceLe2Q() { - for i := 0; i < K; i++ { - v[i].ReduceLe2Q() - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/dilithium.go deleted file mode 100644 index 3058692..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/dilithium.go +++ /dev/null @@ -1,295 +0,0 @@ -// Code generated from pkg.templ.go. DO NOT EDIT. - -// mode5 implements the CRYSTALS-Dilithium signature scheme Dilithium5 -// as submitted to round3 of the NIST PQC competition and described in -// -// https://pq-crystals.org/dilithium/data/dilithium-specification-round3-20210208.pdf -package mode5 - -import ( - "crypto" - "errors" - "io" - - "github.com/cloudflare/circl/sign" - "github.com/cloudflare/circl/sign/dilithium/mode5/internal" - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -const ( - // Size of seed for NewKeyFromSeed - SeedSize = common.SeedSize - - // Size of a packed PublicKey - PublicKeySize = internal.PublicKeySize - - // Size of a packed PrivateKey - PrivateKeySize = internal.PrivateKeySize - - // Size of a signature - SignatureSize = internal.SignatureSize -) - -// PublicKey is the type of Dilithium5 public key -type PublicKey internal.PublicKey - -// PrivateKey is the type of Dilithium5 private key -type PrivateKey internal.PrivateKey - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - pk, sk, err := internal.GenerateKey(rand) - return (*PublicKey)(pk), (*PrivateKey)(sk), err -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[SeedSize]byte) (*PublicKey, *PrivateKey) { - pk, sk := internal.NewKeyFromSeed(seed) - return (*PublicKey)(pk), (*PrivateKey)(sk) -} - -// SignTo signs the given message and writes the signature into signature. -// It will panic if signature is not of length at least SignatureSize. -func SignTo(sk *PrivateKey, msg, sig []byte) { - var rnd [32]byte - - internal.SignTo( - (*internal.PrivateKey)(sk), - func(w io.Writer) { - w.Write(msg) - }, - rnd, - sig, - ) -} - -// Verify checks whether the given signature by pk on msg is valid. -func Verify(pk *PublicKey, msg, sig []byte) bool { - return internal.Verify( - (*internal.PublicKey)(pk), - func(w io.Writer) { - _, _ = w.Write(msg) - }, - sig, - ) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Unpack(buf) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Unpack(buf) -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Pack(buf) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Pack(buf) -} - -// Packs the public key. -func (pk *PublicKey) Bytes() []byte { - var buf [PublicKeySize]byte - pk.Pack(&buf) - return buf[:] -} - -// Packs the private key. -func (sk *PrivateKey) Bytes() []byte { - var buf [PrivateKeySize]byte - sk.Pack(&buf) - return buf[:] -} - -// Packs the public key. -func (pk *PublicKey) MarshalBinary() ([]byte, error) { - return pk.Bytes(), nil -} - -// Packs the private key. -func (sk *PrivateKey) MarshalBinary() ([]byte, error) { - return sk.Bytes(), nil -} - -// Unpacks the public key from data. -func (pk *PublicKey) UnmarshalBinary(data []byte) error { - if len(data) != PublicKeySize { - return errors.New("packed public key must be of mode5.PublicKeySize bytes") - } - var buf [PublicKeySize]byte - copy(buf[:], data) - pk.Unpack(&buf) - return nil -} - -// Unpacks the private key from data. -func (sk *PrivateKey) UnmarshalBinary(data []byte) error { - if len(data) != PrivateKeySize { - return errors.New("packed private key must be of mode5.PrivateKeySize bytes") - } - var buf [PrivateKeySize]byte - copy(buf[:], data) - sk.Unpack(&buf) - return nil -} - -// Sign signs the given message. -// -// opts.HashFunc() must return zero, which can be achieved by passing -// crypto.Hash(0) for opts. rand is ignored. Will only return an error -// if opts.HashFunc() is non-zero. -// -// This function is used to make PrivateKey implement the crypto.Signer -// interface. The package-level SignTo function might be more convenient -// to use. -func (sk *PrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ( - sig []byte, err error) { - var ret [SignatureSize]byte - - if opts.HashFunc() != crypto.Hash(0) { - return nil, errors.New("dilithium: cannot sign hashed message") - } - SignTo(sk, msg, ret[:]) - - return ret[:], nil -} - -// Computes the public key corresponding to this private key. -// -// Returns a *PublicKey. The type crypto.PublicKey is used to make -// PrivateKey implement the crypto.Signer interface. -func (sk *PrivateKey) Public() crypto.PublicKey { - return (*PublicKey)((*internal.PrivateKey)(sk).Public()) -} - -// Equal returns whether the two private keys equal. -func (sk *PrivateKey) Equal(other crypto.PrivateKey) bool { - castOther, ok := other.(*PrivateKey) - if !ok { - return false - } - return (*internal.PrivateKey)(sk).Equal((*internal.PrivateKey)(castOther)) -} - -// Equal returns whether the two public keys equal. -func (pk *PublicKey) Equal(other crypto.PublicKey) bool { - castOther, ok := other.(*PublicKey) - if !ok { - return false - } - return (*internal.PublicKey)(pk).Equal((*internal.PublicKey)(castOther)) -} - -// Boilerplate for generic signatures API - -type scheme struct{} - -var sch sign.Scheme = &scheme{} - -// Scheme returns a generic signature interface for Dilithium5. -func Scheme() sign.Scheme { return sch } - -func (*scheme) Name() string { return "Dilithium5" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SignatureSize() int { return SignatureSize } -func (*scheme) SeedSize() int { return SeedSize } - -// TODO TLSIdentifier() - -func (*scheme) SupportsContext() bool { - return false -} - -func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) { - return GenerateKey(nil) -} - -func (*scheme) Sign( - sk sign.PrivateKey, - msg []byte, - opts *sign.SignatureOpts, -) []byte { - sig := make([]byte, SignatureSize) - - priv, ok := sk.(*PrivateKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - SignTo(priv, msg, sig) - - return sig -} - -func (*scheme) Verify( - pk sign.PublicKey, - msg, sig []byte, - opts *sign.SignatureOpts, -) bool { - pub, ok := pk.(*PublicKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - return Verify(pub, msg, sig) -} - -func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) { - if len(seed) != SeedSize { - panic(sign.ErrSeedSize) - } - var seed2 [SeedSize]byte - copy(seed2[:], seed) - return NewKeyFromSeed(&seed2) -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) { - if len(buf) != PublicKeySize { - return nil, sign.ErrPubKeySize - } - - var ( - buf2 [PublicKeySize]byte - ret PublicKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) { - if len(buf) != PrivateKeySize { - return nil, sign.ErrPrivKeySize - } - - var ( - buf2 [PrivateKeySize]byte - ret PrivateKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (sk *PrivateKey) Scheme() sign.Scheme { - return sch -} - -func (sk *PublicKey) Scheme() sign.Scheme { - return sch -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/dilithium.go deleted file mode 100644 index 8f1c8e5..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/dilithium.go +++ /dev/null @@ -1,491 +0,0 @@ -// Code generated from mode3/internal/dilithium.go by gen.go - -package internal - -import ( - cryptoRand "crypto/rand" - "crypto/subtle" - "io" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -const ( - // Size of a packed polynomial of norm ≤η. - // (Note that the formula is not valid in general.) - PolyLeqEtaSize = (common.N * DoubleEtaBits) / 8 - - // β = τη, the maximum size of c s₂. - Beta = Tau * Eta - - // γ₁ range of y - Gamma1 = 1 << Gamma1Bits - - // Size of packed polynomial of norm <γ₁ such as z - PolyLeGamma1Size = (Gamma1Bits + 1) * common.N / 8 - - // α = 2γ₂ parameter for decompose - Alpha = 2 * Gamma2 - - // Size of a packed private key - PrivateKeySize = 32 + 32 + TRSize + PolyLeqEtaSize*(L+K) + common.PolyT0Size*K - - // Size of a packed public key - PublicKeySize = 32 + common.PolyT1Size*K - - // Size of a packed signature - SignatureSize = L*PolyLeGamma1Size + Omega + K + CTildeSize - - // Size of packed w₁ - PolyW1Size = (common.N * (common.QBits - Gamma1Bits)) / 8 -) - -// PublicKey is the type of Dilithium public keys. -type PublicKey struct { - rho [32]byte - t1 VecK - - // Cached values - t1p [common.PolyT1Size * K]byte - A *Mat - tr *[TRSize]byte -} - -// PrivateKey is the type of Dilithium private keys. -type PrivateKey struct { - rho [32]byte - key [32]byte - s1 VecL - s2 VecK - t0 VecK - tr [TRSize]byte - - // Cached values - A Mat // ExpandA(ρ) - s1h VecL // NTT(s₁) - s2h VecK // NTT(s₂) - t0h VecK // NTT(t₀) -} - -type unpackedSignature struct { - z VecL - hint VecK - c [CTildeSize]byte -} - -// Packs the signature into buf. -func (sig *unpackedSignature) Pack(buf []byte) { - copy(buf[:], sig.c[:]) - sig.z.PackLeGamma1(buf[CTildeSize:]) - sig.hint.PackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) -} - -// Sets sig to the signature encoded in the buffer. -// -// Returns whether buf contains a properly packed signature. -func (sig *unpackedSignature) Unpack(buf []byte) bool { - if len(buf) < SignatureSize { - return false - } - copy(sig.c[:], buf[:]) - sig.z.UnpackLeGamma1(buf[CTildeSize:]) - if sig.z.Exceeds(Gamma1 - Beta) { - return false - } - if !sig.hint.UnpackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) { - return false - } - return true -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - copy(buf[:32], pk.rho[:]) - copy(buf[32:], pk.t1p[:]) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - copy(pk.rho[:], buf[:32]) - copy(pk.t1p[:], buf[32:]) - - pk.t1.UnpackT1(pk.t1p[:]) - pk.A = new(Mat) - pk.A.Derive(&pk.rho) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - pk.tr = new([TRSize]byte) - h := sha3.NewShake256() - _, _ = h.Write(buf[:]) - _, _ = h.Read(pk.tr[:]) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - copy(buf[:32], sk.rho[:]) - copy(buf[32:64], sk.key[:]) - copy(buf[64:64+TRSize], sk.tr[:]) - offset := 64 + TRSize - sk.s1.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.PackT0(buf[offset:]) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - copy(sk.rho[:], buf[:32]) - copy(sk.key[:], buf[32:64]) - copy(sk.tr[:], buf[64:64+TRSize]) - offset := 64 + TRSize - sk.s1.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.UnpackT0(buf[offset:]) - - // Cached values - sk.A.Derive(&sk.rho) - sk.t0h = sk.t0 - sk.t0h.NTT() - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() -} - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - var seed [32]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - pk, sk := NewKeyFromSeed(&seed) - return pk, sk, nil -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[common.SeedSize]byte) (*PublicKey, *PrivateKey) { - var eSeed [128]byte // expanded seed - var pk PublicKey - var sk PrivateKey - var sSeed [64]byte - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - - if NIST { - _, _ = h.Write([]byte{byte(K), byte(L)}) - } - - _, _ = h.Read(eSeed[:]) - - copy(pk.rho[:], eSeed[:32]) - copy(sSeed[:], eSeed[32:96]) - copy(sk.key[:], eSeed[96:]) - copy(sk.rho[:], pk.rho[:]) - - sk.A.Derive(&pk.rho) - - for i := uint16(0); i < L; i++ { - PolyDeriveUniformLeqEta(&sk.s1[i], &sSeed, i) - } - - for i := uint16(0); i < K; i++ { - PolyDeriveUniformLeqEta(&sk.s2[i], &sSeed, i+L) - } - - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() - - sk.computeT0andT1(&sk.t0, &pk.t1) - - sk.t0h = sk.t0 - sk.t0h.NTT() - - // Complete public key far enough to be packed - pk.t1.PackT1(pk.t1p[:]) - pk.A = &sk.A - - // Finish private key - var packedPk [PublicKeySize]byte - pk.Pack(&packedPk) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - h.Reset() - _, _ = h.Write(packedPk[:]) - _, _ = h.Read(sk.tr[:]) - - // Finish cache of public key - pk.tr = &sk.tr - - return &pk, &sk -} - -// Computes t0 and t1 from sk.s1h, sk.s2 and sk.A. -func (sk *PrivateKey) computeT0andT1(t0, t1 *VecK) { - var t VecK - - // Set t to A s₁ + s₂ - for i := 0; i < K; i++ { - PolyDotHat(&t[i], &sk.A[i], &sk.s1h) - t[i].ReduceLe2Q() - t[i].InvNTT() - } - t.Add(&t, &sk.s2) - t.Normalize() - - // Compute t₀, t₁ = Power2Round(t) - t.Power2Round(t0, t1) -} - -// Verify checks whether the given signature by pk on msg is valid. -// -// For Dilithium this is the top-level verification function. -// In ML-DSA, this is ML-DSA.Verify_internal. -func Verify(pk *PublicKey, msg func(io.Writer), signature []byte) bool { - var sig unpackedSignature - var mu [64]byte - var zh VecL - var Az, Az2dct1, w1 VecK - var ch common.Poly - var cp [CTildeSize]byte - var w1Packed [PolyW1Size * K]byte - - // Note that Unpack() checked whether ‖z‖_∞ < γ₁ - β - // and ensured that there at most ω ones in pk.hint. - if !sig.Unpack(signature) { - return false - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(pk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // Compute Az - zh = sig.z - zh.NTT() - - for i := 0; i < K; i++ { - PolyDotHat(&Az[i], &pk.A[i], &zh) - } - - // Next, we compute Az - 2ᵈ·c·t₁. - // Note that the coefficients of t₁ are bounded by 256 = 2⁹, - // so the coefficients of Az2dct1 will bounded by 2⁹⁺ᵈ = 2²³ < 2q, - // which is small enough for NTT(). - Az2dct1.MulBy2toD(&pk.t1) - Az2dct1.NTT() - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - for i := 0; i < K; i++ { - Az2dct1[i].MulHat(&Az2dct1[i], &ch) - } - Az2dct1.Sub(&Az, &Az2dct1) - Az2dct1.ReduceLe2Q() - Az2dct1.InvNTT() - Az2dct1.NormalizeAssumingLe2Q() - - // UseHint(pk.hint, Az - 2ᵈ·c·t₁) - // = UseHint(pk.hint, w - c·s₂ + c·t₀) - // = UseHint(pk.hint, r + c·t₀) - // = r₁ = w₁. - w1.UseHint(&Az2dct1, &sig.hint) - w1.PackW1(w1Packed[:]) - - // c' = H(μ, w₁) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(cp[:]) - - return sig.c == cp -} - -// SignTo signs the given message and writes the signature into signature. -// -// For Dilithium this is the top-level signing function. For ML-DSA -// this is ML-DSA.Sign_internal. -// -//nolint:funlen -func SignTo(sk *PrivateKey, msg func(io.Writer), rnd [32]byte, signature []byte) { - var mu, rhop [64]byte - var w1Packed [PolyW1Size * K]byte - var y, yh VecL - var w, w0, w1, w0mcs2, ct0, w0mcs2pct0 VecK - var ch common.Poly - var yNonce uint16 - var sig unpackedSignature - - if len(signature) < SignatureSize { - panic("Signature does not fit in that byteslice") - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(sk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // ρ' = CRH(key ‖ μ) - h.Reset() - _, _ = h.Write(sk.key[:]) - if NIST { - _, _ = h.Write(rnd[:]) - } - _, _ = h.Write(mu[:]) - _, _ = h.Read(rhop[:]) - - // Main rejection loop - attempt := 0 - for { - attempt++ - if attempt >= 576 { - // Depending on the mode, one try has a chance between 1/7 and 1/4 - // of succeeding. Thus it is safe to say that 576 iterations - // are enough as (6/7)⁵⁷⁶ < 2⁻¹²⁸. - panic("This should only happen 1 in 2^{128}: something is wrong.") - } - - // y = ExpandMask(ρ', key) - VecLDeriveUniformLeGamma1(&y, &rhop, yNonce) - yNonce += uint16(L) - - // Set w to A y - yh = y - yh.NTT() - for i := 0; i < K; i++ { - PolyDotHat(&w[i], &sk.A[i], &yh) - w[i].ReduceLe2Q() - w[i].InvNTT() - } - - // Decompose w into w₀ and w₁ - w.NormalizeAssumingLe2Q() - w.Decompose(&w0, &w1) - - // c~ = H(μ ‖ w₁) - w1.PackW1(w1Packed[:]) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(sig.c[:]) - - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - - // Ensure ‖ w₀ - c·s2 ‖_∞ < γ₂ - β. - // - // By Lemma 3 of the specification this is equivalent to checking that - // both ‖ r₀ ‖_∞ < γ₂ - β and r₁ = w₁, for the decomposition - // w - c·s₂ = r₁ α + r₀ as computed by decompose(). - // See also §4.1 of the specification. - for i := 0; i < K; i++ { - w0mcs2[i].MulHat(&ch, &sk.s2h[i]) - w0mcs2[i].InvNTT() - } - w0mcs2.Sub(&w0, &w0mcs2) - w0mcs2.Normalize() - - if w0mcs2.Exceeds(Gamma2 - Beta) { - continue - } - - // z = y + c·s₁ - for i := 0; i < L; i++ { - sig.z[i].MulHat(&ch, &sk.s1h[i]) - sig.z[i].InvNTT() - } - sig.z.Add(&sig.z, &y) - sig.z.Normalize() - - // Ensure ‖z‖_∞ < γ₁ - β - if sig.z.Exceeds(Gamma1 - Beta) { - continue - } - - // Compute c·t₀ - for i := 0; i < K; i++ { - ct0[i].MulHat(&ch, &sk.t0h[i]) - ct0[i].InvNTT() - } - ct0.NormalizeAssumingLe2Q() - - // Ensure ‖c·t₀‖_∞ < γ₂. - if ct0.Exceeds(Gamma2) { - continue - } - - // Create the hint to be able to reconstruct w₁ from w - c·s₂ + c·t0. - // Note that we're not using makeHint() in the obvious way as we - // do not know whether ‖ sc·s₂ - c·t₀ ‖_∞ < γ₂. Instead we note - // that our makeHint() is actually the same as a makeHint for a - // different decomposition: - // - // Earlier we ensured indirectly with a check that r₁ = w₁ where - // r = w - c·s₂. Hence r₀ = r - r₁ α = w - c·s₂ - w₁ α = w₀ - c·s₂. - // Thus MakeHint(w₀ - c·s₂ + c·t₀, w₁) = MakeHint(r0 + c·t₀, r₁) - // and UseHint(w - c·s₂ + c·t₀, w₁) = UseHint(r + c·t₀, r₁). - // As we just ensured that ‖ c·t₀ ‖_∞ < γ₂ our usage is correct. - w0mcs2pct0.Add(&w0mcs2, &ct0) - w0mcs2pct0.NormalizeAssumingLe2Q() - hintPop := sig.hint.MakeHint(&w0mcs2pct0, &w1) - if hintPop > Omega { - continue - } - - break - } - - sig.Pack(signature[:]) -} - -// Computes the public key corresponding to this private key. -func (sk *PrivateKey) Public() *PublicKey { - var t0 VecK - pk := &PublicKey{ - rho: sk.rho, - A: &sk.A, - tr: &sk.tr, - } - sk.computeT0andT1(&t0, &pk.t1) - pk.t1.PackT1(pk.t1p[:]) - return pk -} - -// Equal returns whether the two public keys are equal -func (pk *PublicKey) Equal(other *PublicKey) bool { - return pk.rho == other.rho && pk.t1 == other.t1 -} - -// Equal returns whether the two private keys are equal -func (sk *PrivateKey) Equal(other *PrivateKey) bool { - ret := (subtle.ConstantTimeCompare(sk.rho[:], other.rho[:]) & - subtle.ConstantTimeCompare(sk.key[:], other.key[:]) & - subtle.ConstantTimeCompare(sk.tr[:], other.tr[:])) - - acc := uint32(0) - for i := 0; i < L; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s1[i][j] ^ other.s1[i][j] - } - } - for i := 0; i < K; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s2[i][j] ^ other.s2[i][j] - acc |= sk.t0[i][j] ^ other.t0[i][j] - } - } - return (ret & subtle.ConstantTimeEq(int32(acc), 0)) == 1 -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/mat.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/mat.go deleted file mode 100644 index ceaf634..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/mat.go +++ /dev/null @@ -1,59 +0,0 @@ -// Code generated from mode3/internal/mat.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A k by l matrix of polynomials. -type Mat [K]VecL - -// Expands the given seed to a complete matrix. -// -// This function is called ExpandA in the specification. -func (m *Mat) Derive(seed *[32]byte) { - if !DeriveX4Available { - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - PolyDeriveUniform(&m[i][j], seed, (i<<8)+j) - } - } - return - } - - idx := 0 - var nonces [4]uint16 - var ps [4]*common.Poly - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - nonces[idx] = (i << 8) + j - ps[idx] = &m[i][j] - idx++ - if idx == 4 { - idx = 0 - PolyDeriveUniformX4(ps, seed, nonces) - } - } - } - if idx != 0 { - for i := idx; i < 4; i++ { - ps[i] = nil - } - PolyDeriveUniformX4(ps, seed, nonces) - } -} - -// Set p to the inner product of a and b using pointwise multiplication. -// -// Assumes a and b are in Montgomery form and their coefficients are -// pairwise sufficiently small to multiply, see Poly.MulHat(). Resulting -// coefficients are bounded by 2Lq. -func PolyDotHat(p *common.Poly, a, b *VecL) { - var t common.Poly - *p = common.Poly{} // zero p - for i := 0; i < L; i++ { - t.MulHat(&a[i], &b[i]) - p.Add(&t, p) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/pack.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/pack.go deleted file mode 100644 index 1854b41..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/pack.go +++ /dev/null @@ -1,270 +0,0 @@ -// Code generated from mode3/internal/pack.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Writes p with norm less than or equal η into buf, which must be of -// size PolyLeqEtaSize. -// -// Assumes coefficients of p are not normalized, but in [q-η,q+η]. -func PolyPackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - buf[i] = (byte(common.Q+Eta-p[j]) | - byte(common.Q+Eta-p[j+1])<<4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - buf[i] = (byte(common.Q+Eta-p[j]) | - (byte(common.Q+Eta-p[j+1]) << 3) | - (byte(common.Q+Eta-p[j+2]) << 6)) - buf[i+1] = ((byte(common.Q+Eta-p[j+2]) >> 2) | - (byte(common.Q+Eta-p[j+3]) << 1) | - (byte(common.Q+Eta-p[j+4]) << 4) | - (byte(common.Q+Eta-p[j+5]) << 7)) - buf[i+2] = ((byte(common.Q+Eta-p[j+5]) >> 1) | - (byte(common.Q+Eta-p[j+6]) << 2) | - (byte(common.Q+Eta-p[j+7]) << 5)) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Sets p to the polynomial of norm less than or equal η encoded in the -// given buffer of size PolyLeqEtaSize. -// -// Output coefficients of p are not normalized, but in [q-η,q+η] provided -// buf was created using PackLeqEta. -// -// Beware, for arbitrary buf the coefficients of p might end up in -// the interval [q-2^b,q+2^b] where b is the least b with η≤2^b. -func PolyUnpackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - p[j] = common.Q + Eta - uint32(buf[i]&15) - p[j+1] = common.Q + Eta - uint32(buf[i]>>4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - p[j] = common.Q + Eta - uint32(buf[i]&7) - p[j+1] = common.Q + Eta - uint32((buf[i]>>3)&7) - p[j+2] = common.Q + Eta - uint32((buf[i]>>6)|((buf[i+1]<<2)&7)) - p[j+3] = common.Q + Eta - uint32((buf[i+1]>>1)&7) - p[j+4] = common.Q + Eta - uint32((buf[i+1]>>4)&7) - p[j+5] = common.Q + Eta - uint32((buf[i+1]>>7)|((buf[i+2]<<1)&7)) - p[j+6] = common.Q + Eta - uint32((buf[i+2]>>2)&7) - p[j+7] = common.Q + Eta - uint32((buf[i+2]>>5)&7) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Writes v with coefficients in {0, 1} of which at most ω non-zero -// to buf, which must have length ω+k. -func (v *VecK) PackHint(buf []byte) { - // The packed hint starts with the indices of the non-zero coefficients - // For instance: - // - // (x⁵⁶ + x¹⁰⁰, x²⁵⁵, 0, x² + x²³, x¹) - // - // Yields - // - // 56, 100, 255, 2, 23, 1 - // - // Then we pad with zeroes until we have a list of ω items: - // // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0 - // - // Then we finish with a list of the switch-over-indices in this - // list between polynomials, so: - // - // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0, 2, 3, 3, 5, 6 - - off := uint8(0) - for i := 0; i < K; i++ { - for j := uint16(0); j < common.N; j++ { - if v[i][j] != 0 { - buf[off] = uint8(j) - off++ - } - } - buf[Omega+i] = off - } - for ; off < Omega; off++ { - buf[off] = 0 - } -} - -// Sets v to the vector encoded using VecK.PackHint() -// -// Returns whether unpacking was successful. -func (v *VecK) UnpackHint(buf []byte) bool { - // A priori, there would be several reasonable ways to encode the same - // hint vector. We take care to only allow only one encoding, to ensure - // "strong unforgeability". - // - // See PackHint() source for description of the encoding. - *v = VecK{} // zero v - prevSOP := uint8(0) // previous switch-over-point - for i := 0; i < K; i++ { - SOP := buf[Omega+i] - if SOP < prevSOP || SOP > Omega { - return false // ensures switch-over-points are increasing - } - for j := prevSOP; j < SOP; j++ { - if j > prevSOP && buf[j] <= buf[j-1] { - return false // ensures indices are increasing (within a poly) - } - v[i][buf[j]] = 1 - } - prevSOP = SOP - } - for j := prevSOP; j < Omega; j++ { - if buf[j] != 0 { - return false // ensures padding indices are zero - } - } - - return true -} - -// Sets p to the polynomial packed into buf by PolyPackLeGamma1. -// -// p will be normalized. -func PolyUnpackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0x3) << 16) - p1 := uint32(buf[i+2]>>2) | (uint32(buf[i+3]) << 6) | - (uint32(buf[i+4]&0xf) << 14) - p2 := uint32(buf[i+4]>>4) | (uint32(buf[i+5]) << 4) | - (uint32(buf[i+6]&0x3f) << 12) - p3 := uint32(buf[i+6]>>6) | (uint32(buf[i+7]) << 2) | - (uint32(buf[i+8]) << 10) - - // coefficients in [0,…,2γ₁) - p0 = Gamma1 - p0 // (-γ₁,…,γ₁] - p1 = Gamma1 - p1 - p2 = Gamma1 - p2 - p3 = Gamma1 - p3 - - p0 += uint32(int32(p0)>>31) & common.Q // normalize - p1 += uint32(int32(p1)>>31) & common.Q - p2 += uint32(int32(p2)>>31) & common.Q - p3 += uint32(int32(p3)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - p[j+2] = p2 - p[j+3] = p3 - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0xf) << 16) - p1 := uint32(buf[i+2]>>4) | (uint32(buf[i+3]) << 4) | - (uint32(buf[i+4]) << 12) - - p0 = Gamma1 - p0 - p1 = Gamma1 - p1 - - p0 += uint32(int32(p0)>>31) & common.Q - p1 += uint32(int32(p1)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Writes p whose coefficients are in (-γ₁,γ₁] into buf -// which has to be of length PolyLeGamma1Size. -// -// Assumes p is normalized. -func PolyPackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - // coefficients in [0,…,γ₁] ∪ (q-γ₁,…,q) - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := Gamma1 - p[j] // [0,…,γ₁] ∪ (γ₁-q,…,2γ₁-q) - p0 += uint32(int32(p0)>>31) & common.Q // [0,…,2γ₁) - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - p2 := Gamma1 - p[j+2] - p2 += uint32(int32(p2)>>31) & common.Q - p3 := Gamma1 - p[j+3] - p3 += uint32(int32(p3)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<2) - buf[i+3] = byte(p1 >> 6) - buf[i+4] = byte(p1>>14) | byte(p2<<4) - buf[i+5] = byte(p2 >> 4) - buf[i+6] = byte(p2>>12) | byte(p3<<6) - buf[i+7] = byte(p3 >> 2) - buf[i+8] = byte(p3 >> 10) - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - // Coefficients are in [0, γ₁] ∪ (Q-γ₁, Q) - p0 := Gamma1 - p[j] - p0 += uint32(int32(p0)>>31) & common.Q - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<4) - buf[i+3] = byte(p1 >> 4) - buf[i+4] = byte(p1 >> 12) - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Pack w₁ into buf, which must be of length PolyW1Size. -// -// Assumes w₁ is normalized. -func PolyPackW1(p *common.Poly, buf []byte) { - if Gamma1Bits == 19 { - p.PackLe16(buf) - } else if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyW1Size; i += 3 { - buf[i] = byte(p[j]) | byte(p[j+1]<<6) - buf[i+1] = byte(p[j+1]>>2) | byte(p[j+2]<<4) - buf[i+2] = byte(p[j+2]>>4) | byte(p[j+3]<<2) - j += 4 - } - } else { - panic("unsupported γ₁") - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/params.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/params.go deleted file mode 100644 index 6f65f03..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/params.go +++ /dev/null @@ -1,18 +0,0 @@ -// Code generated from params.templ.go. DO NOT EDIT. - -package internal - -const ( - Name = "Dilithium5" - K = 8 - L = 7 - Eta = 2 - DoubleEtaBits = 3 - Omega = 75 - Tau = 60 - Gamma1Bits = 19 - Gamma2 = 261888 - NIST = false - TRSize = 32 - CTildeSize = 32 -) diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/rounding.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/rounding.go deleted file mode 100644 index 58123c0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/rounding.go +++ /dev/null @@ -1,142 +0,0 @@ -// Code generated from mode3/internal/rounding.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, -// except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken -// and -α/2 ≤ a₀ < 0. Returns a₀ + q. Note 0 ≤ a₁ < (q-1)/α. -// Recall α = 2γ₂. -func decompose(a uint32) (a0plusQ, a1 uint32) { - // a₁ = ⌈a / 128⌉ - a1 = (a + 127) >> 7 - - if Alpha == 523776 { - // 1025/2²² is close enough to 1/4092 so that a₁ - // becomes a/α rounded down. - a1 = ((a1*1025 + (1 << 21)) >> 22) - - // For the corner-case a₁ = (q-1)/α = 16, we have to set a₁=0. - a1 &= 15 - } else if Alpha == 190464 { - // 1488/2²⁴ is close enough to 1/1488 so that a₁ - // becomes a/α rounded down. - a1 = ((a1 * 11275) + (1 << 23)) >> 24 - - // For the corner-case a₁ = (q-1)/α = 44, we have to set a₁=0. - a1 ^= uint32(int32(43-a1)>>31) & a1 - } else { - panic("unsupported α") - } - - a0plusQ = a - a1*Alpha - - // In the corner-case, when we set a₁=0, we will incorrectly - // have a₀ > (q-1)/2 and we'll need to subtract q. As we - // return a₀ + q, that comes down to adding q if a₀ < (q-1)/2. - a0plusQ += uint32(int32(a0plusQ-(common.Q-1)/2)>>31) & common.Q - - return -} - -// Assume 0 ≤ r, f < Q with ‖f‖_∞ ≤ α/2. Decompose r as r = r1*α + r0 as -// computed by decompose(). Write r' := r - f (mod Q). Now, decompose -// r'=r-f again as r' = r'1*α + r'0 using decompose(). As f is small, we -// have r'1 = r1 + h, where h ∈ {-1, 0, 1}. makeHint() computes |h| -// given z0 := r0 - f (mod Q) and r1. With |h|, which is called the hint, -// we can reconstruct r1 using only r' = r - f, which is done by useHint(). -// To wit: -// -// useHint( r - f, makeHint( r0 - f, r1 ) ) = r1. -// -// Assumes 0 ≤ z0 < Q. -func makeHint(z0, r1 uint32) uint32 { - // If -α/2 < r0 - f ≤ α/2, then r1*α + r0 - f is a valid decomposition of r' - // with the restrictions of decompose() and so r'1 = r1. So the hint - // should be 0. This is covered by the first two inequalities. - // There is one other case: if r0 - f = -α/2, then r1*α + r0 - f is also - // a valid decomposition if r1 = 0. In the other cases a one is carried - // and the hint should be 1. - if z0 <= Gamma2 || z0 > common.Q-Gamma2 || (z0 == common.Q-Gamma2 && r1 == 0) { - return 0 - } - return 1 -} - -// Uses the hint created by makeHint() to reconstruct r1 from r'=r-f; see -// documentation of makeHint() for context. -// Assumes 0 ≤ r' < Q. -func useHint(rp uint32, hint uint32) uint32 { - rp0plusQ, rp1 := decompose(rp) - if hint == 0 { - return rp1 - } - if rp0plusQ > common.Q { - return (rp1 + 1) & 15 - } - return (rp1 - 1) & 15 -} - -// Sets p to the hint polynomial for p0 the modified low bits and p1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint polynomial. -func PolyMakeHint(p, p0, p1 *common.Poly) (pop uint32) { - for i := 0; i < common.N; i++ { - h := makeHint(p0[i], p1[i]) - pop += h - p[i] = h - } - return -} - -// Computes corrections to the high bits of the polynomial q according -// to the hints in h and sets p to the corrected high bits. Returns p. -func PolyUseHint(p, q, hint *common.Poly) { - var q0PlusQ common.Poly - - // See useHint() and makeHint() for an explanation. We reimplement it - // here so that we can call Poly.Decompose(), which might be way faster - // than calling decompose() in a loop (for instance when having AVX2.) - - PolyDecompose(q, &q0PlusQ, p) - - for i := 0; i < common.N; i++ { - if hint[i] == 0 { - continue - } - if Gamma2 == 261888 { - if q0PlusQ[i] > common.Q { - p[i] = (p[i] + 1) & 15 - } else { - p[i] = (p[i] - 1) & 15 - } - } else if Gamma2 == 95232 { - if q0PlusQ[i] > common.Q { - if p[i] == 43 { - p[i] = 0 - } else { - p[i]++ - } - } else { - if p[i] == 0 { - p[i] = 43 - } else { - p[i]-- - } - } - } else { - panic("unsupported γ₂") - } - } -} - -// Splits each of the coefficients of p using decompose. -func PolyDecompose(p, p0PlusQ, p1 *common.Poly) { - for i := 0; i < common.N; i++ { - p0PlusQ[i], p1[i] = decompose(p[i]) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/sample.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/sample.go deleted file mode 100644 index b37370a..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/sample.go +++ /dev/null @@ -1,339 +0,0 @@ -// Code generated from mode3/internal/sample.go by gen.go - -package internal - -import ( - "encoding/binary" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" - "github.com/cloudflare/circl/simd/keccakf1600" -) - -// DeriveX4Available indicates whether the system supports the quick fourway -// sampling variants like PolyDeriveUniformX4. -var DeriveX4Available = keccakf1600.IsEnabledX4() - -// For each i, sample ps[i] uniformly from the given seed and nonces[i]. -// ps[i] may be nil and is ignored in that case. -// -// Can only be called when DeriveX4Available is true. -func PolyDeriveUniformX4(ps [4]*common.Poly, seed *[32]byte, nonces [4]uint16) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < 4; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // Absorb the nonces, the SHAKE128 domain separator (0b1111), the - // start of the padding (0b...001) and the end of the padding 0b100... - // Recall that the rate of SHAKE128 is 168 --- i.e. 21 uint64s. - for j := 0; j < 4; j++ { - state[4*4+j] = uint64(nonces[j]) | (0x1f << 16) - state[20*4+j] = 0x80 << 56 - } - - var idx [4]int // indices into ps - for j := 0; j < 4; j++ { - if ps[j] == nil { - idx[j] = common.N // mark nil polynomial as completed - } - } - - done := false - for !done { - // Applies KeccaK-f[1600] to state to get the next 21 uint64s of each - // of the four SHAKE128 streams. - perm.Permute() - - done = true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - for i := 0; i < 7; i++ { - var t [8]uint32 - t[0] = uint32(state[i*3*4+j] & 0x7fffff) - t[1] = uint32((state[i*3*4+j] >> 24) & 0x7fffff) - t[2] = uint32((state[i*3*4+j] >> 48) | - ((state[(i*3+1)*4+j] & 0x7f) << 16)) - t[3] = uint32((state[(i*3+1)*4+j] >> 8) & 0x7fffff) - t[4] = uint32((state[(i*3+1)*4+j] >> 32) & 0x7fffff) - t[5] = uint32((state[(i*3+1)*4+j] >> 56) | - ((state[(i*3+2)*4+j] & 0x7fff) << 8)) - t[6] = uint32((state[(i*3+2)*4+j] >> 16) & 0x7fffff) - t[7] = uint32((state[(i*3+2)*4+j] >> 40) & 0x7fffff) - - for k := 0; k < 8; k++ { - if t[k] < common.Q { - ps[j][idx[j]] = t[k] - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - } - done = false - } - } -} - -// Sample p uniformly from the given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniform(p *common.Poly, seed *[32]byte, nonce uint16) { - var i, length int - var buf [12 * 16]byte // fits 168B SHAKE-128 rate - - length = 168 - - sample := func() { - // Note that 3 divides into 168 and 12*16, so we use up buf completely. - for j := 0; j < length && i < common.N; j += 3 { - t := (uint32(buf[j]) | (uint32(buf[j+1]) << 8) | - (uint32(buf[j+2]) << 16)) & 0x7fffff - - // We use rejection sampling - if t < common.Q { - p[i] = t - i++ - } - } - } - - var iv [32 + 2]byte // 32 byte seed + uint16 nonce - h := sha3.NewShake128() - copy(iv[:32], seed[:]) - iv[32] = uint8(nonce) - iv[33] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:168]) - sample() - } -} - -// Sample p uniformly with coefficients of norm less than or equal η, -// using the given seed and nonce. -// -// p will not be normalized, but will have coefficients in [q-η,q+η]. -func PolyDeriveUniformLeqEta(p *common.Poly, seed *[64]byte, nonce uint16) { - // Assumes 2 < η < 8. - var i, length int - var buf [9 * 16]byte // fits 136B SHAKE-256 rate - - length = 136 - - sample := func() { - // We use rejection sampling - for j := 0; j < length && i < common.N; j++ { - t1 := uint32(buf[j]) & 15 - t2 := uint32(buf[j]) >> 4 - if Eta == 2 { // branch is eliminated by compiler - if t1 <= 14 { - t1 -= ((205 * t1) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 14 && i < common.N { - t2 -= ((205 * t2) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t2 - i++ - } - } else if Eta == 4 { - if t1 <= 2*Eta { - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 2*Eta && i < common.N { - p[i] = common.Q + Eta - t2 - i++ - } - } else { - panic("unsupported η") - } - } - } - - var iv [64 + 2]byte // 64 byte seed + uint16 nonce - - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - - // 136 is SHAKE-256 rate - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:136]) - sample() - } -} - -// Sample v[i] uniformly with coefficients in (-γ₁,…,γ₁] using the -// given seed and nonce+i -// -// p will be normalized. -func VecLDeriveUniformLeGamma1(v *VecL, seed *[64]byte, nonce uint16) { - for i := 0; i < L; i++ { - PolyDeriveUniformLeGamma1(&v[i], seed, nonce+uint16(i)) - } -} - -// Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the -// given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniformLeGamma1(p *common.Poly, seed *[64]byte, nonce uint16) { - var buf [PolyLeGamma1Size]byte - - var iv [66]byte - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - _, _ = h.Read(buf[:]) - - PolyUnpackLeGamma1(p, buf[:]) -} - -// For each i, sample ps[i] uniformly with τ non-zero coefficients in {q-1,1} -// using the given seed and w1[i]. ps[i] may be nil and is ignored -// in that case. ps[i] will be normalized. -// -// Can only be called when DeriveX4Available is true. -// -// This function is currently not used (yet). -func PolyDeriveUniformBallX4(ps [4]*common.Poly, seed []byte) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < CTildeSize/8; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // SHAKE256 domain separator and padding - for j := 0; j < 4; j++ { - state[(CTildeSize/8)*4+j] ^= 0x1f - state[16*4+j] ^= 0x80 << 56 - } - perm.Permute() - - var signs [4]uint64 - var idx [4]uint16 // indices into ps - - for j := 0; j < 4; j++ { - if ps[j] != nil { - signs[j] = state[j] - *ps[j] = common.Poly{} // zero ps[j] - idx[j] = common.N - Tau - } else { - idx[j] = common.N // mark as completed - } - } - - stateOffset := 1 - for { - done := true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - - for i := stateOffset; i < 17; i++ { - var bs [8]byte - binary.LittleEndian.PutUint64(bs[:], state[4*i+j]) - for k := 0; k < 8; k++ { - b := uint16(bs[k]) - - if b > idx[j] { - continue - } - - ps[j][idx[j]] = ps[j][b] - ps[j][b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - ps[j][b] ^= uint32((-(signs[j] & 1)) & (1 | (common.Q - 1))) - signs[j] >>= 1 - - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - - done = false - } - - if done { - break - } - - perm.Permute() - stateOffset = 0 - } -} - -// Samples p uniformly with τ non-zero coefficients in {q-1,1}. -// -// The polynomial p will be normalized. -func PolyDeriveUniformBall(p *common.Poly, seed []byte) { - var buf [136]byte // SHAKE-256 rate is 136 - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - _, _ = h.Read(buf[:]) - - // Essentially we generate a sequence of τ ones or minus ones, - // prepend 196 zeroes and shuffle the concatenation using the - // usual algorithm (Fisher--Yates.) - signs := binary.LittleEndian.Uint64(buf[:]) - bufOff := 8 // offset into buf - - *p = common.Poly{} // zero p - for i := uint16(common.N - Tau); i < common.N; i++ { - var b uint16 - - // Find location of where to move the new coefficient to using - // rejection sampling. - for { - if bufOff >= 136 { - _, _ = h.Read(buf[:]) - bufOff = 0 - } - - b = uint16(buf[bufOff]) - bufOff++ - - if b <= i { - break - } - } - - p[i] = p[b] - p[b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - p[b] ^= uint32((-(signs & 1)) & (1 | (common.Q - 1))) - signs >>= 1 - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/vec.go b/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/vec.go deleted file mode 100644 index d07d3b2..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/dilithium/mode5/internal/vec.go +++ /dev/null @@ -1,281 +0,0 @@ -// Code generated from mode3/internal/vec.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A vector of L polynomials. -type VecL [L]common.Poly - -// A vector of K polynomials. -type VecK [K]common.Poly - -// Normalize the polynomials in this vector. -func (v *VecL) Normalize() { - for i := 0; i < L; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecL) NormalizeAssumingLe2Q() { - for i := 0; i < L; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecL) Add(w, u *VecL) { - for i := 0; i < L; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecL) NTT() { - for i := 0; i < L; i++ { - v[i].NTT() - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecL) Exceeds(bound uint32) bool { - for i := 0; i < L; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Power2Round(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Decompose(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecL) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeqEta(). -func (v *VecL) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sequentially packs each polynomial using PolyPackLeGamma1(). -func (v *VecL) PackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeGamma1(). -func (v *VecL) UnpackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Normalize the polynomials in this vector. -func (v *VecK) Normalize() { - for i := 0; i < K; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecK) NormalizeAssumingLe2Q() { - for i := 0; i < K; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecK) Add(w, u *VecK) { - for i := 0; i < K; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecK) Exceeds(bound uint32) bool { - for i := 0; i < K; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Power2Round(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Decompose(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sets v to the hint vector for v0 the modified low bits and v1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint vector. -func (v *VecK) MakeHint(v0, v1 *VecK) (pop uint32) { - for i := 0; i < K; i++ { - pop += PolyMakeHint(&v[i], &v0[i], &v1[i]) - } - return -} - -// Computes corrections to the high bits of the polynomials in the vector -// w using the hints in h and sets v to the corrected high bits. Returns v. -// See useHint(). -func (v *VecK) UseHint(q, hint *VecK) *VecK { - for i := 0; i < K; i++ { - PolyUseHint(&v[i], &q[i], &hint[i]) - } - return v -} - -// Sequentially packs each polynomial using Poly.PackT1(). -func (v *VecK) PackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sets v to the vector packed into buf by PackT1(). -func (v *VecK) UnpackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sequentially packs each polynomial using Poly.PackT0(). -func (v *VecK) PackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sets v to the vector packed into buf by PackT0(). -func (v *VecK) UnpackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecK) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecK.PackLeqEta(). -func (v *VecK) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecK) NTT() { - for i := 0; i < K; i++ { - v[i].NTT() - } -} - -// Sequentially packs each polynomial using PolyPackW1(). -func (v *VecK) PackW1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackW1(&v[i], buf[offset:]) - offset += PolyW1Size - } -} - -// Sets v to a - b. -// -// Warning: assumes coefficients of the polynomials of b are less than 2q. -func (v *VecK) Sub(a, b *VecK) { - for i := 0; i < K; i++ { - v[i].Sub(&a[i], &b[i]) - } -} - -// Sets v to 2ᵈ w without reducing. -func (v *VecK) MulBy2toD(w *VecK) { - for i := 0; i < K; i++ { - v[i].MulBy2toD(&w[i]) - } -} - -// Applies InvNTT componentwise. See Poly.InvNTT() for details. -func (v *VecK) InvNTT() { - for i := 0; i < K; i++ { - v[i].InvNTT() - } -} - -// Applies Poly.ReduceLe2Q() componentwise. -func (v *VecK) ReduceLe2Q() { - for i := 0; i < K; i++ { - v[i].ReduceLe2Q() - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/ed25519.go b/backend/vendor/github.com/cloudflare/circl/sign/ed25519/ed25519.go deleted file mode 100644 index 2c73c26..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/ed25519.go +++ /dev/null @@ -1,453 +0,0 @@ -// Package ed25519 implements Ed25519 signature scheme as described in RFC-8032. -// -// This package provides optimized implementations of the three signature -// variants and maintaining closer compatibility with crypto/ed25519. -// -// | Scheme Name | Sign Function | Verification | Context | -// |-------------|-------------------|---------------|-------------------| -// | Ed25519 | Sign | Verify | None | -// | Ed25519Ph | SignPh | VerifyPh | Yes, can be empty | -// | Ed25519Ctx | SignWithCtx | VerifyWithCtx | Yes, non-empty | -// | All above | (PrivateKey).Sign | VerifyAny | As above | -// -// Specific functions for sign and verify are defined. A generic signing -// function for all schemes is available through the crypto.Signer interface, -// which is implemented by the PrivateKey type. A correspond all-in-one -// verification method is provided by the VerifyAny function. -// -// Signing with Ed25519Ph or Ed25519Ctx requires a context string for domain -// separation. This parameter is passed using a SignerOptions struct defined -// in this package. While Ed25519Ph accepts an empty context, Ed25519Ctx -// enforces non-empty context strings. -// -// # Compatibility with crypto.ed25519 -// -// These functions are compatible with the “Ed25519” function defined in -// RFC-8032. However, unlike RFC 8032's formulation, this package's private -// key representation includes a public key suffix to make multiple signing -// operations with the same key more efficient. This package refers to the -// RFC-8032 private key as the “seed”. -// -// References -// -// - RFC-8032: https://rfc-editor.org/rfc/rfc8032.txt -// - Ed25519: https://ed25519.cr.yp.to/ -// - EdDSA: High-speed high-security signatures. https://doi.org/10.1007/s13389-012-0027-1 -package ed25519 - -import ( - "bytes" - "crypto" - cryptoRand "crypto/rand" - "crypto/sha512" - "crypto/subtle" - "errors" - "fmt" - "io" - "strconv" - - "github.com/cloudflare/circl/sign" -) - -const ( - // ContextMaxSize is the maximum length (in bytes) allowed for context. - ContextMaxSize = 255 - // PublicKeySize is the size, in bytes, of public keys as used in this package. - PublicKeySize = 32 - // PrivateKeySize is the size, in bytes, of private keys as used in this package. - PrivateKeySize = 64 - // SignatureSize is the size, in bytes, of signatures generated and verified by this package. - SignatureSize = 64 - // SeedSize is the size, in bytes, of private key seeds. These are the private key representations used by RFC 8032. - SeedSize = 32 -) - -const ( - paramB = 256 / 8 // Size of keys in bytes. -) - -// SignerOptions implements crypto.SignerOpts and augments with parameters -// that are specific to the Ed25519 signature schemes. -type SignerOptions struct { - // Hash must be crypto.Hash(0) for Ed25519/Ed25519ctx, or crypto.SHA512 - // for Ed25519ph. - crypto.Hash - - // Context is an optional domain separation string for Ed25519ph and a - // must for Ed25519ctx. Its length must be less or equal than 255 bytes. - Context string - - // Scheme is an identifier for choosing a signature scheme. The zero value - // is ED25519. - Scheme SchemeID -} - -// SchemeID is an identifier for each signature scheme. -type SchemeID uint - -const ( - ED25519 SchemeID = iota - ED25519Ph - ED25519Ctx -) - -// PrivateKey is the type of Ed25519 private keys. It implements crypto.Signer. -type PrivateKey []byte - -// Equal reports whether priv and x have the same value. -func (priv PrivateKey) Equal(x crypto.PrivateKey) bool { - xx, ok := x.(PrivateKey) - return ok && subtle.ConstantTimeCompare(priv, xx) == 1 -} - -// Public returns the PublicKey corresponding to priv. -func (priv PrivateKey) Public() crypto.PublicKey { - publicKey := make(PublicKey, PublicKeySize) - copy(publicKey, priv[SeedSize:]) - return publicKey -} - -// Seed returns the private key seed corresponding to priv. It is provided for -// interoperability with RFC 8032. RFC 8032's private keys correspond to seeds -// in this package. -func (priv PrivateKey) Seed() []byte { - seed := make([]byte, SeedSize) - copy(seed, priv[:SeedSize]) - return seed -} - -func (priv PrivateKey) Scheme() sign.Scheme { return sch } - -func (pub PublicKey) Scheme() sign.Scheme { return sch } - -func (priv PrivateKey) MarshalBinary() (data []byte, err error) { - privateKey := make(PrivateKey, PrivateKeySize) - copy(privateKey, priv) - return privateKey, nil -} - -func (pub PublicKey) MarshalBinary() (data []byte, err error) { - publicKey := make(PublicKey, PublicKeySize) - copy(publicKey, pub) - return publicKey, nil -} - -// Equal reports whether pub and x have the same value. -func (pub PublicKey) Equal(x crypto.PublicKey) bool { - xx, ok := x.(PublicKey) - return ok && bytes.Equal(pub, xx) -} - -// Sign creates a signature of a message with priv key. -// This function is compatible with crypto.ed25519 and also supports the -// three signature variants defined in RFC-8032, namely Ed25519 (or pure -// EdDSA), Ed25519Ph, and Ed25519Ctx. -// The opts.HashFunc() must return zero to specify either Ed25519 or Ed25519Ctx -// variant. This can be achieved by passing crypto.Hash(0) as the value for -// opts. -// The opts.HashFunc() must return SHA512 to specify the Ed25519Ph variant. -// This can be achieved by passing crypto.SHA512 as the value for opts. -// Use a SignerOptions struct (defined in this package) to pass a context -// string for signing. -func (priv PrivateKey) Sign( - rand io.Reader, - message []byte, - opts crypto.SignerOpts, -) (signature []byte, err error) { - var ctx string - var scheme SchemeID - if o, ok := opts.(SignerOptions); ok { - ctx = o.Context - scheme = o.Scheme - } - - switch true { - case scheme == ED25519 && opts.HashFunc() == crypto.Hash(0): - return Sign(priv, message), nil - case scheme == ED25519Ph && opts.HashFunc() == crypto.SHA512: - return SignPh(priv, message, ctx), nil - case scheme == ED25519Ctx && opts.HashFunc() == crypto.Hash(0) && len(ctx) > 0: - return SignWithCtx(priv, message, ctx), nil - default: - return nil, errors.New("ed25519: bad hash algorithm") - } -} - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (PublicKey, PrivateKey, error) { - if rand == nil { - rand = cryptoRand.Reader - } - - seed := make([]byte, SeedSize) - if _, err := io.ReadFull(rand, seed); err != nil { - return nil, nil, err - } - - privateKey := NewKeyFromSeed(seed) - publicKey := make(PublicKey, PublicKeySize) - copy(publicKey, privateKey[SeedSize:]) - - return publicKey, privateKey, nil -} - -// NewKeyFromSeed calculates a private key from a seed. It will panic if -// len(seed) is not SeedSize. This function is provided for interoperability -// with RFC 8032. RFC 8032's private keys correspond to seeds in this -// package. -func NewKeyFromSeed(seed []byte) PrivateKey { - privateKey := make(PrivateKey, PrivateKeySize) - newKeyFromSeed(privateKey, seed) - return privateKey -} - -func newKeyFromSeed(privateKey, seed []byte) { - if l := len(seed); l != SeedSize { - panic("ed25519: bad seed length: " + strconv.Itoa(l)) - } - var P pointR1 - k := sha512.Sum512(seed) - clamp(k[:]) - reduceModOrder(k[:paramB], false) - P.fixedMult(k[:paramB]) - copy(privateKey[:SeedSize], seed) - _ = P.ToBytes(privateKey[SeedSize:]) -} - -func signAll(signature []byte, privateKey PrivateKey, message, ctx []byte, preHash bool) { - if l := len(privateKey); l != PrivateKeySize { - panic("ed25519: bad private key length: " + strconv.Itoa(l)) - } - - H := sha512.New() - var PHM []byte - - if preHash { - _, _ = H.Write(message) - PHM = H.Sum(nil) - H.Reset() - } else { - PHM = message - } - - // 1. Hash the 32-byte private key using SHA-512. - _, _ = H.Write(privateKey[:SeedSize]) - h := H.Sum(nil) - clamp(h[:]) - prefix, s := h[paramB:], h[:paramB] - - // 2. Compute SHA-512(dom2(F, C) || prefix || PH(M)) - H.Reset() - - writeDom(H, ctx, preHash) - - _, _ = H.Write(prefix) - _, _ = H.Write(PHM) - r := H.Sum(nil) - reduceModOrder(r[:], true) - - // 3. Compute the point [r]B. - var P pointR1 - P.fixedMult(r[:paramB]) - R := (&[paramB]byte{})[:] - if err := P.ToBytes(R); err != nil { - panic(err) - } - - // 4. Compute SHA512(dom2(F, C) || R || A || PH(M)). - H.Reset() - - writeDom(H, ctx, preHash) - - _, _ = H.Write(R) - _, _ = H.Write(privateKey[SeedSize:]) - _, _ = H.Write(PHM) - hRAM := H.Sum(nil) - - reduceModOrder(hRAM[:], true) - - // 5. Compute S = (r + k * s) mod order. - S := (&[paramB]byte{})[:] - calculateS(S, r[:paramB], hRAM[:paramB], s) - - // 6. The signature is the concatenation of R and S. - copy(signature[:paramB], R[:]) - copy(signature[paramB:], S[:]) -} - -// Sign signs the message with privateKey and returns a signature. -// This function supports the signature variant defined in RFC-8032: Ed25519, -// also known as the pure version of EdDSA. -// It will panic if len(privateKey) is not PrivateKeySize. -func Sign(privateKey PrivateKey, message []byte) []byte { - signature := make([]byte, SignatureSize) - signAll(signature, privateKey, message, []byte(""), false) - return signature -} - -// SignPh creates a signature of a message with private key and context. -// This function supports the signature variant defined in RFC-8032: Ed25519ph, -// meaning it internally hashes the message using SHA-512, and optionally -// accepts a context string. -// It will panic if len(privateKey) is not PrivateKeySize. -// Context could be passed to this function, which length should be no more than -// ContextMaxSize=255. It can be empty. -func SignPh(privateKey PrivateKey, message []byte, ctx string) []byte { - if len(ctx) > ContextMaxSize { - panic(fmt.Errorf("ed25519: bad context length: %v", len(ctx))) - } - - signature := make([]byte, SignatureSize) - signAll(signature, privateKey, message, []byte(ctx), true) - return signature -} - -// SignWithCtx creates a signature of a message with private key and context. -// This function supports the signature variant defined in RFC-8032: Ed25519ctx, -// meaning it accepts a non-empty context string. -// It will panic if len(privateKey) is not PrivateKeySize. -// Context must be passed to this function, which length should be no more than -// ContextMaxSize=255 and cannot be empty. -func SignWithCtx(privateKey PrivateKey, message []byte, ctx string) []byte { - if len(ctx) == 0 || len(ctx) > ContextMaxSize { - panic(fmt.Errorf("ed25519: bad context length: %v > %v", len(ctx), ContextMaxSize)) - } - - signature := make([]byte, SignatureSize) - signAll(signature, privateKey, message, []byte(ctx), false) - return signature -} - -func verify(public PublicKey, message, signature, ctx []byte, preHash bool) bool { - if len(public) != PublicKeySize || - len(signature) != SignatureSize || - !isLessThanOrder(signature[paramB:]) { - return false - } - - var P pointR1 - if ok := P.FromBytes(public); !ok { - return false - } - - H := sha512.New() - var PHM []byte - - if preHash { - _, _ = H.Write(message) - PHM = H.Sum(nil) - H.Reset() - } else { - PHM = message - } - - R := signature[:paramB] - - writeDom(H, ctx, preHash) - - _, _ = H.Write(R) - _, _ = H.Write(public) - _, _ = H.Write(PHM) - hRAM := H.Sum(nil) - reduceModOrder(hRAM[:], true) - - var Q pointR1 - encR := (&[paramB]byte{})[:] - P.neg() - Q.doubleMult(&P, signature[paramB:], hRAM[:paramB]) - _ = Q.ToBytes(encR) - return bytes.Equal(R, encR) -} - -// VerifyAny returns true if the signature is valid. Failure cases are invalid -// signature, or when the public key cannot be decoded. -// This function supports all the three signature variants defined in RFC-8032, -// namely Ed25519 (or pure EdDSA), Ed25519Ph, and Ed25519Ctx. -// The opts.HashFunc() must return zero to specify either Ed25519 or Ed25519Ctx -// variant. This can be achieved by passing crypto.Hash(0) as the value for opts. -// The opts.HashFunc() must return SHA512 to specify the Ed25519Ph variant. -// This can be achieved by passing crypto.SHA512 as the value for opts. -// Use a SignerOptions struct to pass a context string for signing. -func VerifyAny(public PublicKey, message, signature []byte, opts crypto.SignerOpts) bool { - var ctx string - var scheme SchemeID - if o, ok := opts.(SignerOptions); ok { - ctx = o.Context - scheme = o.Scheme - } - - switch true { - case scheme == ED25519 && opts.HashFunc() == crypto.Hash(0): - return Verify(public, message, signature) - case scheme == ED25519Ph && opts.HashFunc() == crypto.SHA512: - return VerifyPh(public, message, signature, ctx) - case scheme == ED25519Ctx && opts.HashFunc() == crypto.Hash(0) && len(ctx) > 0: - return VerifyWithCtx(public, message, signature, ctx) - default: - return false - } -} - -// Verify returns true if the signature is valid. Failure cases are invalid -// signature, or when the public key cannot be decoded. -// This function supports the signature variant defined in RFC-8032: Ed25519, -// also known as the pure version of EdDSA. -func Verify(public PublicKey, message, signature []byte) bool { - return verify(public, message, signature, []byte(""), false) -} - -// VerifyPh returns true if the signature is valid. Failure cases are invalid -// signature, or when the public key cannot be decoded. -// This function supports the signature variant defined in RFC-8032: Ed25519ph, -// meaning it internally hashes the message using SHA-512. -// Context could be passed to this function, which length should be no more than -// 255. It can be empty. -func VerifyPh(public PublicKey, message, signature []byte, ctx string) bool { - return verify(public, message, signature, []byte(ctx), true) -} - -// VerifyWithCtx returns true if the signature is valid. Failure cases are invalid -// signature, or when the public key cannot be decoded, or when context is -// not provided. -// This function supports the signature variant defined in RFC-8032: Ed25519ctx, -// meaning it does not handle prehashed messages. Non-empty context string must be -// provided, and must not be more than 255 of length. -func VerifyWithCtx(public PublicKey, message, signature []byte, ctx string) bool { - if len(ctx) == 0 || len(ctx) > ContextMaxSize { - return false - } - - return verify(public, message, signature, []byte(ctx), false) -} - -func clamp(k []byte) { - k[0] &= 248 - k[paramB-1] = (k[paramB-1] & 127) | 64 -} - -// isLessThanOrder returns true if 0 <= x < order. -func isLessThanOrder(x []byte) bool { - i := len(order) - 1 - for i > 0 && x[i] == order[i] { - i-- - } - return x[i] < order[i] -} - -func writeDom(h io.Writer, ctx []byte, preHash bool) { - dom2 := "SigEd25519 no Ed25519 collisions" - - if len(ctx) > 0 { - _, _ = h.Write([]byte(dom2)) - if preHash { - _, _ = h.Write([]byte{byte(0x01), byte(len(ctx))}) - } else { - _, _ = h.Write([]byte{byte(0x00), byte(len(ctx))}) - } - _, _ = h.Write(ctx) - } else if preHash { - _, _ = h.Write([]byte(dom2)) - _, _ = h.Write([]byte{0x01, 0x00}) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/modular.go b/backend/vendor/github.com/cloudflare/circl/sign/ed25519/modular.go deleted file mode 100644 index 10efafd..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/modular.go +++ /dev/null @@ -1,175 +0,0 @@ -package ed25519 - -import ( - "encoding/binary" - "math/bits" -) - -var order = [paramB]byte{ - 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, - 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, -} - -// isLessThan returns true if 0 <= x < y, and assumes that slices have the same length. -func isLessThan(x, y []byte) bool { - i := len(x) - 1 - for i > 0 && x[i] == y[i] { - i-- - } - return x[i] < y[i] -} - -// reduceModOrder calculates k = k mod order of the curve. -func reduceModOrder(k []byte, is512Bit bool) { - var X [((2 * paramB) * 8) / 64]uint64 - numWords := len(k) >> 3 - for i := 0; i < numWords; i++ { - X[i] = binary.LittleEndian.Uint64(k[i*8 : (i+1)*8]) - } - red512(&X, is512Bit) - for i := 0; i < numWords; i++ { - binary.LittleEndian.PutUint64(k[i*8:(i+1)*8], X[i]) - } -} - -// red512 calculates x = x mod Order of the curve. -func red512(x *[8]uint64, full bool) { - // Implementation of Algs.(14.47)+(14.52) of Handbook of Applied - // Cryptography, by A. Menezes, P. van Oorschot, and S. Vanstone. - const ( - ell0 = uint64(0x5812631a5cf5d3ed) - ell1 = uint64(0x14def9dea2f79cd6) - ell160 = uint64(0x812631a5cf5d3ed0) - ell161 = uint64(0x4def9dea2f79cd65) - ell162 = uint64(0x0000000000000001) - ) - - var c0, c1, c2, c3 uint64 - r0, r1, r2, r3, r4 := x[0], x[1], x[2], x[3], uint64(0) - - if full { - q0, q1, q2, q3 := x[4], x[5], x[6], x[7] - - for i := 0; i < 3; i++ { - h0, s0 := bits.Mul64(q0, ell160) - h1, s1 := bits.Mul64(q1, ell160) - h2, s2 := bits.Mul64(q2, ell160) - h3, s3 := bits.Mul64(q3, ell160) - - s1, c0 = bits.Add64(h0, s1, 0) - s2, c1 = bits.Add64(h1, s2, c0) - s3, c2 = bits.Add64(h2, s3, c1) - s4, _ := bits.Add64(h3, 0, c2) - - h0, l0 := bits.Mul64(q0, ell161) - h1, l1 := bits.Mul64(q1, ell161) - h2, l2 := bits.Mul64(q2, ell161) - h3, l3 := bits.Mul64(q3, ell161) - - l1, c0 = bits.Add64(h0, l1, 0) - l2, c1 = bits.Add64(h1, l2, c0) - l3, c2 = bits.Add64(h2, l3, c1) - l4, _ := bits.Add64(h3, 0, c2) - - s1, c0 = bits.Add64(s1, l0, 0) - s2, c1 = bits.Add64(s2, l1, c0) - s3, c2 = bits.Add64(s3, l2, c1) - s4, c3 = bits.Add64(s4, l3, c2) - s5, s6 := bits.Add64(l4, 0, c3) - - s2, c0 = bits.Add64(s2, q0, 0) - s3, c1 = bits.Add64(s3, q1, c0) - s4, c2 = bits.Add64(s4, q2, c1) - s5, c3 = bits.Add64(s5, q3, c2) - s6, s7 := bits.Add64(s6, 0, c3) - - q := q0 | q1 | q2 | q3 - m := -((q | -q) >> 63) // if q=0 then m=0...0 else m=1..1 - s0 &= m - s1 &= m - s2 &= m - s3 &= m - q0, q1, q2, q3 = s4, s5, s6, s7 - - if (i+1)%2 == 0 { - r0, c0 = bits.Add64(r0, s0, 0) - r1, c1 = bits.Add64(r1, s1, c0) - r2, c2 = bits.Add64(r2, s2, c1) - r3, c3 = bits.Add64(r3, s3, c2) - r4, _ = bits.Add64(r4, 0, c3) - } else { - r0, c0 = bits.Sub64(r0, s0, 0) - r1, c1 = bits.Sub64(r1, s1, c0) - r2, c2 = bits.Sub64(r2, s2, c1) - r3, c3 = bits.Sub64(r3, s3, c2) - r4, _ = bits.Sub64(r4, 0, c3) - } - } - - m := -(r4 >> 63) - r0, c0 = bits.Add64(r0, m&ell160, 0) - r1, c1 = bits.Add64(r1, m&ell161, c0) - r2, c2 = bits.Add64(r2, m&ell162, c1) - r3, c3 = bits.Add64(r3, 0, c2) - r4, _ = bits.Add64(r4, m&1, c3) - x[4], x[5], x[6], x[7] = 0, 0, 0, 0 - } - - q0 := (r4 << 4) | (r3 >> 60) - r3 &= (uint64(1) << 60) - 1 - - h0, s0 := bits.Mul64(ell0, q0) - h1, s1 := bits.Mul64(ell1, q0) - s1, c0 = bits.Add64(h0, s1, 0) - s2, _ := bits.Add64(h1, 0, c0) - - r0, c0 = bits.Sub64(r0, s0, 0) - r1, c1 = bits.Sub64(r1, s1, c0) - r2, c2 = bits.Sub64(r2, s2, c1) - r3, _ = bits.Sub64(r3, 0, c2) - - x[0], x[1], x[2], x[3] = r0, r1, r2, r3 -} - -// calculateS performs s = r+k*a mod Order of the curve. -func calculateS(s, r, k, a []byte) { - K := [4]uint64{ - binary.LittleEndian.Uint64(k[0*8 : 1*8]), - binary.LittleEndian.Uint64(k[1*8 : 2*8]), - binary.LittleEndian.Uint64(k[2*8 : 3*8]), - binary.LittleEndian.Uint64(k[3*8 : 4*8]), - } - S := [8]uint64{ - binary.LittleEndian.Uint64(r[0*8 : 1*8]), - binary.LittleEndian.Uint64(r[1*8 : 2*8]), - binary.LittleEndian.Uint64(r[2*8 : 3*8]), - binary.LittleEndian.Uint64(r[3*8 : 4*8]), - } - var c3 uint64 - for i := range K { - ai := binary.LittleEndian.Uint64(a[i*8 : (i+1)*8]) - - h0, l0 := bits.Mul64(K[0], ai) - h1, l1 := bits.Mul64(K[1], ai) - h2, l2 := bits.Mul64(K[2], ai) - h3, l3 := bits.Mul64(K[3], ai) - - l1, c0 := bits.Add64(h0, l1, 0) - l2, c1 := bits.Add64(h1, l2, c0) - l3, c2 := bits.Add64(h2, l3, c1) - l4, _ := bits.Add64(h3, 0, c2) - - S[i+0], c0 = bits.Add64(S[i+0], l0, 0) - S[i+1], c1 = bits.Add64(S[i+1], l1, c0) - S[i+2], c2 = bits.Add64(S[i+2], l2, c1) - S[i+3], c3 = bits.Add64(S[i+3], l3, c2) - S[i+4], _ = bits.Add64(S[i+4], l4, c3) - } - red512(&S, true) - binary.LittleEndian.PutUint64(s[0*8:1*8], S[0]) - binary.LittleEndian.PutUint64(s[1*8:2*8], S[1]) - binary.LittleEndian.PutUint64(s[2*8:3*8], S[2]) - binary.LittleEndian.PutUint64(s[3*8:4*8], S[3]) -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/mult.go b/backend/vendor/github.com/cloudflare/circl/sign/ed25519/mult.go deleted file mode 100644 index 3216aae..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/mult.go +++ /dev/null @@ -1,180 +0,0 @@ -package ed25519 - -import ( - "crypto/subtle" - "encoding/binary" - "math/bits" - - "github.com/cloudflare/circl/internal/conv" - "github.com/cloudflare/circl/math" - fp "github.com/cloudflare/circl/math/fp25519" -) - -var paramD = fp.Elt{ - 0xa3, 0x78, 0x59, 0x13, 0xca, 0x4d, 0xeb, 0x75, - 0xab, 0xd8, 0x41, 0x41, 0x4d, 0x0a, 0x70, 0x00, - 0x98, 0xe8, 0x79, 0x77, 0x79, 0x40, 0xc7, 0x8c, - 0x73, 0xfe, 0x6f, 0x2b, 0xee, 0x6c, 0x03, 0x52, -} - -// mLSBRecoding parameters. -const ( - fxT = 257 - fxV = 2 - fxW = 3 - fx2w1 = 1 << (uint(fxW) - 1) - numWords64 = (paramB * 8 / 64) -) - -// mLSBRecoding is the odd-only modified LSB-set. -// -// Reference: -// -// "Efficient and secure algorithms for GLV-based scalar multiplication and -// their implementation on GLV–GLS curves" by (Faz-Hernandez et al.) -// http://doi.org/10.1007/s13389-014-0085-7. -func mLSBRecoding(L []int8, k []byte) { - const ee = (fxT + fxW*fxV - 1) / (fxW * fxV) - const dd = ee * fxV - const ll = dd * fxW - if len(L) == (ll + 1) { - var m [numWords64 + 1]uint64 - for i := 0; i < numWords64; i++ { - m[i] = binary.LittleEndian.Uint64(k[8*i : 8*i+8]) - } - condAddOrderN(&m) - L[dd-1] = 1 - for i := 0; i < dd-1; i++ { - kip1 := (m[(i+1)/64] >> (uint(i+1) % 64)) & 0x1 - L[i] = int8(kip1<<1) - 1 - } - { // right-shift by d - right := uint(dd % 64) - left := uint(64) - right - lim := ((numWords64+1)*64 - dd) / 64 - j := dd / 64 - for i := 0; i < lim; i++ { - m[i] = (m[i+j] >> right) | (m[i+j+1] << left) - } - m[lim] = m[lim+j] >> right - } - for i := dd; i < ll; i++ { - L[i] = L[i%dd] * int8(m[0]&0x1) - div2subY(m[:], int64(L[i]>>1), numWords64) - } - L[ll] = int8(m[0]) - } -} - -// absolute returns always a positive value. -func absolute(x int32) int32 { - mask := x >> 31 - return (x + mask) ^ mask -} - -// condAddOrderN updates x = x+order if x is even, otherwise x remains unchanged. -func condAddOrderN(x *[numWords64 + 1]uint64) { - isOdd := (x[0] & 0x1) - 1 - c := uint64(0) - for i := 0; i < numWords64; i++ { - orderWord := binary.LittleEndian.Uint64(order[8*i : 8*i+8]) - o := isOdd & orderWord - x0, c0 := bits.Add64(x[i], o, c) - x[i] = x0 - c = c0 - } - x[numWords64], _ = bits.Add64(x[numWords64], 0, c) -} - -// div2subY update x = (x/2) - y. -func div2subY(x []uint64, y int64, l int) { - s := uint64(y >> 63) - for i := 0; i < l-1; i++ { - x[i] = (x[i] >> 1) | (x[i+1] << 63) - } - x[l-1] = (x[l-1] >> 1) - - b := uint64(0) - x0, b0 := bits.Sub64(x[0], uint64(y), b) - x[0] = x0 - b = b0 - for i := 1; i < l-1; i++ { - x0, b0 := bits.Sub64(x[i], s, b) - x[i] = x0 - b = b0 - } - x[l-1], _ = bits.Sub64(x[l-1], s, b) -} - -func (P *pointR1) fixedMult(scalar []byte) { - if len(scalar) != paramB { - panic("wrong scalar size") - } - const ee = (fxT + fxW*fxV - 1) / (fxW * fxV) - const dd = ee * fxV - const ll = dd * fxW - - L := make([]int8, ll+1) - mLSBRecoding(L[:], scalar) - S := &pointR3{} - P.SetIdentity() - for ii := ee - 1; ii >= 0; ii-- { - P.double() - for j := 0; j < fxV; j++ { - dig := L[fxW*dd-j*ee+ii-ee] - for i := (fxW-1)*dd - j*ee + ii - ee; i >= (2*dd - j*ee + ii - ee); i = i - dd { - dig = 2*dig + L[i] - } - idx := absolute(int32(dig)) - sig := L[dd-j*ee+ii-ee] - Tabj := &tabSign[fxV-j-1] - for k := 0; k < fx2w1; k++ { - S.cmov(&Tabj[k], subtle.ConstantTimeEq(int32(k), idx)) - } - S.cneg(subtle.ConstantTimeEq(int32(sig), -1)) - P.mixAdd(S) - } - } -} - -const ( - omegaFix = 7 - omegaVar = 5 -) - -// doubleMult returns P=mG+nQ. -func (P *pointR1) doubleMult(Q *pointR1, m, n []byte) { - nafFix := math.OmegaNAF(conv.BytesLe2BigInt(m), omegaFix) - nafVar := math.OmegaNAF(conv.BytesLe2BigInt(n), omegaVar) - - if len(nafFix) > len(nafVar) { - nafVar = append(nafVar, make([]int32, len(nafFix)-len(nafVar))...) - } else if len(nafFix) < len(nafVar) { - nafFix = append(nafFix, make([]int32, len(nafVar)-len(nafFix))...) - } - - var TabQ [1 << (omegaVar - 2)]pointR2 - Q.oddMultiples(TabQ[:]) - P.SetIdentity() - for i := len(nafFix) - 1; i >= 0; i-- { - P.double() - // Generator point - if nafFix[i] != 0 { - idxM := absolute(nafFix[i]) >> 1 - R := tabVerif[idxM] - if nafFix[i] < 0 { - R.neg() - } - P.mixAdd(&R) - } - // Variable input point - if nafVar[i] != 0 { - idxN := absolute(nafVar[i]) >> 1 - S := TabQ[idxN] - if nafVar[i] < 0 { - S.neg() - } - P.add(&S) - } - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/point.go b/backend/vendor/github.com/cloudflare/circl/sign/ed25519/point.go deleted file mode 100644 index d1c3b14..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/point.go +++ /dev/null @@ -1,195 +0,0 @@ -package ed25519 - -import fp "github.com/cloudflare/circl/math/fp25519" - -type ( - pointR1 struct{ x, y, z, ta, tb fp.Elt } - pointR2 struct { - pointR3 - z2 fp.Elt - } -) -type pointR3 struct{ addYX, subYX, dt2 fp.Elt } - -func (P *pointR1) neg() { - fp.Neg(&P.x, &P.x) - fp.Neg(&P.ta, &P.ta) -} - -func (P *pointR1) SetIdentity() { - P.x = fp.Elt{} - fp.SetOne(&P.y) - fp.SetOne(&P.z) - P.ta = fp.Elt{} - P.tb = fp.Elt{} -} - -func (P *pointR1) toAffine() { - fp.Inv(&P.z, &P.z) - fp.Mul(&P.x, &P.x, &P.z) - fp.Mul(&P.y, &P.y, &P.z) - fp.Modp(&P.x) - fp.Modp(&P.y) - fp.SetOne(&P.z) - P.ta = P.x - P.tb = P.y -} - -func (P *pointR1) ToBytes(k []byte) error { - P.toAffine() - var x [fp.Size]byte - err := fp.ToBytes(k[:fp.Size], &P.y) - if err != nil { - return err - } - err = fp.ToBytes(x[:], &P.x) - if err != nil { - return err - } - b := x[0] & 1 - k[paramB-1] = k[paramB-1] | (b << 7) - return nil -} - -func (P *pointR1) FromBytes(k []byte) bool { - if len(k) != paramB { - panic("wrong size") - } - signX := k[paramB-1] >> 7 - copy(P.y[:], k[:fp.Size]) - P.y[fp.Size-1] &= 0x7F - p := fp.P() - if !isLessThan(P.y[:], p[:]) { - return false - } - - one, u, v := &fp.Elt{}, &fp.Elt{}, &fp.Elt{} - fp.SetOne(one) - fp.Sqr(u, &P.y) // u = y^2 - fp.Mul(v, u, ¶mD) // v = dy^2 - fp.Sub(u, u, one) // u = y^2-1 - fp.Add(v, v, one) // v = dy^2+1 - isQR := fp.InvSqrt(&P.x, u, v) // x = sqrt(u/v) - if !isQR { - return false - } - fp.Modp(&P.x) // x = x mod p - if fp.IsZero(&P.x) && signX == 1 { - return false - } - if signX != (P.x[0] & 1) { - fp.Neg(&P.x, &P.x) - } - P.ta = P.x - P.tb = P.y - fp.SetOne(&P.z) - return true -} - -// double calculates 2P for curves with A=-1. -func (P *pointR1) double() { - Px, Py, Pz, Pta, Ptb := &P.x, &P.y, &P.z, &P.ta, &P.tb - a, b, c, e, f, g, h := Px, Py, Pz, Pta, Px, Py, Ptb - fp.Add(e, Px, Py) // x+y - fp.Sqr(a, Px) // A = x^2 - fp.Sqr(b, Py) // B = y^2 - fp.Sqr(c, Pz) // z^2 - fp.Add(c, c, c) // C = 2*z^2 - fp.Add(h, a, b) // H = A+B - fp.Sqr(e, e) // (x+y)^2 - fp.Sub(e, e, h) // E = (x+y)^2-A-B - fp.Sub(g, b, a) // G = B-A - fp.Sub(f, c, g) // F = C-G - fp.Mul(Pz, f, g) // Z = F * G - fp.Mul(Px, e, f) // X = E * F - fp.Mul(Py, g, h) // Y = G * H, T = E * H -} - -func (P *pointR1) mixAdd(Q *pointR3) { - fp.Add(&P.z, &P.z, &P.z) // D = 2*z1 - P.coreAddition(Q) -} - -func (P *pointR1) add(Q *pointR2) { - fp.Mul(&P.z, &P.z, &Q.z2) // D = 2*z1*z2 - P.coreAddition(&Q.pointR3) -} - -// coreAddition calculates P=P+Q for curves with A=-1. -func (P *pointR1) coreAddition(Q *pointR3) { - Px, Py, Pz, Pta, Ptb := &P.x, &P.y, &P.z, &P.ta, &P.tb - addYX2, subYX2, dt2 := &Q.addYX, &Q.subYX, &Q.dt2 - a, b, c, d, e, f, g, h := Px, Py, &fp.Elt{}, Pz, Pta, Px, Py, Ptb - fp.Mul(c, Pta, Ptb) // t1 = ta*tb - fp.Sub(h, Py, Px) // y1-x1 - fp.Add(b, Py, Px) // y1+x1 - fp.Mul(a, h, subYX2) // A = (y1-x1)*(y2-x2) - fp.Mul(b, b, addYX2) // B = (y1+x1)*(y2+x2) - fp.Mul(c, c, dt2) // C = 2*D*t1*t2 - fp.Sub(e, b, a) // E = B-A - fp.Add(h, b, a) // H = B+A - fp.Sub(f, d, c) // F = D-C - fp.Add(g, d, c) // G = D+C - fp.Mul(Pz, f, g) // Z = F * G - fp.Mul(Px, e, f) // X = E * F - fp.Mul(Py, g, h) // Y = G * H, T = E * H -} - -func (P *pointR1) oddMultiples(T []pointR2) { - var R pointR2 - n := len(T) - T[0].fromR1(P) - _2P := *P - _2P.double() - R.fromR1(&_2P) - for i := 1; i < n; i++ { - P.add(&R) - T[i].fromR1(P) - } -} - -func (P *pointR1) isEqual(Q *pointR1) bool { - l, r := &fp.Elt{}, &fp.Elt{} - fp.Mul(l, &P.x, &Q.z) - fp.Mul(r, &Q.x, &P.z) - fp.Sub(l, l, r) - b := fp.IsZero(l) - fp.Mul(l, &P.y, &Q.z) - fp.Mul(r, &Q.y, &P.z) - fp.Sub(l, l, r) - b = b && fp.IsZero(l) - fp.Mul(l, &P.ta, &P.tb) - fp.Mul(l, l, &Q.z) - fp.Mul(r, &Q.ta, &Q.tb) - fp.Mul(r, r, &P.z) - fp.Sub(l, l, r) - b = b && fp.IsZero(l) - return b && !fp.IsZero(&P.z) && !fp.IsZero(&Q.z) -} - -func (P *pointR3) neg() { - P.addYX, P.subYX = P.subYX, P.addYX - fp.Neg(&P.dt2, &P.dt2) -} - -func (P *pointR2) fromR1(Q *pointR1) { - fp.Add(&P.addYX, &Q.y, &Q.x) - fp.Sub(&P.subYX, &Q.y, &Q.x) - fp.Mul(&P.dt2, &Q.ta, &Q.tb) - fp.Mul(&P.dt2, &P.dt2, ¶mD) - fp.Add(&P.dt2, &P.dt2, &P.dt2) - fp.Add(&P.z2, &Q.z, &Q.z) -} - -func (P *pointR3) cneg(b int) { - t := &fp.Elt{} - fp.Cswap(&P.addYX, &P.subYX, uint(b)) - fp.Neg(t, &P.dt2) - fp.Cmov(&P.dt2, t, uint(b)) -} - -func (P *pointR3) cmov(Q *pointR3, b int) { - fp.Cmov(&P.addYX, &Q.addYX, uint(b)) - fp.Cmov(&P.subYX, &Q.subYX, uint(b)) - fp.Cmov(&P.dt2, &Q.dt2, uint(b)) -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey.go b/backend/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey.go deleted file mode 100644 index c3505b6..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey.go +++ /dev/null @@ -1,9 +0,0 @@ -//go:build go1.13 -// +build go1.13 - -package ed25519 - -import cryptoEd25519 "crypto/ed25519" - -// PublicKey is the type of Ed25519 public keys. -type PublicKey cryptoEd25519.PublicKey diff --git a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey112.go b/backend/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey112.go deleted file mode 100644 index d57d86e..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/pubkey112.go +++ /dev/null @@ -1,7 +0,0 @@ -//go:build !go1.13 -// +build !go1.13 - -package ed25519 - -// PublicKey is the type of Ed25519 public keys. -type PublicKey []byte diff --git a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/signapi.go b/backend/vendor/github.com/cloudflare/circl/sign/ed25519/signapi.go deleted file mode 100644 index e4520f5..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/signapi.go +++ /dev/null @@ -1,87 +0,0 @@ -package ed25519 - -import ( - "crypto/rand" - "encoding/asn1" - - "github.com/cloudflare/circl/sign" -) - -var sch sign.Scheme = &scheme{} - -// Scheme returns a signature interface. -func Scheme() sign.Scheme { return sch } - -type scheme struct{} - -func (*scheme) Name() string { return "Ed25519" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SignatureSize() int { return SignatureSize } -func (*scheme) SeedSize() int { return SeedSize } -func (*scheme) TLSIdentifier() uint { return 0x0807 } -func (*scheme) SupportsContext() bool { return false } -func (*scheme) Oid() asn1.ObjectIdentifier { - return asn1.ObjectIdentifier{1, 3, 101, 112} -} - -func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) { - return GenerateKey(rand.Reader) -} - -func (*scheme) Sign( - sk sign.PrivateKey, - message []byte, - opts *sign.SignatureOpts, -) []byte { - priv, ok := sk.(PrivateKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - return Sign(priv, message) -} - -func (*scheme) Verify( - pk sign.PublicKey, - message, signature []byte, - opts *sign.SignatureOpts, -) bool { - pub, ok := pk.(PublicKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil { - if opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - } - return Verify(pub, message, signature) -} - -func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) { - privateKey := NewKeyFromSeed(seed) - publicKey := make(PublicKey, PublicKeySize) - copy(publicKey, privateKey[SeedSize:]) - return publicKey, privateKey -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) { - if len(buf) < PublicKeySize { - return nil, sign.ErrPubKeySize - } - pub := make(PublicKey, PublicKeySize) - copy(pub, buf[:PublicKeySize]) - return pub, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) { - if len(buf) < PrivateKeySize { - return nil, sign.ErrPrivKeySize - } - priv := make(PrivateKey, PrivateKeySize) - copy(priv, buf[:PrivateKeySize]) - return priv, nil -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/tables.go b/backend/vendor/github.com/cloudflare/circl/sign/ed25519/tables.go deleted file mode 100644 index 8763b42..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/ed25519/tables.go +++ /dev/null @@ -1,213 +0,0 @@ -package ed25519 - -import fp "github.com/cloudflare/circl/math/fp25519" - -var tabSign = [fxV][fx2w1]pointR3{ - { - pointR3{ - addYX: fp.Elt{0x85, 0x3b, 0x8c, 0xf5, 0xc6, 0x93, 0xbc, 0x2f, 0x19, 0x0e, 0x8c, 0xfb, 0xc6, 0x2d, 0x93, 0xcf, 0xc2, 0x42, 0x3d, 0x64, 0x98, 0x48, 0x0b, 0x27, 0x65, 0xba, 0xd4, 0x33, 0x3a, 0x9d, 0xcf, 0x07}, - subYX: fp.Elt{0x3e, 0x91, 0x40, 0xd7, 0x05, 0x39, 0x10, 0x9d, 0xb3, 0xbe, 0x40, 0xd1, 0x05, 0x9f, 0x39, 0xfd, 0x09, 0x8a, 0x8f, 0x68, 0x34, 0x84, 0xc1, 0xa5, 0x67, 0x12, 0xf8, 0x98, 0x92, 0x2f, 0xfd, 0x44}, - dt2: fp.Elt{0x68, 0xaa, 0x7a, 0x87, 0x05, 0x12, 0xc9, 0xab, 0x9e, 0xc4, 0xaa, 0xcc, 0x23, 0xe8, 0xd9, 0x26, 0x8c, 0x59, 0x43, 0xdd, 0xcb, 0x7d, 0x1b, 0x5a, 0xa8, 0x65, 0x0c, 0x9f, 0x68, 0x7b, 0x11, 0x6f}, - }, - { - addYX: fp.Elt{0x7c, 0xb0, 0x9e, 0xe6, 0xc5, 0xbf, 0xfa, 0x13, 0x8e, 0x0d, 0x22, 0xde, 0xc8, 0xd1, 0xce, 0x52, 0x02, 0xd5, 0x62, 0x31, 0x71, 0x0e, 0x8e, 0x9d, 0xb0, 0xd6, 0x00, 0xa5, 0x5a, 0x0e, 0xce, 0x72}, - subYX: fp.Elt{0x1a, 0x8e, 0x5c, 0xdc, 0xa4, 0xb3, 0x6c, 0x51, 0x18, 0xa0, 0x09, 0x80, 0x9a, 0x46, 0x33, 0xd5, 0xe0, 0x3c, 0x4d, 0x3b, 0xfc, 0x49, 0xa2, 0x43, 0x29, 0xe1, 0x29, 0xa9, 0x93, 0xea, 0x7c, 0x35}, - dt2: fp.Elt{0x08, 0x46, 0x6f, 0x68, 0x7f, 0x0b, 0x7c, 0x9e, 0xad, 0xba, 0x07, 0x61, 0x74, 0x83, 0x2f, 0xfc, 0x26, 0xd6, 0x09, 0xb9, 0x00, 0x34, 0x36, 0x4f, 0x01, 0xf3, 0x48, 0xdb, 0x43, 0xba, 0x04, 0x44}, - }, - { - addYX: fp.Elt{0x4c, 0xda, 0x0d, 0x13, 0x66, 0xfd, 0x82, 0x84, 0x9f, 0x75, 0x5b, 0xa2, 0x17, 0xfe, 0x34, 0xbf, 0x1f, 0xcb, 0xba, 0x90, 0x55, 0x80, 0x83, 0xfd, 0x63, 0xb9, 0x18, 0xf8, 0x5b, 0x5d, 0x94, 0x1e}, - subYX: fp.Elt{0xb9, 0xdb, 0x6c, 0x04, 0x88, 0x22, 0xd8, 0x79, 0x83, 0x2f, 0x8d, 0x65, 0x6b, 0xd2, 0xab, 0x1b, 0xdd, 0x65, 0xe5, 0x93, 0x63, 0xf8, 0xa2, 0xd8, 0x3c, 0xf1, 0x4b, 0xc5, 0x99, 0xd1, 0xf2, 0x12}, - dt2: fp.Elt{0x05, 0x4c, 0xb8, 0x3b, 0xfe, 0xf5, 0x9f, 0x2e, 0xd1, 0xb2, 0xb8, 0xff, 0xfe, 0x6d, 0xd9, 0x37, 0xe0, 0xae, 0xb4, 0x5a, 0x51, 0x80, 0x7e, 0x9b, 0x1d, 0xd1, 0x8d, 0x8c, 0x56, 0xb1, 0x84, 0x35}, - }, - { - addYX: fp.Elt{0x39, 0x71, 0x43, 0x34, 0xe3, 0x42, 0x45, 0xa1, 0xf2, 0x68, 0x71, 0xa7, 0xe8, 0x23, 0xfd, 0x9f, 0x86, 0x48, 0xff, 0xe5, 0x96, 0x74, 0xcf, 0x05, 0x49, 0xe2, 0xb3, 0x6c, 0x17, 0x77, 0x2f, 0x6d}, - subYX: fp.Elt{0x73, 0x3f, 0xc1, 0xc7, 0x6a, 0x66, 0xa1, 0x20, 0xdd, 0x11, 0xfb, 0x7a, 0x6e, 0xa8, 0x51, 0xb8, 0x3f, 0x9d, 0xa2, 0x97, 0x84, 0xb5, 0xc7, 0x90, 0x7c, 0xab, 0x48, 0xd6, 0x84, 0xa3, 0xd5, 0x1a}, - dt2: fp.Elt{0x63, 0x27, 0x3c, 0x49, 0x4b, 0xfc, 0x22, 0xf2, 0x0b, 0x50, 0xc2, 0x0f, 0xb4, 0x1f, 0x31, 0x0c, 0x2f, 0x53, 0xab, 0xaa, 0x75, 0x6f, 0xe0, 0x69, 0x39, 0x56, 0xe0, 0x3b, 0xb7, 0xa8, 0xbf, 0x45}, - }, - }, - { - { - addYX: fp.Elt{0x00, 0x45, 0xd9, 0x0d, 0x58, 0x03, 0xfc, 0x29, 0x93, 0xec, 0xbb, 0x6f, 0xa4, 0x7a, 0xd2, 0xec, 0xf8, 0xa7, 0xe2, 0xc2, 0x5f, 0x15, 0x0a, 0x13, 0xd5, 0xa1, 0x06, 0xb7, 0x1a, 0x15, 0x6b, 0x41}, - subYX: fp.Elt{0x85, 0x8c, 0xb2, 0x17, 0xd6, 0x3b, 0x0a, 0xd3, 0xea, 0x3b, 0x77, 0x39, 0xb7, 0x77, 0xd3, 0xc5, 0xbf, 0x5c, 0x6a, 0x1e, 0x8c, 0xe7, 0xc6, 0xc6, 0xc4, 0xb7, 0x2a, 0x8b, 0xf7, 0xb8, 0x61, 0x0d}, - dt2: fp.Elt{0xb0, 0x36, 0xc1, 0xe9, 0xef, 0xd7, 0xa8, 0x56, 0x20, 0x4b, 0xe4, 0x58, 0xcd, 0xe5, 0x07, 0xbd, 0xab, 0xe0, 0x57, 0x1b, 0xda, 0x2f, 0xe6, 0xaf, 0xd2, 0xe8, 0x77, 0x42, 0xf7, 0x2a, 0x1a, 0x19}, - }, - { - addYX: fp.Elt{0x6a, 0x6d, 0x6d, 0xd1, 0xfa, 0xf5, 0x03, 0x30, 0xbd, 0x6d, 0xc2, 0xc8, 0xf5, 0x38, 0x80, 0x4f, 0xb2, 0xbe, 0xa1, 0x76, 0x50, 0x1a, 0x73, 0xf2, 0x78, 0x2b, 0x8e, 0x3a, 0x1e, 0x34, 0x47, 0x7b}, - subYX: fp.Elt{0xc3, 0x2c, 0x36, 0xdc, 0xc5, 0x45, 0xbc, 0xef, 0x1b, 0x64, 0xd6, 0x65, 0x28, 0xe9, 0xda, 0x84, 0x13, 0xbe, 0x27, 0x8e, 0x3f, 0x98, 0x2a, 0x37, 0xee, 0x78, 0x97, 0xd6, 0xc0, 0x6f, 0xb4, 0x53}, - dt2: fp.Elt{0x58, 0x5d, 0xa7, 0xa3, 0x68, 0xbb, 0x20, 0x30, 0x2e, 0x03, 0xe9, 0xb1, 0xd4, 0x90, 0x72, 0xe3, 0x71, 0xb2, 0x36, 0x3e, 0x73, 0xa0, 0x2e, 0x3d, 0xd1, 0x85, 0x33, 0x62, 0x4e, 0xa7, 0x7b, 0x31}, - }, - { - addYX: fp.Elt{0xbf, 0xc4, 0x38, 0x53, 0xfb, 0x68, 0xa9, 0x77, 0xce, 0x55, 0xf9, 0x05, 0xcb, 0xeb, 0xfb, 0x8c, 0x46, 0xc2, 0x32, 0x7c, 0xf0, 0xdb, 0xd7, 0x2c, 0x62, 0x8e, 0xdd, 0x54, 0x75, 0xcf, 0x3f, 0x33}, - subYX: fp.Elt{0x49, 0x50, 0x1f, 0x4e, 0x6e, 0x55, 0x55, 0xde, 0x8c, 0x4e, 0x77, 0x96, 0x38, 0x3b, 0xfe, 0xb6, 0x43, 0x3c, 0x86, 0x69, 0xc2, 0x72, 0x66, 0x1f, 0x6b, 0xf9, 0x87, 0xbc, 0x4f, 0x37, 0x3e, 0x3c}, - dt2: fp.Elt{0xd2, 0x2f, 0x06, 0x6b, 0x08, 0x07, 0x69, 0x77, 0xc0, 0x94, 0xcc, 0xae, 0x43, 0x00, 0x59, 0x6e, 0xa3, 0x63, 0xa8, 0xdd, 0xfa, 0x24, 0x18, 0xd0, 0x35, 0xc7, 0x78, 0xf7, 0x0d, 0xd4, 0x5a, 0x1e}, - }, - { - addYX: fp.Elt{0x45, 0xc1, 0x17, 0x51, 0xf8, 0xed, 0x7e, 0xc7, 0xa9, 0x1a, 0x11, 0x6e, 0x2d, 0xef, 0x0b, 0xd5, 0x3f, 0x98, 0xb0, 0xa3, 0x9d, 0x65, 0xf1, 0xcd, 0x53, 0x4a, 0x8a, 0x18, 0x70, 0x0a, 0x7f, 0x23}, - subYX: fp.Elt{0xdd, 0xef, 0xbe, 0x3a, 0x31, 0xe0, 0xbc, 0xbe, 0x6d, 0x5d, 0x79, 0x87, 0xd6, 0xbe, 0x68, 0xe3, 0x59, 0x76, 0x8c, 0x86, 0x0e, 0x7a, 0x92, 0x13, 0x14, 0x8f, 0x67, 0xb3, 0xcb, 0x1a, 0x76, 0x76}, - dt2: fp.Elt{0x56, 0x7a, 0x1c, 0x9d, 0xca, 0x96, 0xf9, 0xf9, 0x03, 0x21, 0xd4, 0xe8, 0xb3, 0xd5, 0xe9, 0x52, 0xc8, 0x54, 0x1e, 0x1b, 0x13, 0xb6, 0xfd, 0x47, 0x7d, 0x02, 0x32, 0x33, 0x27, 0xe2, 0x1f, 0x19}, - }, - }, -} - -var tabVerif = [1 << (omegaFix - 2)]pointR3{ - { /* 1P */ - addYX: fp.Elt{0x85, 0x3b, 0x8c, 0xf5, 0xc6, 0x93, 0xbc, 0x2f, 0x19, 0x0e, 0x8c, 0xfb, 0xc6, 0x2d, 0x93, 0xcf, 0xc2, 0x42, 0x3d, 0x64, 0x98, 0x48, 0x0b, 0x27, 0x65, 0xba, 0xd4, 0x33, 0x3a, 0x9d, 0xcf, 0x07}, - subYX: fp.Elt{0x3e, 0x91, 0x40, 0xd7, 0x05, 0x39, 0x10, 0x9d, 0xb3, 0xbe, 0x40, 0xd1, 0x05, 0x9f, 0x39, 0xfd, 0x09, 0x8a, 0x8f, 0x68, 0x34, 0x84, 0xc1, 0xa5, 0x67, 0x12, 0xf8, 0x98, 0x92, 0x2f, 0xfd, 0x44}, - dt2: fp.Elt{0x68, 0xaa, 0x7a, 0x87, 0x05, 0x12, 0xc9, 0xab, 0x9e, 0xc4, 0xaa, 0xcc, 0x23, 0xe8, 0xd9, 0x26, 0x8c, 0x59, 0x43, 0xdd, 0xcb, 0x7d, 0x1b, 0x5a, 0xa8, 0x65, 0x0c, 0x9f, 0x68, 0x7b, 0x11, 0x6f}, - }, - { /* 3P */ - addYX: fp.Elt{0x30, 0x97, 0xee, 0x4c, 0xa8, 0xb0, 0x25, 0xaf, 0x8a, 0x4b, 0x86, 0xe8, 0x30, 0x84, 0x5a, 0x02, 0x32, 0x67, 0x01, 0x9f, 0x02, 0x50, 0x1b, 0xc1, 0xf4, 0xf8, 0x80, 0x9a, 0x1b, 0x4e, 0x16, 0x7a}, - subYX: fp.Elt{0x65, 0xd2, 0xfc, 0xa4, 0xe8, 0x1f, 0x61, 0x56, 0x7d, 0xba, 0xc1, 0xe5, 0xfd, 0x53, 0xd3, 0x3b, 0xbd, 0xd6, 0x4b, 0x21, 0x1a, 0xf3, 0x31, 0x81, 0x62, 0xda, 0x5b, 0x55, 0x87, 0x15, 0xb9, 0x2a}, - dt2: fp.Elt{0x89, 0xd8, 0xd0, 0x0d, 0x3f, 0x93, 0xae, 0x14, 0x62, 0xda, 0x35, 0x1c, 0x22, 0x23, 0x94, 0x58, 0x4c, 0xdb, 0xf2, 0x8c, 0x45, 0xe5, 0x70, 0xd1, 0xc6, 0xb4, 0xb9, 0x12, 0xaf, 0x26, 0x28, 0x5a}, - }, - { /* 5P */ - addYX: fp.Elt{0x33, 0xbb, 0xa5, 0x08, 0x44, 0xbc, 0x12, 0xa2, 0x02, 0xed, 0x5e, 0xc7, 0xc3, 0x48, 0x50, 0x8d, 0x44, 0xec, 0xbf, 0x5a, 0x0c, 0xeb, 0x1b, 0xdd, 0xeb, 0x06, 0xe2, 0x46, 0xf1, 0xcc, 0x45, 0x29}, - subYX: fp.Elt{0xba, 0xd6, 0x47, 0xa4, 0xc3, 0x82, 0x91, 0x7f, 0xb7, 0x29, 0x27, 0x4b, 0xd1, 0x14, 0x00, 0xd5, 0x87, 0xa0, 0x64, 0xb8, 0x1c, 0xf1, 0x3c, 0xe3, 0xf3, 0x55, 0x1b, 0xeb, 0x73, 0x7e, 0x4a, 0x15}, - dt2: fp.Elt{0x85, 0x82, 0x2a, 0x81, 0xf1, 0xdb, 0xbb, 0xbc, 0xfc, 0xd1, 0xbd, 0xd0, 0x07, 0x08, 0x0e, 0x27, 0x2d, 0xa7, 0xbd, 0x1b, 0x0b, 0x67, 0x1b, 0xb4, 0x9a, 0xb6, 0x3b, 0x6b, 0x69, 0xbe, 0xaa, 0x43}, - }, - { /* 7P */ - addYX: fp.Elt{0xbf, 0xa3, 0x4e, 0x94, 0xd0, 0x5c, 0x1a, 0x6b, 0xd2, 0xc0, 0x9d, 0xb3, 0x3a, 0x35, 0x70, 0x74, 0x49, 0x2e, 0x54, 0x28, 0x82, 0x52, 0xb2, 0x71, 0x7e, 0x92, 0x3c, 0x28, 0x69, 0xea, 0x1b, 0x46}, - subYX: fp.Elt{0xb1, 0x21, 0x32, 0xaa, 0x9a, 0x2c, 0x6f, 0xba, 0xa7, 0x23, 0xba, 0x3b, 0x53, 0x21, 0xa0, 0x6c, 0x3a, 0x2c, 0x19, 0x92, 0x4f, 0x76, 0xea, 0x9d, 0xe0, 0x17, 0x53, 0x2e, 0x5d, 0xdd, 0x6e, 0x1d}, - dt2: fp.Elt{0xa2, 0xb3, 0xb8, 0x01, 0xc8, 0x6d, 0x83, 0xf1, 0x9a, 0xa4, 0x3e, 0x05, 0x47, 0x5f, 0x03, 0xb3, 0xf3, 0xad, 0x77, 0x58, 0xba, 0x41, 0x9c, 0x52, 0xa7, 0x90, 0x0f, 0x6a, 0x1c, 0xbb, 0x9f, 0x7a}, - }, - { /* 9P */ - addYX: fp.Elt{0x2f, 0x63, 0xa8, 0xa6, 0x8a, 0x67, 0x2e, 0x9b, 0xc5, 0x46, 0xbc, 0x51, 0x6f, 0x9e, 0x50, 0xa6, 0xb5, 0xf5, 0x86, 0xc6, 0xc9, 0x33, 0xb2, 0xce, 0x59, 0x7f, 0xdd, 0x8a, 0x33, 0xed, 0xb9, 0x34}, - subYX: fp.Elt{0x64, 0x80, 0x9d, 0x03, 0x7e, 0x21, 0x6e, 0xf3, 0x9b, 0x41, 0x20, 0xf5, 0xb6, 0x81, 0xa0, 0x98, 0x44, 0xb0, 0x5e, 0xe7, 0x08, 0xc6, 0xcb, 0x96, 0x8f, 0x9c, 0xdc, 0xfa, 0x51, 0x5a, 0xc0, 0x49}, - dt2: fp.Elt{0x1b, 0xaf, 0x45, 0x90, 0xbf, 0xe8, 0xb4, 0x06, 0x2f, 0xd2, 0x19, 0xa7, 0xe8, 0x83, 0xff, 0xe2, 0x16, 0xcf, 0xd4, 0x93, 0x29, 0xfc, 0xf6, 0xaa, 0x06, 0x8b, 0x00, 0x1b, 0x02, 0x72, 0xc1, 0x73}, - }, - { /* 11P */ - addYX: fp.Elt{0xde, 0x2a, 0x80, 0x8a, 0x84, 0x00, 0xbf, 0x2f, 0x27, 0x2e, 0x30, 0x02, 0xcf, 0xfe, 0xd9, 0xe5, 0x06, 0x34, 0x70, 0x17, 0x71, 0x84, 0x3e, 0x11, 0xaf, 0x8f, 0x6d, 0x54, 0xe2, 0xaa, 0x75, 0x42}, - subYX: fp.Elt{0x48, 0x43, 0x86, 0x49, 0x02, 0x5b, 0x5f, 0x31, 0x81, 0x83, 0x08, 0x77, 0x69, 0xb3, 0xd6, 0x3e, 0x95, 0xeb, 0x8d, 0x6a, 0x55, 0x75, 0xa0, 0xa3, 0x7f, 0xc7, 0xd5, 0x29, 0x80, 0x59, 0xab, 0x18}, - dt2: fp.Elt{0xe9, 0x89, 0x60, 0xfd, 0xc5, 0x2c, 0x2b, 0xd8, 0xa4, 0xe4, 0x82, 0x32, 0xa1, 0xb4, 0x1e, 0x03, 0x22, 0x86, 0x1a, 0xb5, 0x99, 0x11, 0x31, 0x44, 0x48, 0xf9, 0x3d, 0xb5, 0x22, 0x55, 0xc6, 0x3d}, - }, - { /* 13P */ - addYX: fp.Elt{0x6d, 0x7f, 0x00, 0xa2, 0x22, 0xc2, 0x70, 0xbf, 0xdb, 0xde, 0xbc, 0xb5, 0x9a, 0xb3, 0x84, 0xbf, 0x07, 0xba, 0x07, 0xfb, 0x12, 0x0e, 0x7a, 0x53, 0x41, 0xf2, 0x46, 0xc3, 0xee, 0xd7, 0x4f, 0x23}, - subYX: fp.Elt{0x93, 0xbf, 0x7f, 0x32, 0x3b, 0x01, 0x6f, 0x50, 0x6b, 0x6f, 0x77, 0x9b, 0xc9, 0xeb, 0xfc, 0xae, 0x68, 0x59, 0xad, 0xaa, 0x32, 0xb2, 0x12, 0x9d, 0xa7, 0x24, 0x60, 0x17, 0x2d, 0x88, 0x67, 0x02}, - dt2: fp.Elt{0x78, 0xa3, 0x2e, 0x73, 0x19, 0xa1, 0x60, 0x53, 0x71, 0xd4, 0x8d, 0xdf, 0xb1, 0xe6, 0x37, 0x24, 0x33, 0xe5, 0xa7, 0x91, 0xf8, 0x37, 0xef, 0xa2, 0x63, 0x78, 0x09, 0xaa, 0xfd, 0xa6, 0x7b, 0x49}, - }, - { /* 15P */ - addYX: fp.Elt{0xa0, 0xea, 0xcf, 0x13, 0x03, 0xcc, 0xce, 0x24, 0x6d, 0x24, 0x9c, 0x18, 0x8d, 0xc2, 0x48, 0x86, 0xd0, 0xd4, 0xf2, 0xc1, 0xfa, 0xbd, 0xbd, 0x2d, 0x2b, 0xe7, 0x2d, 0xf1, 0x17, 0x29, 0xe2, 0x61}, - subYX: fp.Elt{0x0b, 0xcf, 0x8c, 0x46, 0x86, 0xcd, 0x0b, 0x04, 0xd6, 0x10, 0x99, 0x2a, 0xa4, 0x9b, 0x82, 0xd3, 0x92, 0x51, 0xb2, 0x07, 0x08, 0x30, 0x08, 0x75, 0xbf, 0x5e, 0xd0, 0x18, 0x42, 0xcd, 0xb5, 0x43}, - dt2: fp.Elt{0x16, 0xb5, 0xd0, 0x9b, 0x2f, 0x76, 0x9a, 0x5d, 0xee, 0xde, 0x3f, 0x37, 0x4e, 0xaf, 0x38, 0xeb, 0x70, 0x42, 0xd6, 0x93, 0x7d, 0x5a, 0x2e, 0x03, 0x42, 0xd8, 0xe4, 0x0a, 0x21, 0x61, 0x1d, 0x51}, - }, - { /* 17P */ - addYX: fp.Elt{0x81, 0x9d, 0x0e, 0x95, 0xef, 0x76, 0xc6, 0x92, 0x4f, 0x04, 0xd7, 0xc0, 0xcd, 0x20, 0x46, 0xa5, 0x48, 0x12, 0x8f, 0x6f, 0x64, 0x36, 0x9b, 0xaa, 0xe3, 0x55, 0xb8, 0xdd, 0x24, 0x59, 0x32, 0x6d}, - subYX: fp.Elt{0x87, 0xde, 0x20, 0x44, 0x48, 0x86, 0x13, 0x08, 0xb4, 0xed, 0x92, 0xb5, 0x16, 0xf0, 0x1c, 0x8a, 0x25, 0x2d, 0x94, 0x29, 0x27, 0x4e, 0xfa, 0x39, 0x10, 0x28, 0x48, 0xe2, 0x6f, 0xfe, 0xa7, 0x71}, - dt2: fp.Elt{0x54, 0xc8, 0xc8, 0xa5, 0xb8, 0x82, 0x71, 0x6c, 0x03, 0x2a, 0x5f, 0xfe, 0x79, 0x14, 0xfd, 0x33, 0x0c, 0x8d, 0x77, 0x83, 0x18, 0x59, 0xcf, 0x72, 0xa9, 0xea, 0x9e, 0x55, 0xb6, 0xc4, 0x46, 0x47}, - }, - { /* 19P */ - addYX: fp.Elt{0x2b, 0x9a, 0xc6, 0x6d, 0x3c, 0x7b, 0x77, 0xd3, 0x17, 0xf6, 0x89, 0x6f, 0x27, 0xb2, 0xfa, 0xde, 0xb5, 0x16, 0x3a, 0xb5, 0xf7, 0x1c, 0x65, 0x45, 0xb7, 0x9f, 0xfe, 0x34, 0xde, 0x51, 0x9a, 0x5c}, - subYX: fp.Elt{0x47, 0x11, 0x74, 0x64, 0xc8, 0x46, 0x85, 0x34, 0x49, 0xc8, 0xfc, 0x0e, 0xdd, 0xae, 0x35, 0x7d, 0x32, 0xa3, 0x72, 0x06, 0x76, 0x9a, 0x93, 0xff, 0xd6, 0xe6, 0xb5, 0x7d, 0x49, 0x63, 0x96, 0x21}, - dt2: fp.Elt{0x67, 0x0e, 0xf1, 0x79, 0xcf, 0xf1, 0x10, 0xf5, 0x5b, 0x51, 0x58, 0xe6, 0xa1, 0xda, 0xdd, 0xff, 0x77, 0x22, 0x14, 0x10, 0x17, 0xa7, 0xc3, 0x09, 0xbb, 0x23, 0x82, 0x60, 0x3c, 0x50, 0x04, 0x48}, - }, - { /* 21P */ - addYX: fp.Elt{0xc7, 0x7f, 0xa3, 0x2c, 0xd0, 0x9e, 0x24, 0xc4, 0xab, 0xac, 0x15, 0xa6, 0xe3, 0xa0, 0x59, 0xa0, 0x23, 0x0e, 0x6e, 0xc9, 0xd7, 0x6e, 0xa9, 0x88, 0x6d, 0x69, 0x50, 0x16, 0xa5, 0x98, 0x33, 0x55}, - subYX: fp.Elt{0x75, 0xd1, 0x36, 0x3a, 0xd2, 0x21, 0x68, 0x3b, 0x32, 0x9e, 0x9b, 0xe9, 0xa7, 0x0a, 0xb4, 0xbb, 0x47, 0x8a, 0x83, 0x20, 0xe4, 0x5c, 0x9e, 0x5d, 0x5e, 0x4c, 0xde, 0x58, 0x88, 0x09, 0x1e, 0x77}, - dt2: fp.Elt{0xdf, 0x1e, 0x45, 0x78, 0xd2, 0xf5, 0x12, 0x9a, 0xcb, 0x9c, 0x89, 0x85, 0x79, 0x5d, 0xda, 0x3a, 0x08, 0x95, 0xa5, 0x9f, 0x2d, 0x4a, 0x7f, 0x47, 0x11, 0xa6, 0xf5, 0x8f, 0xd6, 0xd1, 0x5e, 0x5a}, - }, - { /* 23P */ - addYX: fp.Elt{0x83, 0x0e, 0x15, 0xfe, 0x2a, 0x12, 0x95, 0x11, 0xd8, 0x35, 0x4b, 0x7e, 0x25, 0x9a, 0x20, 0xcf, 0x20, 0x1e, 0x71, 0x1e, 0x29, 0xf8, 0x87, 0x73, 0xf0, 0x92, 0xbf, 0xd8, 0x97, 0xb8, 0xac, 0x44}, - subYX: fp.Elt{0x59, 0x73, 0x52, 0x58, 0xc5, 0xe0, 0xe5, 0xba, 0x7e, 0x9d, 0xdb, 0xca, 0x19, 0x5c, 0x2e, 0x39, 0xe9, 0xab, 0x1c, 0xda, 0x1e, 0x3c, 0x65, 0x28, 0x44, 0xdc, 0xef, 0x5f, 0x13, 0x60, 0x9b, 0x01}, - dt2: fp.Elt{0x83, 0x4b, 0x13, 0x5e, 0x14, 0x68, 0x60, 0x1e, 0x16, 0x4c, 0x30, 0x24, 0x4f, 0xe6, 0xf5, 0xc4, 0xd7, 0x3e, 0x1a, 0xfc, 0xa8, 0x88, 0x6e, 0x50, 0x92, 0x2f, 0xad, 0xe6, 0xfd, 0x49, 0x0c, 0x15}, - }, - { /* 25P */ - addYX: fp.Elt{0x38, 0x11, 0x47, 0x09, 0x95, 0xf2, 0x7b, 0x8e, 0x51, 0xa6, 0x75, 0x4f, 0x39, 0xef, 0x6f, 0x5d, 0xad, 0x08, 0xa7, 0x25, 0xc4, 0x79, 0xaf, 0x10, 0x22, 0x99, 0xb9, 0x5b, 0x07, 0x5a, 0x2b, 0x6b}, - subYX: fp.Elt{0x68, 0xa8, 0xdc, 0x9c, 0x3c, 0x86, 0x49, 0xb8, 0xd0, 0x4a, 0x71, 0xb8, 0xdb, 0x44, 0x3f, 0xc8, 0x8d, 0x16, 0x36, 0x0c, 0x56, 0xe3, 0x3e, 0xfe, 0xc1, 0xfb, 0x05, 0x1e, 0x79, 0xd7, 0xa6, 0x78}, - dt2: fp.Elt{0x76, 0xb9, 0xa0, 0x47, 0x4b, 0x70, 0xbf, 0x58, 0xd5, 0x48, 0x17, 0x74, 0x55, 0xb3, 0x01, 0xa6, 0x90, 0xf5, 0x42, 0xd5, 0xb1, 0x1f, 0x2b, 0xaa, 0x00, 0x5d, 0xd5, 0x4a, 0xfc, 0x7f, 0x5c, 0x72}, - }, - { /* 27P */ - addYX: fp.Elt{0xb2, 0x99, 0xcf, 0xd1, 0x15, 0x67, 0x42, 0xe4, 0x34, 0x0d, 0xa2, 0x02, 0x11, 0xd5, 0x52, 0x73, 0x9f, 0x10, 0x12, 0x8b, 0x7b, 0x15, 0xd1, 0x23, 0xa3, 0xf3, 0xb1, 0x7c, 0x27, 0xc9, 0x4c, 0x79}, - subYX: fp.Elt{0xc0, 0x98, 0xd0, 0x1c, 0xf7, 0x2b, 0x80, 0x91, 0x66, 0x63, 0x5e, 0xed, 0xa4, 0x6c, 0x41, 0xfe, 0x4c, 0x99, 0x02, 0x49, 0x71, 0x5d, 0x58, 0xdf, 0xe7, 0xfa, 0x55, 0xf8, 0x25, 0x46, 0xd5, 0x4c}, - dt2: fp.Elt{0x53, 0x50, 0xac, 0xc2, 0x26, 0xc4, 0xf6, 0x4a, 0x58, 0x72, 0xf6, 0x32, 0xad, 0xed, 0x9a, 0xbc, 0x21, 0x10, 0x31, 0x0a, 0xf1, 0x32, 0xd0, 0x2a, 0x85, 0x8e, 0xcc, 0x6f, 0x7b, 0x35, 0x08, 0x70}, - }, - { /* 29P */ - addYX: fp.Elt{0x01, 0x3f, 0x77, 0x38, 0x27, 0x67, 0x88, 0x0b, 0xfb, 0xcc, 0xfb, 0x95, 0xfa, 0xc8, 0xcc, 0xb8, 0xb6, 0x29, 0xad, 0xb9, 0xa3, 0xd5, 0x2d, 0x8d, 0x6a, 0x0f, 0xad, 0x51, 0x98, 0x7e, 0xef, 0x06}, - subYX: fp.Elt{0x34, 0x4a, 0x58, 0x82, 0xbb, 0x9f, 0x1b, 0xd0, 0x2b, 0x79, 0xb4, 0xd2, 0x63, 0x64, 0xab, 0x47, 0x02, 0x62, 0x53, 0x48, 0x9c, 0x63, 0x31, 0xb6, 0x28, 0xd4, 0xd6, 0x69, 0x36, 0x2a, 0xa9, 0x13}, - dt2: fp.Elt{0xe5, 0x7d, 0x57, 0xc0, 0x1c, 0x77, 0x93, 0xca, 0x5c, 0xdc, 0x35, 0x50, 0x1e, 0xe4, 0x40, 0x75, 0x71, 0xe0, 0x02, 0xd8, 0x01, 0x0f, 0x68, 0x24, 0x6a, 0xf8, 0x2a, 0x8a, 0xdf, 0x6d, 0x29, 0x3c}, - }, - { /* 31P */ - addYX: fp.Elt{0x13, 0xa7, 0x14, 0xd9, 0xf9, 0x15, 0xad, 0xae, 0x12, 0xf9, 0x8f, 0x8c, 0xf9, 0x7b, 0x2f, 0xa9, 0x30, 0xd7, 0x53, 0x9f, 0x17, 0x23, 0xf8, 0xaf, 0xba, 0x77, 0x0c, 0x49, 0x93, 0xd3, 0x99, 0x7a}, - subYX: fp.Elt{0x41, 0x25, 0x1f, 0xbb, 0x2e, 0x4d, 0xeb, 0xfc, 0x1f, 0xb9, 0xad, 0x40, 0xc7, 0x10, 0x95, 0xb8, 0x05, 0xad, 0xa1, 0xd0, 0x7d, 0xa3, 0x71, 0xfc, 0x7b, 0x71, 0x47, 0x07, 0x70, 0x2c, 0x89, 0x0a}, - dt2: fp.Elt{0xe8, 0xa3, 0xbd, 0x36, 0x24, 0xed, 0x52, 0x8f, 0x94, 0x07, 0xe8, 0x57, 0x41, 0xc8, 0xa8, 0x77, 0xe0, 0x9c, 0x2f, 0x26, 0x63, 0x65, 0xa9, 0xa5, 0xd2, 0xf7, 0x02, 0x83, 0xd2, 0x62, 0x67, 0x28}, - }, - { /* 33P */ - addYX: fp.Elt{0x25, 0x5b, 0xe3, 0x3c, 0x09, 0x36, 0x78, 0x4e, 0x97, 0xaa, 0x6b, 0xb2, 0x1d, 0x18, 0xe1, 0x82, 0x3f, 0xb8, 0xc7, 0xcb, 0xd3, 0x92, 0xc1, 0x0c, 0x3a, 0x9d, 0x9d, 0x6a, 0x04, 0xda, 0xf1, 0x32}, - subYX: fp.Elt{0xbd, 0xf5, 0x2e, 0xce, 0x2b, 0x8e, 0x55, 0x7c, 0x63, 0xbc, 0x47, 0x67, 0xb4, 0x6c, 0x98, 0xe4, 0xb8, 0x89, 0xbb, 0x3b, 0x9f, 0x17, 0x4a, 0x15, 0x7a, 0x76, 0xf1, 0xd6, 0xa3, 0xf2, 0x86, 0x76}, - dt2: fp.Elt{0x6a, 0x7c, 0x59, 0x6d, 0xa6, 0x12, 0x8d, 0xaa, 0x2b, 0x85, 0xd3, 0x04, 0x03, 0x93, 0x11, 0x8f, 0x22, 0xb0, 0x09, 0xc2, 0x73, 0xdc, 0x91, 0x3f, 0xa6, 0x28, 0xad, 0xa9, 0xf8, 0x05, 0x13, 0x56}, - }, - { /* 35P */ - addYX: fp.Elt{0xd1, 0xae, 0x92, 0xec, 0x8d, 0x97, 0x0c, 0x10, 0xe5, 0x73, 0x6d, 0x4d, 0x43, 0xd5, 0x43, 0xca, 0x48, 0xba, 0x47, 0xd8, 0x22, 0x1b, 0x13, 0x83, 0x2c, 0x4d, 0x5d, 0xe3, 0x53, 0xec, 0xaa}, - subYX: fp.Elt{0xd5, 0xc0, 0xb0, 0xe7, 0x28, 0xcc, 0x22, 0x67, 0x53, 0x5c, 0x07, 0xdb, 0xbb, 0xe9, 0x9d, 0x70, 0x61, 0x0a, 0x01, 0xd7, 0xa7, 0x8d, 0xf6, 0xca, 0x6c, 0xcc, 0x57, 0x2c, 0xef, 0x1a, 0x0a, 0x03}, - dt2: fp.Elt{0xaa, 0xd2, 0x3a, 0x00, 0x73, 0xf7, 0xb1, 0x7b, 0x08, 0x66, 0x21, 0x2b, 0x80, 0x29, 0x3f, 0x0b, 0x3e, 0xd2, 0x0e, 0x52, 0x86, 0xdc, 0x21, 0x78, 0x80, 0x54, 0x06, 0x24, 0x1c, 0x9c, 0xbe, 0x20}, - }, - { /* 37P */ - addYX: fp.Elt{0xa6, 0x73, 0x96, 0x24, 0xd8, 0x87, 0x53, 0xe1, 0x93, 0xe4, 0x46, 0xf5, 0x2d, 0xbc, 0x43, 0x59, 0xb5, 0x63, 0x6f, 0xc3, 0x81, 0x9a, 0x7f, 0x1c, 0xde, 0xc1, 0x0a, 0x1f, 0x36, 0xb3, 0x0a, 0x75}, - subYX: fp.Elt{0x60, 0x5e, 0x02, 0xe2, 0x4a, 0xe4, 0xe0, 0x20, 0x38, 0xb9, 0xdc, 0xcb, 0x2f, 0x3b, 0x3b, 0xb0, 0x1c, 0x0d, 0x5a, 0xf9, 0x9c, 0x63, 0x5d, 0x10, 0x11, 0xe3, 0x67, 0x50, 0x54, 0x4c, 0x76, 0x69}, - dt2: fp.Elt{0x37, 0x10, 0xf8, 0xa2, 0x83, 0x32, 0x8a, 0x1e, 0xf1, 0xcb, 0x7f, 0xbd, 0x23, 0xda, 0x2e, 0x6f, 0x63, 0x25, 0x2e, 0xac, 0x5b, 0xd1, 0x2f, 0xb7, 0x40, 0x50, 0x07, 0xb7, 0x3f, 0x6b, 0xf9, 0x54}, - }, - { /* 39P */ - addYX: fp.Elt{0x79, 0x92, 0x66, 0x29, 0x04, 0xf2, 0xad, 0x0f, 0x4a, 0x72, 0x7d, 0x7d, 0x04, 0xa2, 0xdd, 0x3a, 0xf1, 0x60, 0x57, 0x8c, 0x82, 0x94, 0x3d, 0x6f, 0x9e, 0x53, 0xb7, 0x2b, 0xc5, 0xe9, 0x7f, 0x3d}, - subYX: fp.Elt{0xcd, 0x1e, 0xb1, 0x16, 0xc6, 0xaf, 0x7d, 0x17, 0x79, 0x64, 0x57, 0xfa, 0x9c, 0x4b, 0x76, 0x89, 0x85, 0xe7, 0xec, 0xe6, 0x10, 0xa1, 0xa8, 0xb7, 0xf0, 0xdb, 0x85, 0xbe, 0x9f, 0x83, 0xe6, 0x78}, - dt2: fp.Elt{0x6b, 0x85, 0xb8, 0x37, 0xf7, 0x2d, 0x33, 0x70, 0x8a, 0x17, 0x1a, 0x04, 0x43, 0x5d, 0xd0, 0x75, 0x22, 0x9e, 0xe5, 0xa0, 0x4a, 0xf7, 0x0f, 0x32, 0x42, 0x82, 0x08, 0x50, 0xf3, 0x68, 0xf2, 0x70}, - }, - { /* 41P */ - addYX: fp.Elt{0x47, 0x5f, 0x80, 0xb1, 0x83, 0x45, 0x86, 0x66, 0x19, 0x7c, 0xdd, 0x60, 0xd1, 0xc5, 0x35, 0xf5, 0x06, 0xb0, 0x4c, 0x1e, 0xb7, 0x4e, 0x87, 0xe9, 0xd9, 0x89, 0xd8, 0xfa, 0x5c, 0x34, 0x0d, 0x7c}, - subYX: fp.Elt{0x55, 0xf3, 0xdc, 0x70, 0x20, 0x11, 0x24, 0x23, 0x17, 0xe1, 0xfc, 0xe7, 0x7e, 0xc9, 0x0c, 0x38, 0x98, 0xb6, 0x52, 0x35, 0xed, 0xde, 0x1d, 0xb3, 0xb9, 0xc4, 0xb8, 0x39, 0xc0, 0x56, 0x4e, 0x40}, - dt2: fp.Elt{0x8a, 0x33, 0x78, 0x8c, 0x4b, 0x1f, 0x1f, 0x59, 0xe1, 0xb5, 0xe0, 0x67, 0xb1, 0x6a, 0x36, 0xa0, 0x44, 0x3d, 0x5f, 0xb4, 0x52, 0x41, 0xbc, 0x5c, 0x77, 0xc7, 0xae, 0x2a, 0x76, 0x54, 0xd7, 0x20}, - }, - { /* 43P */ - addYX: fp.Elt{0x58, 0xb7, 0x3b, 0xc7, 0x6f, 0xc3, 0x8f, 0x5e, 0x9a, 0xbb, 0x3c, 0x36, 0xa5, 0x43, 0xe5, 0xac, 0x22, 0xc9, 0x3b, 0x90, 0x7d, 0x4a, 0x93, 0xa9, 0x62, 0xec, 0xce, 0xf3, 0x46, 0x1e, 0x8f, 0x2b}, - subYX: fp.Elt{0x43, 0xf5, 0xb9, 0x35, 0xb1, 0xfe, 0x74, 0x9d, 0x6c, 0x95, 0x8c, 0xde, 0xf1, 0x7d, 0xb3, 0x84, 0xa9, 0x8b, 0x13, 0x57, 0x07, 0x2b, 0x32, 0xe9, 0xe1, 0x4c, 0x0b, 0x79, 0xa8, 0xad, 0xb8, 0x38}, - dt2: fp.Elt{0x5d, 0xf9, 0x51, 0xdf, 0x9c, 0x4a, 0xc0, 0xb5, 0xac, 0xde, 0x1f, 0xcb, 0xae, 0x52, 0x39, 0x2b, 0xda, 0x66, 0x8b, 0x32, 0x8b, 0x6d, 0x10, 0x1d, 0x53, 0x19, 0xba, 0xce, 0x32, 0xeb, 0x9a, 0x04}, - }, - { /* 45P */ - addYX: fp.Elt{0x31, 0x79, 0xfc, 0x75, 0x0b, 0x7d, 0x50, 0xaa, 0xd3, 0x25, 0x67, 0x7a, 0x4b, 0x92, 0xef, 0x0f, 0x30, 0x39, 0x6b, 0x39, 0x2b, 0x54, 0x82, 0x1d, 0xfc, 0x74, 0xf6, 0x30, 0x75, 0xe1, 0x5e, 0x79}, - subYX: fp.Elt{0x7e, 0xfe, 0xdc, 0x63, 0x3c, 0x7d, 0x76, 0xd7, 0x40, 0x6e, 0x85, 0x97, 0x48, 0x59, 0x9c, 0x20, 0x13, 0x7c, 0x4f, 0xe1, 0x61, 0x68, 0x67, 0xb6, 0xfc, 0x25, 0xd6, 0xc8, 0xe0, 0x65, 0xc6, 0x51}, - dt2: fp.Elt{0x81, 0xbd, 0xec, 0x52, 0x0a, 0x5b, 0x4a, 0x25, 0xe7, 0xaf, 0x34, 0xe0, 0x6e, 0x1f, 0x41, 0x5d, 0x31, 0x4a, 0xee, 0xca, 0x0d, 0x4d, 0xa2, 0xe6, 0x77, 0x44, 0xc5, 0x9d, 0xf4, 0x9b, 0xd1, 0x6c}, - }, - { /* 47P */ - addYX: fp.Elt{0x86, 0xc3, 0xaf, 0x65, 0x21, 0x61, 0xfe, 0x1f, 0x10, 0x1b, 0xd5, 0xb8, 0x88, 0x2a, 0x2a, 0x08, 0xaa, 0x0b, 0x99, 0x20, 0x7e, 0x62, 0xf6, 0x76, 0xe7, 0x43, 0x9e, 0x42, 0xa7, 0xb3, 0x01, 0x5e}, - subYX: fp.Elt{0xa3, 0x9c, 0x17, 0x52, 0x90, 0x61, 0x87, 0x7e, 0x85, 0x9f, 0x2c, 0x0b, 0x06, 0x0a, 0x1d, 0x57, 0x1e, 0x71, 0x99, 0x84, 0xa8, 0xba, 0xa2, 0x80, 0x38, 0xe6, 0xb2, 0x40, 0xdb, 0xf3, 0x20, 0x75}, - dt2: fp.Elt{0xa1, 0x57, 0x93, 0xd3, 0xe3, 0x0b, 0xb5, 0x3d, 0xa5, 0x94, 0x9e, 0x59, 0xdd, 0x6c, 0x7b, 0x96, 0x6e, 0x1e, 0x31, 0xdf, 0x64, 0x9a, 0x30, 0x1a, 0x86, 0xc9, 0xf3, 0xce, 0x9c, 0x2c, 0x09, 0x71}, - }, - { /* 49P */ - addYX: fp.Elt{0xcf, 0x1d, 0x05, 0x74, 0xac, 0xd8, 0x6b, 0x85, 0x1e, 0xaa, 0xb7, 0x55, 0x08, 0xa4, 0xf6, 0x03, 0xeb, 0x3c, 0x74, 0xc9, 0xcb, 0xe7, 0x4a, 0x3a, 0xde, 0xab, 0x37, 0x71, 0xbb, 0xa5, 0x73, 0x41}, - subYX: fp.Elt{0x8c, 0x91, 0x64, 0x03, 0x3f, 0x52, 0xd8, 0x53, 0x1c, 0x6b, 0xab, 0x3f, 0xf4, 0x04, 0xb4, 0xa2, 0xa4, 0xe5, 0x81, 0x66, 0x9e, 0x4a, 0x0b, 0x08, 0xa7, 0x7b, 0x25, 0xd0, 0x03, 0x5b, 0xa1, 0x0e}, - dt2: fp.Elt{0x8a, 0x21, 0xf9, 0xf0, 0x31, 0x6e, 0xc5, 0x17, 0x08, 0x47, 0xfc, 0x1a, 0x2b, 0x6e, 0x69, 0x5a, 0x76, 0xf1, 0xb2, 0xf4, 0x68, 0x16, 0x93, 0xf7, 0x67, 0x3a, 0x4e, 0x4a, 0x61, 0x65, 0xc5, 0x5f}, - }, - { /* 51P */ - addYX: fp.Elt{0x8e, 0x98, 0x90, 0x77, 0xe6, 0xe1, 0x92, 0x48, 0x22, 0xd7, 0x5c, 0x1c, 0x0f, 0x95, 0xd5, 0x01, 0xed, 0x3e, 0x92, 0xe5, 0x9a, 0x81, 0xb0, 0xe3, 0x1b, 0x65, 0x46, 0x9d, 0x40, 0xc7, 0x14, 0x32}, - subYX: fp.Elt{0xe5, 0x7a, 0x6d, 0xc4, 0x0d, 0x57, 0x6e, 0x13, 0x8f, 0xdc, 0xf8, 0x54, 0xcc, 0xaa, 0xd0, 0x0f, 0x86, 0xad, 0x0d, 0x31, 0x03, 0x9f, 0x54, 0x59, 0xa1, 0x4a, 0x45, 0x4c, 0x41, 0x1c, 0x71, 0x62}, - dt2: fp.Elt{0x70, 0x17, 0x65, 0x06, 0x74, 0x82, 0x29, 0x13, 0x36, 0x94, 0x27, 0x8a, 0x66, 0xa0, 0xa4, 0x3b, 0x3c, 0x22, 0x5d, 0x18, 0xec, 0xb8, 0xb6, 0xd9, 0x3c, 0x83, 0xcb, 0x3e, 0x07, 0x94, 0xea, 0x5b}, - }, - { /* 53P */ - addYX: fp.Elt{0xf8, 0xd2, 0x43, 0xf3, 0x63, 0xce, 0x70, 0xb4, 0xf1, 0xe8, 0x43, 0x05, 0x8f, 0xba, 0x67, 0x00, 0x6f, 0x7b, 0x11, 0xa2, 0xa1, 0x51, 0xda, 0x35, 0x2f, 0xbd, 0xf1, 0x44, 0x59, 0x78, 0xd0, 0x4a}, - subYX: fp.Elt{0xe4, 0x9b, 0xc8, 0x12, 0x09, 0xbf, 0x1d, 0x64, 0x9c, 0x57, 0x6e, 0x7d, 0x31, 0x8b, 0xf3, 0xac, 0x65, 0xb0, 0x97, 0xf6, 0x02, 0x9e, 0xfe, 0xab, 0xec, 0x1e, 0xf6, 0x48, 0xc1, 0xd5, 0xac, 0x3a}, - dt2: fp.Elt{0x01, 0x83, 0x31, 0xc3, 0x34, 0x3b, 0x8e, 0x85, 0x26, 0x68, 0x31, 0x07, 0x47, 0xc0, 0x99, 0xdc, 0x8c, 0xa8, 0x9d, 0xd3, 0x2e, 0x5b, 0x08, 0x34, 0x3d, 0x85, 0x02, 0xd9, 0xb1, 0x0c, 0xff, 0x3a}, - }, - { /* 55P */ - addYX: fp.Elt{0x05, 0x35, 0xc5, 0xf4, 0x0b, 0x43, 0x26, 0x92, 0x83, 0x22, 0x1f, 0x26, 0x13, 0x9c, 0xe4, 0x68, 0xc6, 0x27, 0xd3, 0x8f, 0x78, 0x33, 0xef, 0x09, 0x7f, 0x9e, 0xd9, 0x2b, 0x73, 0x9f, 0xcf, 0x2c}, - subYX: fp.Elt{0x5e, 0x40, 0x20, 0x3a, 0xeb, 0xc7, 0xc5, 0x87, 0xc9, 0x56, 0xad, 0xed, 0xef, 0x11, 0xe3, 0x8e, 0xf9, 0xd5, 0x29, 0xad, 0x48, 0x2e, 0x25, 0x29, 0x1d, 0x25, 0xcd, 0xf4, 0x86, 0x7e, 0x0e, 0x11}, - dt2: fp.Elt{0xe4, 0xf5, 0x03, 0xd6, 0x9e, 0xd8, 0xc0, 0x57, 0x0c, 0x20, 0xb0, 0xf0, 0x28, 0x86, 0x88, 0x12, 0xb7, 0x3b, 0x2e, 0xa0, 0x09, 0x27, 0x17, 0x53, 0x37, 0x3a, 0x69, 0xb9, 0xe0, 0x57, 0xc5, 0x05}, - }, - { /* 57P */ - addYX: fp.Elt{0xb0, 0x0e, 0xc2, 0x89, 0xb0, 0xbb, 0x76, 0xf7, 0x5c, 0xd8, 0x0f, 0xfa, 0xf6, 0x5b, 0xf8, 0x61, 0xfb, 0x21, 0x44, 0x63, 0x4e, 0x3f, 0xb9, 0xb6, 0x05, 0x12, 0x86, 0x41, 0x08, 0xef, 0x9f, 0x28}, - subYX: fp.Elt{0x6f, 0x7e, 0xc9, 0x1f, 0x31, 0xce, 0xf9, 0xd8, 0xae, 0xfd, 0xf9, 0x11, 0x30, 0x26, 0x3f, 0x7a, 0xdd, 0x25, 0xed, 0x8b, 0xa0, 0x7e, 0x5b, 0xe1, 0x5a, 0x87, 0xe9, 0x8f, 0x17, 0x4c, 0x15, 0x6e}, - dt2: fp.Elt{0xbf, 0x9a, 0xd6, 0xfe, 0x36, 0x63, 0x61, 0xcf, 0x4f, 0xc9, 0x35, 0x83, 0xe7, 0xe4, 0x16, 0x9b, 0xe7, 0x7f, 0x3a, 0x75, 0x65, 0x97, 0x78, 0x13, 0x19, 0xa3, 0x5c, 0xa9, 0x42, 0xf6, 0xfb, 0x6a}, - }, - { /* 59P */ - addYX: fp.Elt{0xcc, 0xa8, 0x13, 0xf9, 0x70, 0x50, 0xe5, 0x5d, 0x61, 0xf5, 0x0c, 0x2b, 0x7b, 0x16, 0x1d, 0x7d, 0x89, 0xd4, 0xea, 0x90, 0xb6, 0x56, 0x29, 0xda, 0xd9, 0x1e, 0x80, 0xdb, 0xce, 0x93, 0xc0, 0x12}, - subYX: fp.Elt{0xc1, 0xd2, 0xf5, 0x62, 0x0c, 0xde, 0xa8, 0x7d, 0x9a, 0x7b, 0x0e, 0xb0, 0xa4, 0x3d, 0xfc, 0x98, 0xe0, 0x70, 0xad, 0x0d, 0xda, 0x6a, 0xeb, 0x7d, 0xc4, 0x38, 0x50, 0xb9, 0x51, 0xb8, 0xb4, 0x0d}, - dt2: fp.Elt{0x0f, 0x19, 0xb8, 0x08, 0x93, 0x7f, 0x14, 0xfc, 0x10, 0xe3, 0x1a, 0xa1, 0xa0, 0x9d, 0x96, 0x06, 0xfd, 0xd7, 0xc7, 0xda, 0x72, 0x55, 0xe7, 0xce, 0xe6, 0x5c, 0x63, 0xc6, 0x99, 0x87, 0xaa, 0x33}, - }, - { /* 61P */ - addYX: fp.Elt{0xb1, 0x6c, 0x15, 0xfc, 0x88, 0xf5, 0x48, 0x83, 0x27, 0x6d, 0x0a, 0x1a, 0x9b, 0xba, 0xa2, 0x6d, 0xb6, 0x5a, 0xca, 0x87, 0x5c, 0x2d, 0x26, 0xe2, 0xa6, 0x89, 0xd5, 0xc8, 0xc1, 0xd0, 0x2c, 0x21}, - subYX: fp.Elt{0xf2, 0x5c, 0x08, 0xbd, 0x1e, 0xf5, 0x0f, 0xaf, 0x1f, 0x3f, 0xd3, 0x67, 0x89, 0x1a, 0xf5, 0x78, 0x3c, 0x03, 0x60, 0x50, 0xe1, 0xbf, 0xc2, 0x6e, 0x86, 0x1a, 0xe2, 0xe8, 0x29, 0x6f, 0x3c, 0x23}, - dt2: fp.Elt{0x81, 0xc7, 0x18, 0x7f, 0x10, 0xd5, 0xf4, 0xd2, 0x28, 0x9d, 0x7e, 0x52, 0xf2, 0xcd, 0x2e, 0x12, 0x41, 0x33, 0x3d, 0x3d, 0x2a, 0x86, 0x0a, 0xa7, 0xe3, 0x4c, 0x91, 0x11, 0x89, 0x77, 0xb7, 0x1d}, - }, - { /* 63P */ - addYX: fp.Elt{0xb6, 0x1a, 0x70, 0xdd, 0x69, 0x47, 0x39, 0xb3, 0xa5, 0x8d, 0xcf, 0x19, 0xd4, 0xde, 0xb8, 0xe2, 0x52, 0xc8, 0x2a, 0xfd, 0x61, 0x41, 0xdf, 0x15, 0xbe, 0x24, 0x7d, 0x01, 0x8a, 0xca, 0xe2, 0x7a}, - subYX: fp.Elt{0x6f, 0xc2, 0x6b, 0x7c, 0x39, 0x52, 0xf3, 0xdd, 0x13, 0x01, 0xd5, 0x53, 0xcc, 0xe2, 0x97, 0x7a, 0x30, 0xa3, 0x79, 0xbf, 0x3a, 0xf4, 0x74, 0x7c, 0xfc, 0xad, 0xe2, 0x26, 0xad, 0x97, 0xad, 0x31}, - dt2: fp.Elt{0x62, 0xb9, 0x20, 0x09, 0xed, 0x17, 0xe8, 0xb7, 0x9d, 0xda, 0x19, 0x3f, 0xcc, 0x18, 0x85, 0x1e, 0x64, 0x0a, 0x56, 0x25, 0x4f, 0xc1, 0x91, 0xe4, 0x83, 0x2c, 0x62, 0xa6, 0x53, 0xfc, 0xd1, 0x1e}, - }, -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/ed448/ed448.go b/backend/vendor/github.com/cloudflare/circl/sign/ed448/ed448.go deleted file mode 100644 index c368b18..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/ed448/ed448.go +++ /dev/null @@ -1,411 +0,0 @@ -// Package ed448 implements Ed448 signature scheme as described in RFC-8032. -// -// This package implements two signature variants. -// -// | Scheme Name | Sign Function | Verification | Context | -// |-------------|-------------------|---------------|-------------------| -// | Ed448 | Sign | Verify | Yes, can be empty | -// | Ed448Ph | SignPh | VerifyPh | Yes, can be empty | -// | All above | (PrivateKey).Sign | VerifyAny | As above | -// -// Specific functions for sign and verify are defined. A generic signing -// function for all schemes is available through the crypto.Signer interface, -// which is implemented by the PrivateKey type. A correspond all-in-one -// verification method is provided by the VerifyAny function. -// -// Both schemes require a context string for domain separation. This parameter -// is passed using a SignerOptions struct defined in this package. -// -// References: -// -// - RFC8032: https://rfc-editor.org/rfc/rfc8032.txt -// - EdDSA for more curves: https://eprint.iacr.org/2015/677 -// - High-speed high-security signatures: https://doi.org/10.1007/s13389-012-0027-1 -package ed448 - -import ( - "bytes" - "crypto" - cryptoRand "crypto/rand" - "crypto/subtle" - "errors" - "fmt" - "io" - "strconv" - - "github.com/cloudflare/circl/ecc/goldilocks" - "github.com/cloudflare/circl/internal/sha3" - "github.com/cloudflare/circl/sign" -) - -const ( - // ContextMaxSize is the maximum length (in bytes) allowed for context. - ContextMaxSize = 255 - // PublicKeySize is the length in bytes of Ed448 public keys. - PublicKeySize = 57 - // PrivateKeySize is the length in bytes of Ed448 private keys. - PrivateKeySize = 114 - // SignatureSize is the length in bytes of signatures. - SignatureSize = 114 - // SeedSize is the size, in bytes, of private key seeds. These are the private key representations used by RFC 8032. - SeedSize = 57 -) - -const ( - paramB = 456 / 8 // Size of keys in bytes. - hashSize = 2 * paramB // Size of the hash function's output. -) - -// SignerOptions implements crypto.SignerOpts and augments with parameters -// that are specific to the Ed448 signature schemes. -type SignerOptions struct { - // Hash must be crypto.Hash(0) for both Ed448 and Ed448Ph. - crypto.Hash - - // Context is an optional domain separation string for signing. - // Its length must be less or equal than 255 bytes. - Context string - - // Scheme is an identifier for choosing a signature scheme. - Scheme SchemeID -} - -// SchemeID is an identifier for each signature scheme. -type SchemeID uint - -const ( - ED448 SchemeID = iota - ED448Ph -) - -// PublicKey is the type of Ed448 public keys. -type PublicKey []byte - -// Equal reports whether pub and x have the same value. -func (pub PublicKey) Equal(x crypto.PublicKey) bool { - xx, ok := x.(PublicKey) - return ok && bytes.Equal(pub, xx) -} - -// PrivateKey is the type of Ed448 private keys. It implements crypto.Signer. -type PrivateKey []byte - -// Equal reports whether priv and x have the same value. -func (priv PrivateKey) Equal(x crypto.PrivateKey) bool { - xx, ok := x.(PrivateKey) - return ok && subtle.ConstantTimeCompare(priv, xx) == 1 -} - -// Public returns the PublicKey corresponding to priv. -func (priv PrivateKey) Public() crypto.PublicKey { - publicKey := make([]byte, PublicKeySize) - copy(publicKey, priv[SeedSize:]) - return PublicKey(publicKey) -} - -// Seed returns the private key seed corresponding to priv. It is provided for -// interoperability with RFC 8032. RFC 8032's private keys correspond to seeds -// in this package. -func (priv PrivateKey) Seed() []byte { - seed := make([]byte, SeedSize) - copy(seed, priv[:SeedSize]) - return seed -} - -func (priv PrivateKey) Scheme() sign.Scheme { return sch } - -func (pub PublicKey) Scheme() sign.Scheme { return sch } - -func (priv PrivateKey) MarshalBinary() (data []byte, err error) { - privateKey := make(PrivateKey, PrivateKeySize) - copy(privateKey, priv) - return privateKey, nil -} - -func (pub PublicKey) MarshalBinary() (data []byte, err error) { - publicKey := make(PublicKey, PublicKeySize) - copy(publicKey, pub) - return publicKey, nil -} - -// Sign creates a signature of a message given a key pair. -// This function supports all the two signature variants defined in RFC-8032, -// namely Ed448 (or pure EdDSA) and Ed448Ph. -// The opts.HashFunc() must return zero to the specify Ed448 variant. This can -// be achieved by passing crypto.Hash(0) as the value for opts. -// Use an Options struct to pass a bool indicating that the ed448Ph variant -// should be used. -// The struct can also be optionally used to pass a context string for signing. -func (priv PrivateKey) Sign( - rand io.Reader, - message []byte, - opts crypto.SignerOpts, -) (signature []byte, err error) { - var ctx string - var scheme SchemeID - - if o, ok := opts.(SignerOptions); ok { - ctx = o.Context - scheme = o.Scheme - } - - switch true { - case scheme == ED448 && opts.HashFunc() == crypto.Hash(0): - return Sign(priv, message, ctx), nil - case scheme == ED448Ph && opts.HashFunc() == crypto.Hash(0): - return SignPh(priv, message, ctx), nil - default: - return nil, errors.New("ed448: bad hash algorithm") - } -} - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (PublicKey, PrivateKey, error) { - if rand == nil { - rand = cryptoRand.Reader - } - - seed := make(PrivateKey, SeedSize) - if _, err := io.ReadFull(rand, seed); err != nil { - return nil, nil, err - } - - privateKey := NewKeyFromSeed(seed) - publicKey := make([]byte, PublicKeySize) - copy(publicKey, privateKey[SeedSize:]) - - return publicKey, privateKey, nil -} - -// NewKeyFromSeed calculates a private key from a seed. It will panic if -// len(seed) is not SeedSize. This function is provided for interoperability -// with RFC 8032. RFC 8032's private keys correspond to seeds in this -// package. -func NewKeyFromSeed(seed []byte) PrivateKey { - privateKey := make([]byte, PrivateKeySize) - newKeyFromSeed(privateKey, seed) - return privateKey -} - -func newKeyFromSeed(privateKey, seed []byte) { - if l := len(seed); l != SeedSize { - panic("ed448: bad seed length: " + strconv.Itoa(l)) - } - - var h [hashSize]byte - H := sha3.NewShake256() - _, _ = H.Write(seed) - _, _ = H.Read(h[:]) - s := &goldilocks.Scalar{} - deriveSecretScalar(s, h[:paramB]) - - copy(privateKey[:SeedSize], seed) - _ = goldilocks.Curve{}.ScalarBaseMult(s).ToBytes(privateKey[SeedSize:]) -} - -func signAll(signature []byte, privateKey PrivateKey, message, ctx []byte, preHash bool) { - if len(ctx) > ContextMaxSize { - panic(fmt.Errorf("ed448: bad context length: %v", len(ctx))) - } - - H := sha3.NewShake256() - var PHM []byte - - if preHash { - var h [64]byte - _, _ = H.Write(message) - _, _ = H.Read(h[:]) - PHM = h[:] - H.Reset() - } else { - PHM = message - } - - // 1. Hash the 57-byte private key using SHAKE256(x, 114). - var h [hashSize]byte - _, _ = H.Write(privateKey[:SeedSize]) - _, _ = H.Read(h[:]) - s := &goldilocks.Scalar{} - deriveSecretScalar(s, h[:paramB]) - prefix := h[paramB:] - - // 2. Compute SHAKE256(dom4(F, C) || prefix || PH(M), 114). - var rPM [hashSize]byte - H.Reset() - - writeDom(&H, ctx, preHash) - - _, _ = H.Write(prefix) - _, _ = H.Write(PHM) - _, _ = H.Read(rPM[:]) - - // 3. Compute the point [r]B. - r := &goldilocks.Scalar{} - r.FromBytes(rPM[:]) - R := (&[paramB]byte{})[:] - if err := (goldilocks.Curve{}.ScalarBaseMult(r).ToBytes(R)); err != nil { - panic(err) - } - // 4. Compute SHAKE256(dom4(F, C) || R || A || PH(M), 114) - var hRAM [hashSize]byte - H.Reset() - - writeDom(&H, ctx, preHash) - - _, _ = H.Write(R) - _, _ = H.Write(privateKey[SeedSize:]) - _, _ = H.Write(PHM) - _, _ = H.Read(hRAM[:]) - - // 5. Compute S = (r + k * s) mod order. - k := &goldilocks.Scalar{} - k.FromBytes(hRAM[:]) - S := &goldilocks.Scalar{} - S.Mul(k, s) - S.Add(S, r) - - // 6. The signature is the concatenation of R and S. - copy(signature[:paramB], R[:]) - copy(signature[paramB:], S[:]) -} - -// Sign signs the message with privateKey and returns a signature. -// This function supports the signature variant defined in RFC-8032: Ed448, -// also known as the pure version of EdDSA. -// It will panic if len(privateKey) is not PrivateKeySize. -func Sign(priv PrivateKey, message []byte, ctx string) []byte { - signature := make([]byte, SignatureSize) - signAll(signature, priv, message, []byte(ctx), false) - return signature -} - -// SignPh creates a signature of a message given a keypair. -// This function supports the signature variant defined in RFC-8032: Ed448ph, -// meaning it internally hashes the message using SHAKE-256. -// Context could be passed to this function, which length should be no more than -// 255. It can be empty. -func SignPh(priv PrivateKey, message []byte, ctx string) []byte { - signature := make([]byte, SignatureSize) - signAll(signature, priv, message, []byte(ctx), true) - return signature -} - -func verify(public PublicKey, message, signature, ctx []byte, preHash bool) bool { - if len(public) != PublicKeySize || - len(signature) != SignatureSize || - len(ctx) > ContextMaxSize || - !isLessThanOrder(signature[paramB:]) { - return false - } - - P, err := goldilocks.FromBytes(public) - if err != nil { - return false - } - - H := sha3.NewShake256() - var PHM []byte - - if preHash { - var h [64]byte - _, _ = H.Write(message) - _, _ = H.Read(h[:]) - PHM = h[:] - H.Reset() - } else { - PHM = message - } - - var hRAM [hashSize]byte - R := signature[:paramB] - - writeDom(&H, ctx, preHash) - - _, _ = H.Write(R) - _, _ = H.Write(public) - _, _ = H.Write(PHM) - _, _ = H.Read(hRAM[:]) - - k := &goldilocks.Scalar{} - k.FromBytes(hRAM[:]) - S := &goldilocks.Scalar{} - S.FromBytes(signature[paramB:]) - - encR := (&[paramB]byte{})[:] - P.Neg() - _ = goldilocks.Curve{}.CombinedMult(S, k, P).ToBytes(encR) - return bytes.Equal(R, encR) -} - -// VerifyAny returns true if the signature is valid. Failure cases are invalid -// signature, or when the public key cannot be decoded. -// This function supports all the two signature variants defined in RFC-8032, -// namely Ed448 (or pure EdDSA) and Ed448Ph. -// The opts.HashFunc() must return zero, this can be achieved by passing -// crypto.Hash(0) as the value for opts. -// Use a SignerOptions struct to pass a context string for signing. -func VerifyAny(public PublicKey, message, signature []byte, opts crypto.SignerOpts) bool { - var ctx string - var scheme SchemeID - if o, ok := opts.(SignerOptions); ok { - ctx = o.Context - scheme = o.Scheme - } - - switch true { - case scheme == ED448 && opts.HashFunc() == crypto.Hash(0): - return Verify(public, message, signature, ctx) - case scheme == ED448Ph && opts.HashFunc() == crypto.Hash(0): - return VerifyPh(public, message, signature, ctx) - default: - return false - } -} - -// Verify returns true if the signature is valid. Failure cases are invalid -// signature, or when the public key cannot be decoded. -// This function supports the signature variant defined in RFC-8032: Ed448, -// also known as the pure version of EdDSA. -func Verify(public PublicKey, message, signature []byte, ctx string) bool { - return verify(public, message, signature, []byte(ctx), false) -} - -// VerifyPh returns true if the signature is valid. Failure cases are invalid -// signature, or when the public key cannot be decoded. -// This function supports the signature variant defined in RFC-8032: Ed448ph, -// meaning it internally hashes the message using SHAKE-256. -// Context could be passed to this function, which length should be no more than -// 255. It can be empty. -func VerifyPh(public PublicKey, message, signature []byte, ctx string) bool { - return verify(public, message, signature, []byte(ctx), true) -} - -func deriveSecretScalar(s *goldilocks.Scalar, h []byte) { - h[0] &= 0xFC // The two least significant bits of the first octet are cleared, - h[paramB-1] = 0x00 // all eight bits the last octet are cleared, and - h[paramB-2] |= 0x80 // the highest bit of the second to last octet is set. - s.FromBytes(h[:paramB]) -} - -// isLessThanOrder returns true if 0 <= x < order and if the last byte of x is zero. -func isLessThanOrder(x []byte) bool { - order := goldilocks.Curve{}.Order() - i := len(order) - 1 - for i > 0 && x[i] == order[i] { - i-- - } - return x[paramB-1] == 0 && x[i] < order[i] -} - -func writeDom(h io.Writer, ctx []byte, preHash bool) { - dom4 := "SigEd448" - _, _ = h.Write([]byte(dom4)) - - if preHash { - _, _ = h.Write([]byte{byte(0x01), byte(len(ctx))}) - } else { - _, _ = h.Write([]byte{byte(0x00), byte(len(ctx))}) - } - _, _ = h.Write(ctx) -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/ed448/signapi.go b/backend/vendor/github.com/cloudflare/circl/sign/ed448/signapi.go deleted file mode 100644 index 22da8bc..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/ed448/signapi.go +++ /dev/null @@ -1,87 +0,0 @@ -package ed448 - -import ( - "crypto/rand" - "encoding/asn1" - - "github.com/cloudflare/circl/sign" -) - -var sch sign.Scheme = &scheme{} - -// Scheme returns a signature interface. -func Scheme() sign.Scheme { return sch } - -type scheme struct{} - -func (*scheme) Name() string { return "Ed448" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SignatureSize() int { return SignatureSize } -func (*scheme) SeedSize() int { return SeedSize } -func (*scheme) TLSIdentifier() uint { return 0x0808 } -func (*scheme) SupportsContext() bool { return true } -func (*scheme) Oid() asn1.ObjectIdentifier { - return asn1.ObjectIdentifier{1, 3, 101, 113} -} - -func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) { - return GenerateKey(rand.Reader) -} - -func (*scheme) Sign( - sk sign.PrivateKey, - message []byte, - opts *sign.SignatureOpts, -) []byte { - priv, ok := sk.(PrivateKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - ctx := "" - if opts != nil { - ctx = opts.Context - } - return Sign(priv, message, ctx) -} - -func (*scheme) Verify( - pk sign.PublicKey, - message, signature []byte, - opts *sign.SignatureOpts, -) bool { - pub, ok := pk.(PublicKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - ctx := "" - if opts != nil { - ctx = opts.Context - } - return Verify(pub, message, signature, ctx) -} - -func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) { - privateKey := NewKeyFromSeed(seed) - publicKey := make(PublicKey, PublicKeySize) - copy(publicKey, privateKey[SeedSize:]) - return publicKey, privateKey -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) { - if len(buf) < PublicKeySize { - return nil, sign.ErrPubKeySize - } - pub := make(PublicKey, PublicKeySize) - copy(pub, buf[:PublicKeySize]) - return pub, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) { - if len(buf) < PrivateKeySize { - return nil, sign.ErrPrivKeySize - } - priv := make(PrivateKey, PrivateKeySize) - copy(priv, buf[:PrivateKeySize]) - return priv, nil -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/eddilithium2/eddilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/eddilithium2/eddilithium.go deleted file mode 100644 index 9ab4401..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/eddilithium2/eddilithium.go +++ /dev/null @@ -1,239 +0,0 @@ -// Package eddilithium2 implements the hybrid signature scheme Ed25519-Dilithium2. -package eddilithium2 - -import ( - "crypto" - cryptoRand "crypto/rand" - "errors" - "io" - - "github.com/cloudflare/circl/internal/sha3" - "github.com/cloudflare/circl/sign" - "github.com/cloudflare/circl/sign/dilithium/mode2" - "github.com/cloudflare/circl/sign/ed25519" -) - -const ( - // SeedSize is the length of the seed for NewKeyFromSeed - SeedSize = mode2.SeedSize // = ed25519.SeedSize = 32 - - // PublicKeySize is the length in bytes of the packed public key. - PublicKeySize = mode2.PublicKeySize + ed25519.PublicKeySize - - // PrivateKeySize is the length in bytes of the packed public key. - PrivateKeySize = mode2.PrivateKeySize + ed25519.SeedSize - - // SignatureSize is the length in bytes of the signatures. - SignatureSize = mode2.SignatureSize + ed25519.SignatureSize -) - -// PublicKey is the type of an EdDilithium2 public key. -type PublicKey struct { - e ed25519.PublicKey - d mode2.PublicKey -} - -// PrivateKey is the type of an EdDilithium2 private key. -type PrivateKey struct { - e ed25519.PrivateKey - d mode2.PrivateKey -} - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - var seed [SeedSize]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - - pk, sk := NewKeyFromSeed(&seed) - return pk, sk, nil -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[SeedSize]byte) (*PublicKey, *PrivateKey) { - var seed1 [32]byte - var seed2 [ed25519.SeedSize]byte - - // Internally, Ed25519 and Dilithium hash the seeds they are passed again - // with different hash functions, so it would be safe to use exactly the - // same seed for Ed25519 and Dilithium here. However, in general, when - // combining any two signature schemes it might not be the case that this - // is safe. Setting a bad example here isn't worth the tiny gain in - // performance. - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - _, _ = h.Read(seed1[:]) - _, _ = h.Read(seed2[:]) - dpk, dsk := mode2.NewKeyFromSeed(&seed1) - esk := ed25519.NewKeyFromSeed(seed2[:]) - - return &PublicKey{esk.Public().(ed25519.PublicKey), *dpk}, &PrivateKey{esk, *dsk} -} - -// SignTo signs the given message and writes the signature into signature. -// It will panic if signature is not of length at least SignatureSize. -func SignTo(sk *PrivateKey, msg []byte, signature []byte) { - mode2.SignTo( - &sk.d, - msg, - signature[:mode2.SignatureSize], - ) - esig := ed25519.Sign( - sk.e, - msg, - ) - copy(signature[mode2.SignatureSize:], esig[:]) -} - -// Verify checks whether the given signature by pk on msg is valid. -func Verify(pk *PublicKey, msg []byte, signature []byte) bool { - if !mode2.Verify( - &pk.d, - msg, - signature[:mode2.SignatureSize], - ) { - return false - } - if !ed25519.Verify( - pk.e, - msg, - signature[mode2.SignatureSize:], - ) { - return false - } - return true -} - -// Unpack unpacks pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - var tmp [mode2.PublicKeySize]byte - copy(tmp[:], buf[:mode2.PublicKeySize]) - pk.d.Unpack(&tmp) - pk.e = make([]byte, ed25519.PublicKeySize) - copy(pk.e, buf[mode2.PublicKeySize:]) -} - -// Unpack sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - var tmp [mode2.PrivateKeySize]byte - copy(tmp[:], buf[:mode2.PrivateKeySize]) - sk.d.Unpack(&tmp) - sk.e = ed25519.NewKeyFromSeed(buf[mode2.PrivateKeySize:]) -} - -// Pack packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - var tmp [mode2.PublicKeySize]byte - pk.d.Pack(&tmp) - copy(buf[:mode2.PublicKeySize], tmp[:]) - copy(buf[mode2.PublicKeySize:], pk.e) -} - -// Pack packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - var tmp [mode2.PrivateKeySize]byte - sk.d.Pack(&tmp) - copy(buf[:mode2.PrivateKeySize], tmp[:]) - copy(buf[mode2.PrivateKeySize:], sk.e.Seed()) -} - -// Bytes packs the public key. -func (pk *PublicKey) Bytes() []byte { - return append(pk.d.Bytes(), pk.e...) -} - -// Bytes packs the private key. -func (sk *PrivateKey) Bytes() []byte { - return append(sk.d.Bytes(), sk.e.Seed()...) -} - -// MarshalBinary packs the public key. -func (pk *PublicKey) MarshalBinary() ([]byte, error) { - return pk.Bytes(), nil -} - -// MarshalBinary packs the private key. -func (sk *PrivateKey) MarshalBinary() ([]byte, error) { - return sk.Bytes(), nil -} - -// UnmarshalBinary the public key from data. -func (pk *PublicKey) UnmarshalBinary(data []byte) error { - if len(data) != PublicKeySize { - return errors.New("packed public key must be of eddilithium2.PublicKeySize bytes") - } - var buf [PublicKeySize]byte - copy(buf[:], data) - pk.Unpack(&buf) - return nil -} - -// UnmarshalBinary unpacks the private key from data. -func (sk *PrivateKey) UnmarshalBinary(data []byte) error { - if len(data) != PrivateKeySize { - return errors.New("packed private key must be of eddilithium2.PrivateKeySize bytes") - } - var buf [PrivateKeySize]byte - copy(buf[:], data) - sk.Unpack(&buf) - return nil -} - -func (sk *PrivateKey) Scheme() sign.Scheme { return sch } -func (pk *PublicKey) Scheme() sign.Scheme { return sch } - -func (sk *PrivateKey) Equal(other crypto.PrivateKey) bool { - castOther, ok := other.(*PrivateKey) - if !ok { - return false - } - return castOther.e.Equal(sk.e) && castOther.d.Equal(&sk.d) -} - -func (pk *PublicKey) Equal(other crypto.PublicKey) bool { - castOther, ok := other.(*PublicKey) - if !ok { - return false - } - return castOther.e.Equal(pk.e) && castOther.d.Equal(&pk.d) -} - -// Sign signs the given message. -// -// opts.HashFunc() must return zero, which can be achieved by passing -// crypto.Hash(0) for opts. rand is ignored. Will only return an error -// if opts.HashFunc() is non-zero. -// -// This function is used to make PrivateKey implement the crypto.Signer -// interface. The package-level SignTo function might be more convenient -// to use. -func (sk *PrivateKey) Sign( - rand io.Reader, msg []byte, opts crypto.SignerOpts, -) (signature []byte, err error) { - var sig [SignatureSize]byte - - if opts.HashFunc() != crypto.Hash(0) { - return nil, errors.New("eddilithium2: cannot sign hashed message") - } - - SignTo(sk, msg, sig[:]) - return sig[:], nil -} - -// Public computes the public key corresponding to this private key. -// -// Returns a *PublicKey. The type crypto.PublicKey is used to make -// PrivateKey implement the crypto.Signer interface. -func (sk *PrivateKey) Public() crypto.PublicKey { - return &PublicKey{ - sk.e.Public().(ed25519.PublicKey), - *sk.d.Public().(*mode2.PublicKey), - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/eddilithium2/signapi.go b/backend/vendor/github.com/cloudflare/circl/sign/eddilithium2/signapi.go deleted file mode 100644 index 0339243..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/eddilithium2/signapi.go +++ /dev/null @@ -1,93 +0,0 @@ -package eddilithium2 - -import ( - "crypto/rand" - "encoding/asn1" - - "github.com/cloudflare/circl/sign" -) - -var sch sign.Scheme = &scheme{} - -// Scheme returns a signature interface. -func Scheme() sign.Scheme { return sch } - -type scheme struct{} - -func (*scheme) Name() string { return "Ed25519-Dilithium2" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SignatureSize() int { return SignatureSize } -func (*scheme) SeedSize() int { return SeedSize } -func (*scheme) TLSIdentifier() uint { return 0xfe61 /* temp*/ } -func (*scheme) SupportsContext() bool { return false } -func (*scheme) Oid() asn1.ObjectIdentifier { - return asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 44363, 45, 9} -} - -func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) { - return GenerateKey(rand.Reader) -} - -func (*scheme) Sign( - sk sign.PrivateKey, - message []byte, - opts *sign.SignatureOpts, -) []byte { - priv, ok := sk.(*PrivateKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - var sig [SignatureSize]byte - SignTo(priv, message, sig[:]) - return sig[:] -} - -func (*scheme) Verify( - pk sign.PublicKey, - message, signature []byte, - opts *sign.SignatureOpts, -) bool { - pub, ok := pk.(*PublicKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - return Verify(pub, message, signature) -} - -func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) { - if len(seed) != SeedSize { - panic(sign.ErrSeedSize) - } - var tmp [SeedSize]byte - copy(tmp[:], seed) - return NewKeyFromSeed(&tmp) -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) { - if len(buf) != PublicKeySize { - return nil, sign.ErrPubKeySize - } - var tmp [PublicKeySize]byte - copy(tmp[:], buf) - var ret PublicKey - ret.Unpack(&tmp) - return &ret, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) { - if len(buf) != PrivateKeySize { - return nil, sign.ErrPrivKeySize - } - var tmp [PrivateKeySize]byte - copy(tmp[:], buf) - var ret PrivateKey - ret.Unpack(&tmp) - return &ret, nil -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/eddilithium3/eddilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/eddilithium3/eddilithium.go deleted file mode 100644 index aa05c68..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/eddilithium3/eddilithium.go +++ /dev/null @@ -1,234 +0,0 @@ -// Package eddilithium3 implements the hybrid signature scheme Ed448-Dilithium3. -package eddilithium3 - -import ( - "crypto" - cryptoRand "crypto/rand" - "errors" - "io" - - "github.com/cloudflare/circl/internal/sha3" - "github.com/cloudflare/circl/sign" - "github.com/cloudflare/circl/sign/dilithium/mode3" - "github.com/cloudflare/circl/sign/ed448" -) - -const ( - // SeedSize is the length of the seed for NewKeyFromSeed - SeedSize = ed448.SeedSize // > mode3.SeedSize - - // PublicKeySize is the length in bytes of the packed public key. - PublicKeySize = mode3.PublicKeySize + ed448.PublicKeySize - - // PrivateKeySize is the length in bytes of the packed public key. - PrivateKeySize = mode3.PrivateKeySize + ed448.SeedSize - - // SignatureSize is the length in bytes of the signatures. - SignatureSize = mode3.SignatureSize + ed448.SignatureSize -) - -// PublicKey is the type of an EdDilithium3 public key. -type PublicKey struct { - e ed448.PublicKey - d mode3.PublicKey -} - -// PrivateKey is the type of an EdDilithium3 private key. -type PrivateKey struct { - e ed448.PrivateKey - d mode3.PrivateKey -} - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - var seed [SeedSize]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - - pk, sk := NewKeyFromSeed(&seed) - return pk, sk, nil -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[SeedSize]byte) (*PublicKey, *PrivateKey) { - var seed1 [32]byte - var seed2 [ed448.SeedSize]byte - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - _, _ = h.Read(seed1[:]) - _, _ = h.Read(seed2[:]) - dpk, dsk := mode3.NewKeyFromSeed(&seed1) - esk := ed448.NewKeyFromSeed(seed2[:]) - - return &PublicKey{esk.Public().(ed448.PublicKey), *dpk}, &PrivateKey{esk, *dsk} -} - -// SignTo signs the given message and writes the signature into signature. -// It will panic if signature is not of length at least SignatureSize. -func SignTo(sk *PrivateKey, msg []byte, signature []byte) { - mode3.SignTo( - &sk.d, - msg, - signature[:mode3.SignatureSize], - ) - esig := ed448.Sign( - sk.e, - msg, - "", - ) - copy(signature[mode3.SignatureSize:], esig[:]) -} - -// Verify checks whether the given signature by pk on msg is valid. -func Verify(pk *PublicKey, msg []byte, signature []byte) bool { - if !mode3.Verify( - &pk.d, - msg, - signature[:mode3.SignatureSize], - ) { - return false - } - if !ed448.Verify( - pk.e, - msg, - signature[mode3.SignatureSize:], - "", - ) { - return false - } - return true -} - -// Unpack unpacks pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - var tmp [mode3.PublicKeySize]byte - copy(tmp[:], buf[:mode3.PublicKeySize]) - pk.d.Unpack(&tmp) - pk.e = make([]byte, ed448.PublicKeySize) - copy(pk.e, buf[mode3.PublicKeySize:]) -} - -// Unpack sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - var tmp [mode3.PrivateKeySize]byte - copy(tmp[:], buf[:mode3.PrivateKeySize]) - sk.d.Unpack(&tmp) - sk.e = ed448.NewKeyFromSeed(buf[mode3.PrivateKeySize:]) -} - -// Pack packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - var tmp [mode3.PublicKeySize]byte - pk.d.Pack(&tmp) - copy(buf[:mode3.PublicKeySize], tmp[:]) - copy(buf[mode3.PublicKeySize:], pk.e) -} - -// Pack packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - var tmp [mode3.PrivateKeySize]byte - sk.d.Pack(&tmp) - copy(buf[:mode3.PrivateKeySize], tmp[:]) - copy(buf[mode3.PrivateKeySize:], sk.e.Seed()) -} - -// Bytes packs the public key. -func (pk *PublicKey) Bytes() []byte { - return append(pk.d.Bytes(), pk.e...) -} - -// Bytes packs the private key. -func (sk *PrivateKey) Bytes() []byte { - return append(sk.d.Bytes(), sk.e.Seed()...) -} - -// MarshalBinary packs the public key. -func (pk *PublicKey) MarshalBinary() ([]byte, error) { - return pk.Bytes(), nil -} - -// MarshalBinary packs the private key. -func (sk *PrivateKey) MarshalBinary() ([]byte, error) { - return sk.Bytes(), nil -} - -// UnmarshalBinary the public key from data. -func (pk *PublicKey) UnmarshalBinary(data []byte) error { - if len(data) != PublicKeySize { - return errors.New("packed public key must be of eddilithium3.PublicKeySize bytes") - } - var buf [PublicKeySize]byte - copy(buf[:], data) - pk.Unpack(&buf) - return nil -} - -// UnmarshalBinary unpacks the private key from data. -func (sk *PrivateKey) UnmarshalBinary(data []byte) error { - if len(data) != PrivateKeySize { - return errors.New("packed private key must be of eddilithium3.PrivateKeySize bytes") - } - var buf [PrivateKeySize]byte - copy(buf[:], data) - sk.Unpack(&buf) - return nil -} - -func (sk *PrivateKey) Scheme() sign.Scheme { return sch } -func (pk *PublicKey) Scheme() sign.Scheme { return sch } - -func (sk *PrivateKey) Equal(other crypto.PrivateKey) bool { - castOther, ok := other.(*PrivateKey) - if !ok { - return false - } - return castOther.e.Equal(sk.e) && castOther.d.Equal(&sk.d) -} - -func (pk *PublicKey) Equal(other crypto.PublicKey) bool { - castOther, ok := other.(*PublicKey) - if !ok { - return false - } - return castOther.e.Equal(pk.e) && castOther.d.Equal(&pk.d) -} - -// Sign signs the given message. -// -// opts.HashFunc() must return zero, which can be achieved by passing -// crypto.Hash(0) for opts. rand is ignored. Will only return an error -// if opts.HashFunc() is non-zero. -// -// This function is used to make PrivateKey implement the crypto.Signer -// interface. The package-level SignTo function might be more convenient -// to use. -func (sk *PrivateKey) Sign( - rand io.Reader, msg []byte, opts crypto.SignerOpts, -) (signature []byte, err error) { - var sig [SignatureSize]byte - - if opts.HashFunc() != crypto.Hash(0) { - return nil, errors.New("eddilithium3: cannot sign hashed message") - } - - SignTo(sk, msg, sig[:]) - return sig[:], nil -} - -// Public computes the public key corresponding to this private key. -// -// Returns a *PublicKey. The type crypto.PublicKey is used to make -// PrivateKey implement the crypto.Signer interface. -func (sk *PrivateKey) Public() crypto.PublicKey { - return &PublicKey{ - sk.e.Public().(ed448.PublicKey), - *sk.d.Public().(*mode3.PublicKey), - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/eddilithium3/signapi.go b/backend/vendor/github.com/cloudflare/circl/sign/eddilithium3/signapi.go deleted file mode 100644 index 1c345cf..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/eddilithium3/signapi.go +++ /dev/null @@ -1,93 +0,0 @@ -package eddilithium3 - -import ( - "crypto/rand" - "encoding/asn1" - - "github.com/cloudflare/circl/sign" -) - -var sch sign.Scheme = &scheme{} - -// Scheme returns a signature interface. -func Scheme() sign.Scheme { return sch } - -type scheme struct{} - -func (*scheme) Name() string { return "Ed448-Dilithium3" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SignatureSize() int { return SignatureSize } -func (*scheme) SeedSize() int { return SeedSize } -func (*scheme) TLSIdentifier() uint { return 0xfe62 /* temp */ } -func (*scheme) SupportsContext() bool { return false } -func (*scheme) Oid() asn1.ObjectIdentifier { - return asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 44363, 45, 10} -} - -func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) { - return GenerateKey(rand.Reader) -} - -func (*scheme) Sign( - sk sign.PrivateKey, - message []byte, - opts *sign.SignatureOpts, -) []byte { - priv, ok := sk.(*PrivateKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - var sig [SignatureSize]byte - SignTo(priv, message, sig[:]) - return sig[:] -} - -func (*scheme) Verify( - pk sign.PublicKey, - message, signature []byte, - opts *sign.SignatureOpts, -) bool { - pub, ok := pk.(*PublicKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - panic(sign.ErrContextNotSupported) - } - return Verify(pub, message, signature) -} - -func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) { - if len(seed) != SeedSize { - panic(sign.ErrSeedSize) - } - var tmp [SeedSize]byte - copy(tmp[:], seed) - return NewKeyFromSeed(&tmp) -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) { - if len(buf) != PublicKeySize { - return nil, sign.ErrPubKeySize - } - var tmp [PublicKeySize]byte - copy(tmp[:], buf) - var ret PublicKey - ret.Unpack(&tmp) - return &ret, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) { - if len(buf) != PrivateKeySize { - return nil, sign.ErrPrivKeySize - } - var tmp [PrivateKeySize]byte - copy(tmp[:], buf) - var ret PrivateKey - ret.Unpack(&tmp) - return &ret, nil -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/amd64.go b/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/amd64.go deleted file mode 100644 index d5d224e..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/amd64.go +++ /dev/null @@ -1,154 +0,0 @@ -//go:build amd64 && !purego -// +build amd64,!purego - -package dilithium - -import ( - "golang.org/x/sys/cpu" -) - -// Execute an in-place forward NTT on as. -// -// Assumes the coefficients are in Montgomery representation and bounded -// by 2*Q. The resulting coefficients are again in Montgomery representation, -// but are only bounded bt 18*Q. -func (p *Poly) NTT() { - if cpu.X86.HasAVX2 { - nttAVX2( - (*[N]uint32)(p), - ) - } else { - p.nttGeneric() - } -} - -// Execute an in-place inverse NTT and multiply by Montgomery factor R -// -// Assumes the coefficients are in Montgomery representation and bounded -// by 2*Q. The resulting coefficients are again in Montgomery representation -// and bounded by 2*Q. -func (p *Poly) InvNTT() { - if cpu.X86.HasAVX2 { - invNttAVX2( - (*[N]uint32)(p), - ) - } else { - p.invNttGeneric() - } -} - -// Sets p to the polynomial whose coefficients are the pointwise multiplication -// of those of a and b. The coefficients of p are bounded by 2q. -// -// Assumes a and b are in Montgomery form and that the pointwise product -// of each coefficient is below 2³² q. -func (p *Poly) MulHat(a, b *Poly) { - if cpu.X86.HasAVX2 { - mulHatAVX2( - (*[N]uint32)(p), - (*[N]uint32)(a), - (*[N]uint32)(b), - ) - } else { - p.mulHatGeneric(a, b) - } -} - -// Sets p to a + b. Does not normalize polynomials. -func (p *Poly) Add(a, b *Poly) { - if cpu.X86.HasAVX2 { - addAVX2( - (*[N]uint32)(p), - (*[N]uint32)(a), - (*[N]uint32)(b), - ) - } else { - p.addGeneric(a, b) - } -} - -// Sets p to a - b. -// -// Warning: assumes coefficients of b are less than 2q. -// Sets p to a + b. Does not normalize polynomials. -func (p *Poly) Sub(a, b *Poly) { - if cpu.X86.HasAVX2 { - subAVX2( - (*[N]uint32)(p), - (*[N]uint32)(a), - (*[N]uint32)(b), - ) - } else { - p.subGeneric(a, b) - } -} - -// Writes p whose coefficients are in [0, 16) to buf, which must be of -// length N/2. -func (p *Poly) PackLe16(buf []byte) { - if cpu.X86.HasAVX2 { - if len(buf) < PolyLe16Size { - panic("buf too small") - } - packLe16AVX2( - (*[N]uint32)(p), - &buf[0], - ) - } else { - p.packLe16Generic(buf) - } -} - -// Reduces each of the coefficients to <2q. -func (p *Poly) ReduceLe2Q() { - if cpu.X86.HasAVX2 { - reduceLe2QAVX2((*[N]uint32)(p)) - } else { - p.reduceLe2QGeneric() - } -} - -// Reduce each of the coefficients to > 23 - x2 := x & 0x7FFFFF // 2²³-1 - return x2 + (x1 << 13) - x1 -} - -// Returns x mod q. -func modQ(x uint32) uint32 { - return le2qModQ(ReduceLe2Q(x)) -} - -// For x R ≤ q 2³², find y ≤ 2q with y = x mod q. -func montReduceLe2Q(x uint64) uint32 { - // Qinv = 4236238847 = -(q⁻¹) mod 2³² - m := (x * Qinv) & 0xffffffff - return uint32((x + m*uint64(Q)) >> 32) -} - -// Returns x mod q for 0 ≤ x < 2q. -func le2qModQ(x uint32) uint32 { - x -= Q - mask := uint32(int32(x) >> 31) // mask is 2³²-1 if x was neg.; 0 otherwise - return x + (mask & Q) -} - -// Splits 0 ≤ a < Q into a0 and a1 with a = a1*2ᴰ + a0 -// and -2ᴰ⁻¹ < a0 < 2ᴰ⁻¹. Returns a0 + Q and a1. -func power2round(a uint32) (a0plusQ, a1 uint32) { - // We effectively compute a0 = a mod± 2ᵈ - // and a1 = (a - a0) / 2ᵈ. - a0 := a & ((1 << D) - 1) // a mod 2ᵈ - - // a0 is one of 0, 1, ..., 2ᵈ⁻¹-1, 2ᵈ⁻¹, 2ᵈ⁻¹+1, ..., 2ᵈ-1 - a0 -= (1 << (D - 1)) + 1 - // now a0 is -2ᵈ⁻¹-1, -2ᵈ⁻¹, ..., -2, -1, 0, ..., 2ᵈ⁻¹-2 - // Next, we add 2ᴰ to those a0 that are negative (seen as int32). - a0 += uint32(int32(a0)>>31) & (1 << D) - // now a0 is 2ᵈ⁻¹-1, 2ᵈ⁻¹, ..., 2ᵈ-2, 2ᵈ-1, 0, ..., 2ᵈ⁻¹-2 - a0 -= (1 << (D - 1)) - 1 - // now a0 id 0, 1, 2, ..., 2ᵈ⁻¹-1, 2ᵈ⁻¹-1, -2ᵈ⁻¹-1, ... - // which is what we want. - a0plusQ = Q + a0 - a1 = (a - a0) >> D - return -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/generic.go b/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/generic.go deleted file mode 100644 index 25321f5..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/generic.go +++ /dev/null @@ -1,81 +0,0 @@ -//go:build !amd64 || purego -// +build !amd64 purego - -package dilithium - -// Execute an in-place forward NTT on as. -// -// Assumes the coefficients are in Montgomery representation and bounded -// by 2*Q. The resulting coefficients are again in Montgomery representation, -// but are only bounded bt 18*Q. -func (p *Poly) NTT() { - p.nttGeneric() -} - -// Execute an in-place inverse NTT and multiply by Montgomery factor R -// -// Assumes the coefficients are in Montgomery representation and bounded -// by 2*Q. The resulting coefficients are again in Montgomery representation -// and bounded by 2*Q. -func (p *Poly) InvNTT() { - p.invNttGeneric() -} - -// Sets p to the polynomial whose coefficients are the pointwise multiplication -// of those of a and b. The coefficients of p are bounded by 2q. -// -// Assumes a and b are in Montgomery form and that the pointwise product -// of each coefficient is below 2³² q. -func (p *Poly) MulHat(a, b *Poly) { - p.mulHatGeneric(a, b) -} - -// Sets p to a + b. Does not normalize polynomials. -func (p *Poly) Add(a, b *Poly) { - p.addGeneric(a, b) -} - -// Sets p to a - b. -// -// Warning: assumes coefficients of b are less than 2q. -// Sets p to a + b. Does not normalize polynomials. -func (p *Poly) Sub(a, b *Poly) { - p.subGeneric(a, b) -} - -// Writes p whose coefficients are in [0, 16) to buf, which must be of -// length N/2. -func (p *Poly) PackLe16(buf []byte) { - p.packLe16Generic(buf) -} - -// Reduces each of the coefficients to <2q. -func (p *Poly) ReduceLe2Q() { - p.reduceLe2QGeneric() -} - -// Reduce each of the coefficients to 0; l >>= 1 { - // On the n-th iteration of the l-loop, the coefficients start off - // bounded by n*2*Q. - // - // offset effectively loops over the row groups in this column; it - // is the first row in the row group. - for offset := uint(0); offset < N-l; offset += 2 * l { - k++ - zeta := uint64(Zetas[k]) - - // j loops over each butterfly in the row group. - for j := offset; j < offset+l; j++ { - t := montReduceLe2Q(zeta * uint64(p[j+l])) - p[j+l] = p[j] + (2*Q - t) // Cooley--Tukey butterfly - p[j] += t - } - } - } -} - -// Execute an in-place inverse NTT and multiply by Montgomery factor R -// -// Assumes the coefficients are in Montgomery representation and bounded -// by 2*Q. The resulting coefficients are again in Montgomery representation -// and bounded by 2*Q. -func (p *Poly) invNttGeneric() { - k := 0 // Index into InvZetas - - // We basically do the opposite of NTT, but postpone dividing by 2 in the - // inverse of the Cooley--Tukey butterfly and accumulate that to a big - // division by 2⁸ at the end. See comments in the NTT() function. - - for l := uint(1); l < N; l <<= 1 { - // On the n-th iteration of the l-loop, the coefficients start off - // bounded by 2ⁿ⁻¹*2*Q, so by 256*Q on the last. - for offset := uint(0); offset < N-l; offset += 2 * l { - zeta := uint64(InvZetas[k]) - k++ - for j := offset; j < offset+l; j++ { - t := p[j] // Gentleman--Sande butterfly - p[j] = t + p[j+l] - t += 256*Q - p[j+l] - p[j+l] = montReduceLe2Q(zeta * uint64(t)) - } - } - } - - for j := uint(0); j < N; j++ { - // ROver256 = 41978 = (256)⁻¹ R² - p[j] = montReduceLe2Q(ROver256 * uint64(p[j])) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/pack.go b/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/pack.go deleted file mode 100644 index 4b952a0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/pack.go +++ /dev/null @@ -1,160 +0,0 @@ -package dilithium - -// Sets p to the polynomial whose coefficients are less than 1024 encoded -// into buf (which must be of size PolyT1Size). -// -// p will be normalized. -func (p *Poly) UnpackT1(buf []byte) { - j := 0 - for i := 0; i < PolyT1Size; i += 5 { - p[j] = (uint32(buf[i]) | (uint32(buf[i+1]) << 8)) & 0x3ff - p[j+1] = (uint32(buf[i+1]>>2) | (uint32(buf[i+2]) << 6)) & 0x3ff - p[j+2] = (uint32(buf[i+2]>>4) | (uint32(buf[i+3]) << 4)) & 0x3ff - p[j+3] = (uint32(buf[i+3]>>6) | (uint32(buf[i+4]) << 2)) & 0x3ff - j += 4 - } -} - -// Writes p whose coefficients are in (-2ᵈ⁻¹, 2ᵈ⁻¹] into buf which -// has to be of length at least PolyT0Size. -// -// Assumes that the coefficients are not normalized, but lie in the -// range (q-2ᵈ⁻¹, q+2ᵈ⁻¹]. -func (p *Poly) PackT0(buf []byte) { - j := 0 - for i := 0; i < PolyT0Size; i += 13 { - p0 := Q + (1 << (D - 1)) - p[j] - p1 := Q + (1 << (D - 1)) - p[j+1] - p2 := Q + (1 << (D - 1)) - p[j+2] - p3 := Q + (1 << (D - 1)) - p[j+3] - p4 := Q + (1 << (D - 1)) - p[j+4] - p5 := Q + (1 << (D - 1)) - p[j+5] - p6 := Q + (1 << (D - 1)) - p[j+6] - p7 := Q + (1 << (D - 1)) - p[j+7] - - buf[i] = byte(p0 >> 0) - buf[i+1] = byte(p0>>8) | byte(p1<<5) - buf[i+2] = byte(p1 >> 3) - buf[i+3] = byte(p1>>11) | byte(p2<<2) - buf[i+4] = byte(p2>>6) | byte(p3<<7) - buf[i+5] = byte(p3 >> 1) - buf[i+6] = byte(p3>>9) | byte(p4<<4) - buf[i+7] = byte(p4 >> 4) - buf[i+8] = byte(p4>>12) | byte(p5<<1) - buf[i+9] = byte(p5>>7) | byte(p6<<6) - buf[i+10] = byte(p6 >> 2) - buf[i+11] = byte(p6>>10) | byte(p7<<3) - buf[i+12] = byte(p7 >> 5) - j += 8 - } -} - -// Sets p to the polynomial packed into buf by PackT0. -// -// The coefficients of p will not be normalized, but will lie -// in (-2ᵈ⁻¹, 2ᵈ⁻¹]. -func (p *Poly) UnpackT0(buf []byte) { - j := 0 - for i := 0; i < PolyT0Size; i += 13 { - p[j] = Q + (1 << (D - 1)) - ((uint32(buf[i]) | - (uint32(buf[i+1]) << 8)) & 0x1fff) - p[j+1] = Q + (1 << (D - 1)) - (((uint32(buf[i+1]) >> 5) | - (uint32(buf[i+2]) << 3) | - (uint32(buf[i+3]) << 11)) & 0x1fff) - p[j+2] = Q + (1 << (D - 1)) - (((uint32(buf[i+3]) >> 2) | - (uint32(buf[i+4]) << 6)) & 0x1fff) - p[j+3] = Q + (1 << (D - 1)) - (((uint32(buf[i+4]) >> 7) | - (uint32(buf[i+5]) << 1) | - (uint32(buf[i+6]) << 9)) & 0x1fff) - p[j+4] = Q + (1 << (D - 1)) - (((uint32(buf[i+6]) >> 4) | - (uint32(buf[i+7]) << 4) | - (uint32(buf[i+8]) << 12)) & 0x1fff) - p[j+5] = Q + (1 << (D - 1)) - (((uint32(buf[i+8]) >> 1) | - (uint32(buf[i+9]) << 7)) & 0x1fff) - p[j+6] = Q + (1 << (D - 1)) - (((uint32(buf[i+9]) >> 6) | - (uint32(buf[i+10]) << 2) | - (uint32(buf[i+11]) << 10)) & 0x1fff) - p[j+7] = Q + (1 << (D - 1)) - ((uint32(buf[i+11]) >> 3) | - (uint32(buf[i+12]) << 5)) - - j += 8 - } -} - -// Writes p whose coefficients are less than 1024 into buf, which must be -// of size at least PolyT1Size . -// -// Assumes coefficients of p are normalized. -func (p *Poly) PackT1(buf []byte) { - j := 0 - for i := 0; i < PolyT1Size; i += 5 { - buf[i] = byte(p[j]) - buf[i+1] = byte(p[j]>>8) | byte(p[j+1]<<2) - buf[i+2] = byte(p[j+1]>>6) | byte(p[j+2]<<4) - buf[i+3] = byte(p[j+2]>>4) | byte(p[j+3]<<6) - buf[i+4] = byte(p[j+3] >> 2) - j += 4 - } -} - -// Writes p whose coefficients are in [0, 16) to buf, which must be of -// length N/2. -func (p *Poly) packLe16Generic(buf []byte) { - j := 0 - for i := 0; i < PolyLe16Size; i++ { - buf[i] = byte(p[j]) | byte(p[j+1]<<4) - j += 2 - } -} - -// Writes p with 60 non-zero coefficients {-1,1} to buf, which must have -// length 40. -func (p *Poly) PackB60(buf []byte) { - // We start with a mask of the non-zero positions of p (which is 32 bytes) - // and then append 60 packed bits, where a one indicates a negative - // coefficients. - var signs uint64 - mask := uint64(1) - for i := 0; i < 32; i++ { - buf[i] = 0 - for j := 0; j < 8; j++ { - if p[8*i+j] != 0 { - buf[i] |= 1 << uint(j) - if p[8*i+j] == Q-1 { - signs |= mask - } - mask <<= 1 - } - } - } - for i := uint64(0); i < 8; i++ { - buf[i+32] = uint8(signs >> (8 * i)) - } -} - -// UnpackB60 sets p to the polynomial packed into buf with Poly.PackB60(). -// -// Returns whether unpacking was successful. -func (p *Poly) UnpackB60(buf []byte) bool { - *p = Poly{} // zero p - signs := (uint64(buf[32]) | (uint64(buf[33]) << 8) | - (uint64(buf[34]) << 16) | (uint64(buf[35]) << 24) | - (uint64(buf[36]) << 32) | (uint64(buf[37]) << 40) | - (uint64(buf[38]) << 48) | (uint64(buf[39]) << 56)) - if signs>>60 != 0 { - return false // ensure unused bits are zero for strong unforgeability - } - - for i := 0; i < 32; i++ { - for j := 0; j < 8; j++ { - if (buf[i]>>uint(j))&1 == 1 { - p[8*i+j] = 1 - // Note 1 ^ (1 | (Q-1)) = Q-1 and (-1)&x = x - p[8*i+j] ^= uint32(-(signs & 1)) & (1 | (Q - 1)) - signs >>= 1 - } - } - } - - return true -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/params.go b/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/params.go deleted file mode 100644 index f423217..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/params.go +++ /dev/null @@ -1,18 +0,0 @@ -package dilithium - -import ( - "github.com/cloudflare/circl/sign/internal/dilithium/params" -) - -const ( - SeedSize = params.SeedSize - N = params.N - Q = params.Q - QBits = params.QBits - Qinv = params.Qinv - ROver256 = params.ROver256 - D = params.D - PolyT1Size = params.PolyT1Size - PolyT0Size = params.PolyT0Size - PolyLe16Size = params.PolyLe16Size -) diff --git a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/params/params.go b/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/params/params.go deleted file mode 100644 index 2df20e3..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/params/params.go +++ /dev/null @@ -1,25 +0,0 @@ -package params - -// We put these parameters in a separate package so that the Go code, -// such as ntt_amd64_src.go, that generates assembler can import it. - -const ( - SeedSize = 32 - N = 256 - Q = 8380417 // 2²³ - 2¹³ + 1 - QBits = 23 - Qinv = 4236238847 // = -(q^-1) mod 2³² - ROver256 = 41978 // = (256)⁻¹ R² mod q, where R=2³² - D = 13 - - // Size of T1 packed. (Note that the formula is not valid in general, - // but it is for the parameters used in the modes of Dilithium.) - PolyT1Size = (N * (QBits - D)) / 8 - - // Size of T0 packed. (Note that the formula is not valid in general, - // but it is for the parameters used in the modes of Dilithium.) - PolyT0Size = (N * D) / 8 - - // Size of a packed polynomial whose coefficients are in [0,16). - PolyLe16Size = N / 2 -) diff --git a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/poly.go b/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/poly.go deleted file mode 100644 index 96c0551..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/poly.go +++ /dev/null @@ -1,101 +0,0 @@ -package dilithium - -// An element of our base ring R which are polynomials over Z_q modulo -// the equation Xᴺ = -1, where q=2²³ - 2¹³ + 1 and N=256. -// -// Coefficients aren't always reduced. See Normalize(). -type Poly [N]uint32 - -// Reduces each of the coefficients to <2q. -func (p *Poly) reduceLe2QGeneric() { - for i := uint(0); i < N; i++ { - p[i] = ReduceLe2Q(p[i]) - } -} - -// Reduce each of the coefficients to > 31) - // Sets x to {0, 1, ..., (Q-1)/2, (Q-1)/2, ..., 1} - x = int32((Q-1)/2) - x - if uint32(x) >= bound { - return true - } - } - return false -} - -// Splits p into p1 and p0 such that [i]p1 * 2ᴰ + [i]p0 = [i]p -// with -2ᴰ⁻¹ < [i]p0 ≤ 2ᴰ⁻¹. Returns p0 + Q and p1. -// -// Requires the coefficients of p to be normalized. -func (p *Poly) Power2Round(p0PlusQ, p1 *Poly) { - for i := 0; i < N; i++ { - p0PlusQ[i], p1[i] = power2round(p[i]) - } -} - -// Sets p to the polynomial whose coefficients are the pointwise multiplication -// of those of a and b. The coefficients of p are bounded by 2q. -// -// Assumes a and b are in Montgomery form and that the pointwise product -// of each coefficient is below 2³² q. -func (p *Poly) mulHatGeneric(a, b *Poly) { - for i := 0; i < N; i++ { - p[i] = montReduceLe2Q(uint64(a[i]) * uint64(b[i])) - } -} - -// Sets p to 2ᵈ q without reducing. -// -// So it requires the coefficients of p to be less than 2³²⁻ᴰ. -func (p *Poly) mulBy2toDGeneric(q *Poly) { - for i := 0; i < N; i++ { - p[i] = q[i] << D - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/stubs_amd64.go b/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/stubs_amd64.go deleted file mode 100644 index ca92f15..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/internal/dilithium/stubs_amd64.go +++ /dev/null @@ -1,35 +0,0 @@ -// Code generated by command: go run src.go -out ../amd64.s -stubs ../stubs_amd64.go -pkg dilithium. DO NOT EDIT. - -//go:build amd64 && !purego - -package dilithium - -//go:noescape -func nttAVX2(p *[256]uint32) - -//go:noescape -func invNttAVX2(p *[256]uint32) - -//go:noescape -func mulHatAVX2(p *[256]uint32, a *[256]uint32, b *[256]uint32) - -//go:noescape -func addAVX2(p *[256]uint32, a *[256]uint32, b *[256]uint32) - -//go:noescape -func subAVX2(p *[256]uint32, a *[256]uint32, b *[256]uint32) - -//go:noescape -func packLe16AVX2(p *[256]uint32, buf *byte) - -//go:noescape -func reduceLe2QAVX2(p *[256]uint32) - -//go:noescape -func le2qModQAVX2(p *[256]uint32) - -//go:noescape -func exceedsAVX2(p *[256]uint32, bound uint32) uint8 - -//go:noescape -func mulBy2toDAVX2(p *[256]uint32, q *[256]uint32) diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/dilithium.go deleted file mode 100644 index 4b640f0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/dilithium.go +++ /dev/null @@ -1,361 +0,0 @@ -// Code generated from pkg.templ.go. DO NOT EDIT. - -// mldsa44 implements NIST signature scheme ML-DSA-44 as defined in FIPS204. -package mldsa44 - -import ( - "crypto" - cryptoRand "crypto/rand" - "encoding/asn1" - "errors" - "io" - - "github.com/cloudflare/circl/sign" - common "github.com/cloudflare/circl/sign/internal/dilithium" - "github.com/cloudflare/circl/sign/mldsa/mldsa44/internal" -) - -const ( - // Size of seed for NewKeyFromSeed - SeedSize = common.SeedSize - - // Size of a packed PublicKey - PublicKeySize = internal.PublicKeySize - - // Size of a packed PrivateKey - PrivateKeySize = internal.PrivateKeySize - - // Size of a signature - SignatureSize = internal.SignatureSize -) - -// PublicKey is the type of ML-DSA-44 public key -type PublicKey internal.PublicKey - -// PrivateKey is the type of ML-DSA-44 private key -type PrivateKey internal.PrivateKey - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - pk, sk, err := internal.GenerateKey(rand) - return (*PublicKey)(pk), (*PrivateKey)(sk), err -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[SeedSize]byte) (*PublicKey, *PrivateKey) { - pk, sk := internal.NewKeyFromSeed(seed) - return (*PublicKey)(pk), (*PrivateKey)(sk) -} - -// SignTo signs the given message and writes the signature into signature. -// It will panic if signature is not of length at least SignatureSize. -// -// ctx is the optional context string. Errors if ctx is larger than 255 bytes. -// A nil context string is equivalent to an empty context string. -func SignTo(sk *PrivateKey, msg, ctx []byte, randomized bool, sig []byte) error { - var rnd [32]byte - if randomized { - _, err := cryptoRand.Read(rnd[:]) - if err != nil { - return err - } - } - - if len(ctx) > 255 { - return sign.ErrContextTooLong - } - - internal.SignTo( - (*internal.PrivateKey)(sk), - func(w io.Writer) { - _, _ = w.Write([]byte{0}) - _, _ = w.Write([]byte{byte(len(ctx))}) - - if ctx != nil { - _, _ = w.Write(ctx) - } - w.Write(msg) - }, - rnd, - sig, - ) - return nil -} - -// Do not use. Implements ML-DSA.Sign_internal used for compatibility tests. -func (sk *PrivateKey) unsafeSignInternal(msg []byte, rnd [32]byte) []byte { - var ret [SignatureSize]byte - internal.SignTo( - (*internal.PrivateKey)(sk), - func(w io.Writer) { - _, _ = w.Write(msg) - }, - rnd, - ret[:], - ) - return ret[:] -} - -// Do not use. Implements ML-DSA.Verify_internal used for compatibility tests. -func unsafeVerifyInternal(pk *PublicKey, msg, sig []byte) bool { - return internal.Verify( - (*internal.PublicKey)(pk), - func(w io.Writer) { - _, _ = w.Write(msg) - }, - sig, - ) -} - -// Verify checks whether the given signature by pk on msg is valid. -// -// ctx is the optional context string. Fails if ctx is larger than 255 bytes. -// A nil context string is equivalent to an empty context string. -func Verify(pk *PublicKey, msg, ctx, sig []byte) bool { - if len(ctx) > 255 { - return false - } - return internal.Verify( - (*internal.PublicKey)(pk), - func(w io.Writer) { - _, _ = w.Write([]byte{0}) - _, _ = w.Write([]byte{byte(len(ctx))}) - - if ctx != nil { - _, _ = w.Write(ctx) - } - _, _ = w.Write(msg) - }, - sig, - ) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Unpack(buf) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Unpack(buf) -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Pack(buf) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Pack(buf) -} - -// Packs the public key. -func (pk *PublicKey) Bytes() []byte { - var buf [PublicKeySize]byte - pk.Pack(&buf) - return buf[:] -} - -// Packs the private key. -func (sk *PrivateKey) Bytes() []byte { - var buf [PrivateKeySize]byte - sk.Pack(&buf) - return buf[:] -} - -// Packs the public key. -func (pk *PublicKey) MarshalBinary() ([]byte, error) { - return pk.Bytes(), nil -} - -// Packs the private key. -func (sk *PrivateKey) MarshalBinary() ([]byte, error) { - return sk.Bytes(), nil -} - -// Unpacks the public key from data. -func (pk *PublicKey) UnmarshalBinary(data []byte) error { - if len(data) != PublicKeySize { - return errors.New("packed public key must be of mldsa44.PublicKeySize bytes") - } - var buf [PublicKeySize]byte - copy(buf[:], data) - pk.Unpack(&buf) - return nil -} - -// Unpacks the private key from data. -func (sk *PrivateKey) UnmarshalBinary(data []byte) error { - if len(data) != PrivateKeySize { - return errors.New("packed private key must be of mldsa44.PrivateKeySize bytes") - } - var buf [PrivateKeySize]byte - copy(buf[:], data) - sk.Unpack(&buf) - return nil -} - -// Sign signs the given message. -// -// opts.HashFunc() must return zero, which can be achieved by passing -// crypto.Hash(0) for opts. rand is ignored. Will only return an error -// if opts.HashFunc() is non-zero. -// -// This function is used to make PrivateKey implement the crypto.Signer -// interface. The package-level SignTo function might be more convenient -// to use. -func (sk *PrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ( - sig []byte, err error) { - var ret [SignatureSize]byte - - if opts.HashFunc() != crypto.Hash(0) { - return nil, errors.New("dilithium: cannot sign hashed message") - } - if err = SignTo(sk, msg, nil, false, ret[:]); err != nil { - return nil, err - } - - return ret[:], nil -} - -// Computes the public key corresponding to this private key. -// -// Returns a *PublicKey. The type crypto.PublicKey is used to make -// PrivateKey implement the crypto.Signer interface. -func (sk *PrivateKey) Public() crypto.PublicKey { - return (*PublicKey)((*internal.PrivateKey)(sk).Public()) -} - -// Equal returns whether the two private keys equal. -func (sk *PrivateKey) Equal(other crypto.PrivateKey) bool { - castOther, ok := other.(*PrivateKey) - if !ok { - return false - } - return (*internal.PrivateKey)(sk).Equal((*internal.PrivateKey)(castOther)) -} - -// Equal returns whether the two public keys equal. -func (pk *PublicKey) Equal(other crypto.PublicKey) bool { - castOther, ok := other.(*PublicKey) - if !ok { - return false - } - return (*internal.PublicKey)(pk).Equal((*internal.PublicKey)(castOther)) -} - -// Boilerplate for generic signatures API - -type scheme struct{} - -var sch sign.Scheme = &scheme{} - -// Scheme returns a generic signature interface for ML-DSA-44. -func Scheme() sign.Scheme { return sch } - -func (*scheme) Name() string { return "ML-DSA-44" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SignatureSize() int { return SignatureSize } -func (*scheme) SeedSize() int { return SeedSize } - -// TODO TLSIdentifier() -func (*scheme) Oid() asn1.ObjectIdentifier { - return asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 17} -} - -func (*scheme) SupportsContext() bool { - return true -} - -func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) { - return GenerateKey(nil) -} - -func (*scheme) Sign( - sk sign.PrivateKey, - msg []byte, - opts *sign.SignatureOpts, -) []byte { - var ctx []byte - sig := make([]byte, SignatureSize) - - priv, ok := sk.(*PrivateKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - ctx = []byte(opts.Context) - } - err := SignTo(priv, msg, ctx, false, sig) - if err != nil { - panic(err) - } - - return sig -} - -func (*scheme) Verify( - pk sign.PublicKey, - msg, sig []byte, - opts *sign.SignatureOpts, -) bool { - var ctx []byte - pub, ok := pk.(*PublicKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - ctx = []byte(opts.Context) - } - return Verify(pub, msg, ctx, sig) -} - -func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) { - if len(seed) != SeedSize { - panic(sign.ErrSeedSize) - } - var seed2 [SeedSize]byte - copy(seed2[:], seed) - return NewKeyFromSeed(&seed2) -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) { - if len(buf) != PublicKeySize { - return nil, sign.ErrPubKeySize - } - - var ( - buf2 [PublicKeySize]byte - ret PublicKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) { - if len(buf) != PrivateKeySize { - return nil, sign.ErrPrivKeySize - } - - var ( - buf2 [PrivateKeySize]byte - ret PrivateKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (sk *PrivateKey) Scheme() sign.Scheme { - return sch -} - -func (sk *PublicKey) Scheme() sign.Scheme { - return sch -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/dilithium.go deleted file mode 100644 index 8f1c8e5..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/dilithium.go +++ /dev/null @@ -1,491 +0,0 @@ -// Code generated from mode3/internal/dilithium.go by gen.go - -package internal - -import ( - cryptoRand "crypto/rand" - "crypto/subtle" - "io" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -const ( - // Size of a packed polynomial of norm ≤η. - // (Note that the formula is not valid in general.) - PolyLeqEtaSize = (common.N * DoubleEtaBits) / 8 - - // β = τη, the maximum size of c s₂. - Beta = Tau * Eta - - // γ₁ range of y - Gamma1 = 1 << Gamma1Bits - - // Size of packed polynomial of norm <γ₁ such as z - PolyLeGamma1Size = (Gamma1Bits + 1) * common.N / 8 - - // α = 2γ₂ parameter for decompose - Alpha = 2 * Gamma2 - - // Size of a packed private key - PrivateKeySize = 32 + 32 + TRSize + PolyLeqEtaSize*(L+K) + common.PolyT0Size*K - - // Size of a packed public key - PublicKeySize = 32 + common.PolyT1Size*K - - // Size of a packed signature - SignatureSize = L*PolyLeGamma1Size + Omega + K + CTildeSize - - // Size of packed w₁ - PolyW1Size = (common.N * (common.QBits - Gamma1Bits)) / 8 -) - -// PublicKey is the type of Dilithium public keys. -type PublicKey struct { - rho [32]byte - t1 VecK - - // Cached values - t1p [common.PolyT1Size * K]byte - A *Mat - tr *[TRSize]byte -} - -// PrivateKey is the type of Dilithium private keys. -type PrivateKey struct { - rho [32]byte - key [32]byte - s1 VecL - s2 VecK - t0 VecK - tr [TRSize]byte - - // Cached values - A Mat // ExpandA(ρ) - s1h VecL // NTT(s₁) - s2h VecK // NTT(s₂) - t0h VecK // NTT(t₀) -} - -type unpackedSignature struct { - z VecL - hint VecK - c [CTildeSize]byte -} - -// Packs the signature into buf. -func (sig *unpackedSignature) Pack(buf []byte) { - copy(buf[:], sig.c[:]) - sig.z.PackLeGamma1(buf[CTildeSize:]) - sig.hint.PackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) -} - -// Sets sig to the signature encoded in the buffer. -// -// Returns whether buf contains a properly packed signature. -func (sig *unpackedSignature) Unpack(buf []byte) bool { - if len(buf) < SignatureSize { - return false - } - copy(sig.c[:], buf[:]) - sig.z.UnpackLeGamma1(buf[CTildeSize:]) - if sig.z.Exceeds(Gamma1 - Beta) { - return false - } - if !sig.hint.UnpackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) { - return false - } - return true -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - copy(buf[:32], pk.rho[:]) - copy(buf[32:], pk.t1p[:]) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - copy(pk.rho[:], buf[:32]) - copy(pk.t1p[:], buf[32:]) - - pk.t1.UnpackT1(pk.t1p[:]) - pk.A = new(Mat) - pk.A.Derive(&pk.rho) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - pk.tr = new([TRSize]byte) - h := sha3.NewShake256() - _, _ = h.Write(buf[:]) - _, _ = h.Read(pk.tr[:]) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - copy(buf[:32], sk.rho[:]) - copy(buf[32:64], sk.key[:]) - copy(buf[64:64+TRSize], sk.tr[:]) - offset := 64 + TRSize - sk.s1.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.PackT0(buf[offset:]) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - copy(sk.rho[:], buf[:32]) - copy(sk.key[:], buf[32:64]) - copy(sk.tr[:], buf[64:64+TRSize]) - offset := 64 + TRSize - sk.s1.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.UnpackT0(buf[offset:]) - - // Cached values - sk.A.Derive(&sk.rho) - sk.t0h = sk.t0 - sk.t0h.NTT() - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() -} - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - var seed [32]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - pk, sk := NewKeyFromSeed(&seed) - return pk, sk, nil -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[common.SeedSize]byte) (*PublicKey, *PrivateKey) { - var eSeed [128]byte // expanded seed - var pk PublicKey - var sk PrivateKey - var sSeed [64]byte - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - - if NIST { - _, _ = h.Write([]byte{byte(K), byte(L)}) - } - - _, _ = h.Read(eSeed[:]) - - copy(pk.rho[:], eSeed[:32]) - copy(sSeed[:], eSeed[32:96]) - copy(sk.key[:], eSeed[96:]) - copy(sk.rho[:], pk.rho[:]) - - sk.A.Derive(&pk.rho) - - for i := uint16(0); i < L; i++ { - PolyDeriveUniformLeqEta(&sk.s1[i], &sSeed, i) - } - - for i := uint16(0); i < K; i++ { - PolyDeriveUniformLeqEta(&sk.s2[i], &sSeed, i+L) - } - - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() - - sk.computeT0andT1(&sk.t0, &pk.t1) - - sk.t0h = sk.t0 - sk.t0h.NTT() - - // Complete public key far enough to be packed - pk.t1.PackT1(pk.t1p[:]) - pk.A = &sk.A - - // Finish private key - var packedPk [PublicKeySize]byte - pk.Pack(&packedPk) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - h.Reset() - _, _ = h.Write(packedPk[:]) - _, _ = h.Read(sk.tr[:]) - - // Finish cache of public key - pk.tr = &sk.tr - - return &pk, &sk -} - -// Computes t0 and t1 from sk.s1h, sk.s2 and sk.A. -func (sk *PrivateKey) computeT0andT1(t0, t1 *VecK) { - var t VecK - - // Set t to A s₁ + s₂ - for i := 0; i < K; i++ { - PolyDotHat(&t[i], &sk.A[i], &sk.s1h) - t[i].ReduceLe2Q() - t[i].InvNTT() - } - t.Add(&t, &sk.s2) - t.Normalize() - - // Compute t₀, t₁ = Power2Round(t) - t.Power2Round(t0, t1) -} - -// Verify checks whether the given signature by pk on msg is valid. -// -// For Dilithium this is the top-level verification function. -// In ML-DSA, this is ML-DSA.Verify_internal. -func Verify(pk *PublicKey, msg func(io.Writer), signature []byte) bool { - var sig unpackedSignature - var mu [64]byte - var zh VecL - var Az, Az2dct1, w1 VecK - var ch common.Poly - var cp [CTildeSize]byte - var w1Packed [PolyW1Size * K]byte - - // Note that Unpack() checked whether ‖z‖_∞ < γ₁ - β - // and ensured that there at most ω ones in pk.hint. - if !sig.Unpack(signature) { - return false - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(pk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // Compute Az - zh = sig.z - zh.NTT() - - for i := 0; i < K; i++ { - PolyDotHat(&Az[i], &pk.A[i], &zh) - } - - // Next, we compute Az - 2ᵈ·c·t₁. - // Note that the coefficients of t₁ are bounded by 256 = 2⁹, - // so the coefficients of Az2dct1 will bounded by 2⁹⁺ᵈ = 2²³ < 2q, - // which is small enough for NTT(). - Az2dct1.MulBy2toD(&pk.t1) - Az2dct1.NTT() - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - for i := 0; i < K; i++ { - Az2dct1[i].MulHat(&Az2dct1[i], &ch) - } - Az2dct1.Sub(&Az, &Az2dct1) - Az2dct1.ReduceLe2Q() - Az2dct1.InvNTT() - Az2dct1.NormalizeAssumingLe2Q() - - // UseHint(pk.hint, Az - 2ᵈ·c·t₁) - // = UseHint(pk.hint, w - c·s₂ + c·t₀) - // = UseHint(pk.hint, r + c·t₀) - // = r₁ = w₁. - w1.UseHint(&Az2dct1, &sig.hint) - w1.PackW1(w1Packed[:]) - - // c' = H(μ, w₁) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(cp[:]) - - return sig.c == cp -} - -// SignTo signs the given message and writes the signature into signature. -// -// For Dilithium this is the top-level signing function. For ML-DSA -// this is ML-DSA.Sign_internal. -// -//nolint:funlen -func SignTo(sk *PrivateKey, msg func(io.Writer), rnd [32]byte, signature []byte) { - var mu, rhop [64]byte - var w1Packed [PolyW1Size * K]byte - var y, yh VecL - var w, w0, w1, w0mcs2, ct0, w0mcs2pct0 VecK - var ch common.Poly - var yNonce uint16 - var sig unpackedSignature - - if len(signature) < SignatureSize { - panic("Signature does not fit in that byteslice") - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(sk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // ρ' = CRH(key ‖ μ) - h.Reset() - _, _ = h.Write(sk.key[:]) - if NIST { - _, _ = h.Write(rnd[:]) - } - _, _ = h.Write(mu[:]) - _, _ = h.Read(rhop[:]) - - // Main rejection loop - attempt := 0 - for { - attempt++ - if attempt >= 576 { - // Depending on the mode, one try has a chance between 1/7 and 1/4 - // of succeeding. Thus it is safe to say that 576 iterations - // are enough as (6/7)⁵⁷⁶ < 2⁻¹²⁸. - panic("This should only happen 1 in 2^{128}: something is wrong.") - } - - // y = ExpandMask(ρ', key) - VecLDeriveUniformLeGamma1(&y, &rhop, yNonce) - yNonce += uint16(L) - - // Set w to A y - yh = y - yh.NTT() - for i := 0; i < K; i++ { - PolyDotHat(&w[i], &sk.A[i], &yh) - w[i].ReduceLe2Q() - w[i].InvNTT() - } - - // Decompose w into w₀ and w₁ - w.NormalizeAssumingLe2Q() - w.Decompose(&w0, &w1) - - // c~ = H(μ ‖ w₁) - w1.PackW1(w1Packed[:]) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(sig.c[:]) - - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - - // Ensure ‖ w₀ - c·s2 ‖_∞ < γ₂ - β. - // - // By Lemma 3 of the specification this is equivalent to checking that - // both ‖ r₀ ‖_∞ < γ₂ - β and r₁ = w₁, for the decomposition - // w - c·s₂ = r₁ α + r₀ as computed by decompose(). - // See also §4.1 of the specification. - for i := 0; i < K; i++ { - w0mcs2[i].MulHat(&ch, &sk.s2h[i]) - w0mcs2[i].InvNTT() - } - w0mcs2.Sub(&w0, &w0mcs2) - w0mcs2.Normalize() - - if w0mcs2.Exceeds(Gamma2 - Beta) { - continue - } - - // z = y + c·s₁ - for i := 0; i < L; i++ { - sig.z[i].MulHat(&ch, &sk.s1h[i]) - sig.z[i].InvNTT() - } - sig.z.Add(&sig.z, &y) - sig.z.Normalize() - - // Ensure ‖z‖_∞ < γ₁ - β - if sig.z.Exceeds(Gamma1 - Beta) { - continue - } - - // Compute c·t₀ - for i := 0; i < K; i++ { - ct0[i].MulHat(&ch, &sk.t0h[i]) - ct0[i].InvNTT() - } - ct0.NormalizeAssumingLe2Q() - - // Ensure ‖c·t₀‖_∞ < γ₂. - if ct0.Exceeds(Gamma2) { - continue - } - - // Create the hint to be able to reconstruct w₁ from w - c·s₂ + c·t0. - // Note that we're not using makeHint() in the obvious way as we - // do not know whether ‖ sc·s₂ - c·t₀ ‖_∞ < γ₂. Instead we note - // that our makeHint() is actually the same as a makeHint for a - // different decomposition: - // - // Earlier we ensured indirectly with a check that r₁ = w₁ where - // r = w - c·s₂. Hence r₀ = r - r₁ α = w - c·s₂ - w₁ α = w₀ - c·s₂. - // Thus MakeHint(w₀ - c·s₂ + c·t₀, w₁) = MakeHint(r0 + c·t₀, r₁) - // and UseHint(w - c·s₂ + c·t₀, w₁) = UseHint(r + c·t₀, r₁). - // As we just ensured that ‖ c·t₀ ‖_∞ < γ₂ our usage is correct. - w0mcs2pct0.Add(&w0mcs2, &ct0) - w0mcs2pct0.NormalizeAssumingLe2Q() - hintPop := sig.hint.MakeHint(&w0mcs2pct0, &w1) - if hintPop > Omega { - continue - } - - break - } - - sig.Pack(signature[:]) -} - -// Computes the public key corresponding to this private key. -func (sk *PrivateKey) Public() *PublicKey { - var t0 VecK - pk := &PublicKey{ - rho: sk.rho, - A: &sk.A, - tr: &sk.tr, - } - sk.computeT0andT1(&t0, &pk.t1) - pk.t1.PackT1(pk.t1p[:]) - return pk -} - -// Equal returns whether the two public keys are equal -func (pk *PublicKey) Equal(other *PublicKey) bool { - return pk.rho == other.rho && pk.t1 == other.t1 -} - -// Equal returns whether the two private keys are equal -func (sk *PrivateKey) Equal(other *PrivateKey) bool { - ret := (subtle.ConstantTimeCompare(sk.rho[:], other.rho[:]) & - subtle.ConstantTimeCompare(sk.key[:], other.key[:]) & - subtle.ConstantTimeCompare(sk.tr[:], other.tr[:])) - - acc := uint32(0) - for i := 0; i < L; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s1[i][j] ^ other.s1[i][j] - } - } - for i := 0; i < K; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s2[i][j] ^ other.s2[i][j] - acc |= sk.t0[i][j] ^ other.t0[i][j] - } - } - return (ret & subtle.ConstantTimeEq(int32(acc), 0)) == 1 -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/mat.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/mat.go deleted file mode 100644 index ceaf634..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/mat.go +++ /dev/null @@ -1,59 +0,0 @@ -// Code generated from mode3/internal/mat.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A k by l matrix of polynomials. -type Mat [K]VecL - -// Expands the given seed to a complete matrix. -// -// This function is called ExpandA in the specification. -func (m *Mat) Derive(seed *[32]byte) { - if !DeriveX4Available { - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - PolyDeriveUniform(&m[i][j], seed, (i<<8)+j) - } - } - return - } - - idx := 0 - var nonces [4]uint16 - var ps [4]*common.Poly - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - nonces[idx] = (i << 8) + j - ps[idx] = &m[i][j] - idx++ - if idx == 4 { - idx = 0 - PolyDeriveUniformX4(ps, seed, nonces) - } - } - } - if idx != 0 { - for i := idx; i < 4; i++ { - ps[i] = nil - } - PolyDeriveUniformX4(ps, seed, nonces) - } -} - -// Set p to the inner product of a and b using pointwise multiplication. -// -// Assumes a and b are in Montgomery form and their coefficients are -// pairwise sufficiently small to multiply, see Poly.MulHat(). Resulting -// coefficients are bounded by 2Lq. -func PolyDotHat(p *common.Poly, a, b *VecL) { - var t common.Poly - *p = common.Poly{} // zero p - for i := 0; i < L; i++ { - t.MulHat(&a[i], &b[i]) - p.Add(&t, p) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/pack.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/pack.go deleted file mode 100644 index 1854b41..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/pack.go +++ /dev/null @@ -1,270 +0,0 @@ -// Code generated from mode3/internal/pack.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Writes p with norm less than or equal η into buf, which must be of -// size PolyLeqEtaSize. -// -// Assumes coefficients of p are not normalized, but in [q-η,q+η]. -func PolyPackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - buf[i] = (byte(common.Q+Eta-p[j]) | - byte(common.Q+Eta-p[j+1])<<4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - buf[i] = (byte(common.Q+Eta-p[j]) | - (byte(common.Q+Eta-p[j+1]) << 3) | - (byte(common.Q+Eta-p[j+2]) << 6)) - buf[i+1] = ((byte(common.Q+Eta-p[j+2]) >> 2) | - (byte(common.Q+Eta-p[j+3]) << 1) | - (byte(common.Q+Eta-p[j+4]) << 4) | - (byte(common.Q+Eta-p[j+5]) << 7)) - buf[i+2] = ((byte(common.Q+Eta-p[j+5]) >> 1) | - (byte(common.Q+Eta-p[j+6]) << 2) | - (byte(common.Q+Eta-p[j+7]) << 5)) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Sets p to the polynomial of norm less than or equal η encoded in the -// given buffer of size PolyLeqEtaSize. -// -// Output coefficients of p are not normalized, but in [q-η,q+η] provided -// buf was created using PackLeqEta. -// -// Beware, for arbitrary buf the coefficients of p might end up in -// the interval [q-2^b,q+2^b] where b is the least b with η≤2^b. -func PolyUnpackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - p[j] = common.Q + Eta - uint32(buf[i]&15) - p[j+1] = common.Q + Eta - uint32(buf[i]>>4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - p[j] = common.Q + Eta - uint32(buf[i]&7) - p[j+1] = common.Q + Eta - uint32((buf[i]>>3)&7) - p[j+2] = common.Q + Eta - uint32((buf[i]>>6)|((buf[i+1]<<2)&7)) - p[j+3] = common.Q + Eta - uint32((buf[i+1]>>1)&7) - p[j+4] = common.Q + Eta - uint32((buf[i+1]>>4)&7) - p[j+5] = common.Q + Eta - uint32((buf[i+1]>>7)|((buf[i+2]<<1)&7)) - p[j+6] = common.Q + Eta - uint32((buf[i+2]>>2)&7) - p[j+7] = common.Q + Eta - uint32((buf[i+2]>>5)&7) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Writes v with coefficients in {0, 1} of which at most ω non-zero -// to buf, which must have length ω+k. -func (v *VecK) PackHint(buf []byte) { - // The packed hint starts with the indices of the non-zero coefficients - // For instance: - // - // (x⁵⁶ + x¹⁰⁰, x²⁵⁵, 0, x² + x²³, x¹) - // - // Yields - // - // 56, 100, 255, 2, 23, 1 - // - // Then we pad with zeroes until we have a list of ω items: - // // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0 - // - // Then we finish with a list of the switch-over-indices in this - // list between polynomials, so: - // - // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0, 2, 3, 3, 5, 6 - - off := uint8(0) - for i := 0; i < K; i++ { - for j := uint16(0); j < common.N; j++ { - if v[i][j] != 0 { - buf[off] = uint8(j) - off++ - } - } - buf[Omega+i] = off - } - for ; off < Omega; off++ { - buf[off] = 0 - } -} - -// Sets v to the vector encoded using VecK.PackHint() -// -// Returns whether unpacking was successful. -func (v *VecK) UnpackHint(buf []byte) bool { - // A priori, there would be several reasonable ways to encode the same - // hint vector. We take care to only allow only one encoding, to ensure - // "strong unforgeability". - // - // See PackHint() source for description of the encoding. - *v = VecK{} // zero v - prevSOP := uint8(0) // previous switch-over-point - for i := 0; i < K; i++ { - SOP := buf[Omega+i] - if SOP < prevSOP || SOP > Omega { - return false // ensures switch-over-points are increasing - } - for j := prevSOP; j < SOP; j++ { - if j > prevSOP && buf[j] <= buf[j-1] { - return false // ensures indices are increasing (within a poly) - } - v[i][buf[j]] = 1 - } - prevSOP = SOP - } - for j := prevSOP; j < Omega; j++ { - if buf[j] != 0 { - return false // ensures padding indices are zero - } - } - - return true -} - -// Sets p to the polynomial packed into buf by PolyPackLeGamma1. -// -// p will be normalized. -func PolyUnpackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0x3) << 16) - p1 := uint32(buf[i+2]>>2) | (uint32(buf[i+3]) << 6) | - (uint32(buf[i+4]&0xf) << 14) - p2 := uint32(buf[i+4]>>4) | (uint32(buf[i+5]) << 4) | - (uint32(buf[i+6]&0x3f) << 12) - p3 := uint32(buf[i+6]>>6) | (uint32(buf[i+7]) << 2) | - (uint32(buf[i+8]) << 10) - - // coefficients in [0,…,2γ₁) - p0 = Gamma1 - p0 // (-γ₁,…,γ₁] - p1 = Gamma1 - p1 - p2 = Gamma1 - p2 - p3 = Gamma1 - p3 - - p0 += uint32(int32(p0)>>31) & common.Q // normalize - p1 += uint32(int32(p1)>>31) & common.Q - p2 += uint32(int32(p2)>>31) & common.Q - p3 += uint32(int32(p3)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - p[j+2] = p2 - p[j+3] = p3 - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0xf) << 16) - p1 := uint32(buf[i+2]>>4) | (uint32(buf[i+3]) << 4) | - (uint32(buf[i+4]) << 12) - - p0 = Gamma1 - p0 - p1 = Gamma1 - p1 - - p0 += uint32(int32(p0)>>31) & common.Q - p1 += uint32(int32(p1)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Writes p whose coefficients are in (-γ₁,γ₁] into buf -// which has to be of length PolyLeGamma1Size. -// -// Assumes p is normalized. -func PolyPackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - // coefficients in [0,…,γ₁] ∪ (q-γ₁,…,q) - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := Gamma1 - p[j] // [0,…,γ₁] ∪ (γ₁-q,…,2γ₁-q) - p0 += uint32(int32(p0)>>31) & common.Q // [0,…,2γ₁) - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - p2 := Gamma1 - p[j+2] - p2 += uint32(int32(p2)>>31) & common.Q - p3 := Gamma1 - p[j+3] - p3 += uint32(int32(p3)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<2) - buf[i+3] = byte(p1 >> 6) - buf[i+4] = byte(p1>>14) | byte(p2<<4) - buf[i+5] = byte(p2 >> 4) - buf[i+6] = byte(p2>>12) | byte(p3<<6) - buf[i+7] = byte(p3 >> 2) - buf[i+8] = byte(p3 >> 10) - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - // Coefficients are in [0, γ₁] ∪ (Q-γ₁, Q) - p0 := Gamma1 - p[j] - p0 += uint32(int32(p0)>>31) & common.Q - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<4) - buf[i+3] = byte(p1 >> 4) - buf[i+4] = byte(p1 >> 12) - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Pack w₁ into buf, which must be of length PolyW1Size. -// -// Assumes w₁ is normalized. -func PolyPackW1(p *common.Poly, buf []byte) { - if Gamma1Bits == 19 { - p.PackLe16(buf) - } else if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyW1Size; i += 3 { - buf[i] = byte(p[j]) | byte(p[j+1]<<6) - buf[i+1] = byte(p[j+1]>>2) | byte(p[j+2]<<4) - buf[i+2] = byte(p[j+2]>>4) | byte(p[j+3]<<2) - j += 4 - } - } else { - panic("unsupported γ₁") - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/params.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/params.go deleted file mode 100644 index 0485ff0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/params.go +++ /dev/null @@ -1,18 +0,0 @@ -// Code generated from params.templ.go. DO NOT EDIT. - -package internal - -const ( - Name = "ML-DSA-44" - K = 4 - L = 4 - Eta = 2 - DoubleEtaBits = 3 - Omega = 80 - Tau = 39 - Gamma1Bits = 17 - Gamma2 = 95232 - NIST = true - TRSize = 64 - CTildeSize = 32 -) diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/rounding.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/rounding.go deleted file mode 100644 index 58123c0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/rounding.go +++ /dev/null @@ -1,142 +0,0 @@ -// Code generated from mode3/internal/rounding.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, -// except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken -// and -α/2 ≤ a₀ < 0. Returns a₀ + q. Note 0 ≤ a₁ < (q-1)/α. -// Recall α = 2γ₂. -func decompose(a uint32) (a0plusQ, a1 uint32) { - // a₁ = ⌈a / 128⌉ - a1 = (a + 127) >> 7 - - if Alpha == 523776 { - // 1025/2²² is close enough to 1/4092 so that a₁ - // becomes a/α rounded down. - a1 = ((a1*1025 + (1 << 21)) >> 22) - - // For the corner-case a₁ = (q-1)/α = 16, we have to set a₁=0. - a1 &= 15 - } else if Alpha == 190464 { - // 1488/2²⁴ is close enough to 1/1488 so that a₁ - // becomes a/α rounded down. - a1 = ((a1 * 11275) + (1 << 23)) >> 24 - - // For the corner-case a₁ = (q-1)/α = 44, we have to set a₁=0. - a1 ^= uint32(int32(43-a1)>>31) & a1 - } else { - panic("unsupported α") - } - - a0plusQ = a - a1*Alpha - - // In the corner-case, when we set a₁=0, we will incorrectly - // have a₀ > (q-1)/2 and we'll need to subtract q. As we - // return a₀ + q, that comes down to adding q if a₀ < (q-1)/2. - a0plusQ += uint32(int32(a0plusQ-(common.Q-1)/2)>>31) & common.Q - - return -} - -// Assume 0 ≤ r, f < Q with ‖f‖_∞ ≤ α/2. Decompose r as r = r1*α + r0 as -// computed by decompose(). Write r' := r - f (mod Q). Now, decompose -// r'=r-f again as r' = r'1*α + r'0 using decompose(). As f is small, we -// have r'1 = r1 + h, where h ∈ {-1, 0, 1}. makeHint() computes |h| -// given z0 := r0 - f (mod Q) and r1. With |h|, which is called the hint, -// we can reconstruct r1 using only r' = r - f, which is done by useHint(). -// To wit: -// -// useHint( r - f, makeHint( r0 - f, r1 ) ) = r1. -// -// Assumes 0 ≤ z0 < Q. -func makeHint(z0, r1 uint32) uint32 { - // If -α/2 < r0 - f ≤ α/2, then r1*α + r0 - f is a valid decomposition of r' - // with the restrictions of decompose() and so r'1 = r1. So the hint - // should be 0. This is covered by the first two inequalities. - // There is one other case: if r0 - f = -α/2, then r1*α + r0 - f is also - // a valid decomposition if r1 = 0. In the other cases a one is carried - // and the hint should be 1. - if z0 <= Gamma2 || z0 > common.Q-Gamma2 || (z0 == common.Q-Gamma2 && r1 == 0) { - return 0 - } - return 1 -} - -// Uses the hint created by makeHint() to reconstruct r1 from r'=r-f; see -// documentation of makeHint() for context. -// Assumes 0 ≤ r' < Q. -func useHint(rp uint32, hint uint32) uint32 { - rp0plusQ, rp1 := decompose(rp) - if hint == 0 { - return rp1 - } - if rp0plusQ > common.Q { - return (rp1 + 1) & 15 - } - return (rp1 - 1) & 15 -} - -// Sets p to the hint polynomial for p0 the modified low bits and p1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint polynomial. -func PolyMakeHint(p, p0, p1 *common.Poly) (pop uint32) { - for i := 0; i < common.N; i++ { - h := makeHint(p0[i], p1[i]) - pop += h - p[i] = h - } - return -} - -// Computes corrections to the high bits of the polynomial q according -// to the hints in h and sets p to the corrected high bits. Returns p. -func PolyUseHint(p, q, hint *common.Poly) { - var q0PlusQ common.Poly - - // See useHint() and makeHint() for an explanation. We reimplement it - // here so that we can call Poly.Decompose(), which might be way faster - // than calling decompose() in a loop (for instance when having AVX2.) - - PolyDecompose(q, &q0PlusQ, p) - - for i := 0; i < common.N; i++ { - if hint[i] == 0 { - continue - } - if Gamma2 == 261888 { - if q0PlusQ[i] > common.Q { - p[i] = (p[i] + 1) & 15 - } else { - p[i] = (p[i] - 1) & 15 - } - } else if Gamma2 == 95232 { - if q0PlusQ[i] > common.Q { - if p[i] == 43 { - p[i] = 0 - } else { - p[i]++ - } - } else { - if p[i] == 0 { - p[i] = 43 - } else { - p[i]-- - } - } - } else { - panic("unsupported γ₂") - } - } -} - -// Splits each of the coefficients of p using decompose. -func PolyDecompose(p, p0PlusQ, p1 *common.Poly) { - for i := 0; i < common.N; i++ { - p0PlusQ[i], p1[i] = decompose(p[i]) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/sample.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/sample.go deleted file mode 100644 index b37370a..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/sample.go +++ /dev/null @@ -1,339 +0,0 @@ -// Code generated from mode3/internal/sample.go by gen.go - -package internal - -import ( - "encoding/binary" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" - "github.com/cloudflare/circl/simd/keccakf1600" -) - -// DeriveX4Available indicates whether the system supports the quick fourway -// sampling variants like PolyDeriveUniformX4. -var DeriveX4Available = keccakf1600.IsEnabledX4() - -// For each i, sample ps[i] uniformly from the given seed and nonces[i]. -// ps[i] may be nil and is ignored in that case. -// -// Can only be called when DeriveX4Available is true. -func PolyDeriveUniformX4(ps [4]*common.Poly, seed *[32]byte, nonces [4]uint16) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < 4; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // Absorb the nonces, the SHAKE128 domain separator (0b1111), the - // start of the padding (0b...001) and the end of the padding 0b100... - // Recall that the rate of SHAKE128 is 168 --- i.e. 21 uint64s. - for j := 0; j < 4; j++ { - state[4*4+j] = uint64(nonces[j]) | (0x1f << 16) - state[20*4+j] = 0x80 << 56 - } - - var idx [4]int // indices into ps - for j := 0; j < 4; j++ { - if ps[j] == nil { - idx[j] = common.N // mark nil polynomial as completed - } - } - - done := false - for !done { - // Applies KeccaK-f[1600] to state to get the next 21 uint64s of each - // of the four SHAKE128 streams. - perm.Permute() - - done = true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - for i := 0; i < 7; i++ { - var t [8]uint32 - t[0] = uint32(state[i*3*4+j] & 0x7fffff) - t[1] = uint32((state[i*3*4+j] >> 24) & 0x7fffff) - t[2] = uint32((state[i*3*4+j] >> 48) | - ((state[(i*3+1)*4+j] & 0x7f) << 16)) - t[3] = uint32((state[(i*3+1)*4+j] >> 8) & 0x7fffff) - t[4] = uint32((state[(i*3+1)*4+j] >> 32) & 0x7fffff) - t[5] = uint32((state[(i*3+1)*4+j] >> 56) | - ((state[(i*3+2)*4+j] & 0x7fff) << 8)) - t[6] = uint32((state[(i*3+2)*4+j] >> 16) & 0x7fffff) - t[7] = uint32((state[(i*3+2)*4+j] >> 40) & 0x7fffff) - - for k := 0; k < 8; k++ { - if t[k] < common.Q { - ps[j][idx[j]] = t[k] - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - } - done = false - } - } -} - -// Sample p uniformly from the given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniform(p *common.Poly, seed *[32]byte, nonce uint16) { - var i, length int - var buf [12 * 16]byte // fits 168B SHAKE-128 rate - - length = 168 - - sample := func() { - // Note that 3 divides into 168 and 12*16, so we use up buf completely. - for j := 0; j < length && i < common.N; j += 3 { - t := (uint32(buf[j]) | (uint32(buf[j+1]) << 8) | - (uint32(buf[j+2]) << 16)) & 0x7fffff - - // We use rejection sampling - if t < common.Q { - p[i] = t - i++ - } - } - } - - var iv [32 + 2]byte // 32 byte seed + uint16 nonce - h := sha3.NewShake128() - copy(iv[:32], seed[:]) - iv[32] = uint8(nonce) - iv[33] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:168]) - sample() - } -} - -// Sample p uniformly with coefficients of norm less than or equal η, -// using the given seed and nonce. -// -// p will not be normalized, but will have coefficients in [q-η,q+η]. -func PolyDeriveUniformLeqEta(p *common.Poly, seed *[64]byte, nonce uint16) { - // Assumes 2 < η < 8. - var i, length int - var buf [9 * 16]byte // fits 136B SHAKE-256 rate - - length = 136 - - sample := func() { - // We use rejection sampling - for j := 0; j < length && i < common.N; j++ { - t1 := uint32(buf[j]) & 15 - t2 := uint32(buf[j]) >> 4 - if Eta == 2 { // branch is eliminated by compiler - if t1 <= 14 { - t1 -= ((205 * t1) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 14 && i < common.N { - t2 -= ((205 * t2) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t2 - i++ - } - } else if Eta == 4 { - if t1 <= 2*Eta { - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 2*Eta && i < common.N { - p[i] = common.Q + Eta - t2 - i++ - } - } else { - panic("unsupported η") - } - } - } - - var iv [64 + 2]byte // 64 byte seed + uint16 nonce - - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - - // 136 is SHAKE-256 rate - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:136]) - sample() - } -} - -// Sample v[i] uniformly with coefficients in (-γ₁,…,γ₁] using the -// given seed and nonce+i -// -// p will be normalized. -func VecLDeriveUniformLeGamma1(v *VecL, seed *[64]byte, nonce uint16) { - for i := 0; i < L; i++ { - PolyDeriveUniformLeGamma1(&v[i], seed, nonce+uint16(i)) - } -} - -// Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the -// given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniformLeGamma1(p *common.Poly, seed *[64]byte, nonce uint16) { - var buf [PolyLeGamma1Size]byte - - var iv [66]byte - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - _, _ = h.Read(buf[:]) - - PolyUnpackLeGamma1(p, buf[:]) -} - -// For each i, sample ps[i] uniformly with τ non-zero coefficients in {q-1,1} -// using the given seed and w1[i]. ps[i] may be nil and is ignored -// in that case. ps[i] will be normalized. -// -// Can only be called when DeriveX4Available is true. -// -// This function is currently not used (yet). -func PolyDeriveUniformBallX4(ps [4]*common.Poly, seed []byte) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < CTildeSize/8; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // SHAKE256 domain separator and padding - for j := 0; j < 4; j++ { - state[(CTildeSize/8)*4+j] ^= 0x1f - state[16*4+j] ^= 0x80 << 56 - } - perm.Permute() - - var signs [4]uint64 - var idx [4]uint16 // indices into ps - - for j := 0; j < 4; j++ { - if ps[j] != nil { - signs[j] = state[j] - *ps[j] = common.Poly{} // zero ps[j] - idx[j] = common.N - Tau - } else { - idx[j] = common.N // mark as completed - } - } - - stateOffset := 1 - for { - done := true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - - for i := stateOffset; i < 17; i++ { - var bs [8]byte - binary.LittleEndian.PutUint64(bs[:], state[4*i+j]) - for k := 0; k < 8; k++ { - b := uint16(bs[k]) - - if b > idx[j] { - continue - } - - ps[j][idx[j]] = ps[j][b] - ps[j][b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - ps[j][b] ^= uint32((-(signs[j] & 1)) & (1 | (common.Q - 1))) - signs[j] >>= 1 - - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - - done = false - } - - if done { - break - } - - perm.Permute() - stateOffset = 0 - } -} - -// Samples p uniformly with τ non-zero coefficients in {q-1,1}. -// -// The polynomial p will be normalized. -func PolyDeriveUniformBall(p *common.Poly, seed []byte) { - var buf [136]byte // SHAKE-256 rate is 136 - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - _, _ = h.Read(buf[:]) - - // Essentially we generate a sequence of τ ones or minus ones, - // prepend 196 zeroes and shuffle the concatenation using the - // usual algorithm (Fisher--Yates.) - signs := binary.LittleEndian.Uint64(buf[:]) - bufOff := 8 // offset into buf - - *p = common.Poly{} // zero p - for i := uint16(common.N - Tau); i < common.N; i++ { - var b uint16 - - // Find location of where to move the new coefficient to using - // rejection sampling. - for { - if bufOff >= 136 { - _, _ = h.Read(buf[:]) - bufOff = 0 - } - - b = uint16(buf[bufOff]) - bufOff++ - - if b <= i { - break - } - } - - p[i] = p[b] - p[b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - p[b] ^= uint32((-(signs & 1)) & (1 | (common.Q - 1))) - signs >>= 1 - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/vec.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/vec.go deleted file mode 100644 index d07d3b2..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa44/internal/vec.go +++ /dev/null @@ -1,281 +0,0 @@ -// Code generated from mode3/internal/vec.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A vector of L polynomials. -type VecL [L]common.Poly - -// A vector of K polynomials. -type VecK [K]common.Poly - -// Normalize the polynomials in this vector. -func (v *VecL) Normalize() { - for i := 0; i < L; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecL) NormalizeAssumingLe2Q() { - for i := 0; i < L; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecL) Add(w, u *VecL) { - for i := 0; i < L; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecL) NTT() { - for i := 0; i < L; i++ { - v[i].NTT() - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecL) Exceeds(bound uint32) bool { - for i := 0; i < L; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Power2Round(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Decompose(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecL) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeqEta(). -func (v *VecL) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sequentially packs each polynomial using PolyPackLeGamma1(). -func (v *VecL) PackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeGamma1(). -func (v *VecL) UnpackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Normalize the polynomials in this vector. -func (v *VecK) Normalize() { - for i := 0; i < K; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecK) NormalizeAssumingLe2Q() { - for i := 0; i < K; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecK) Add(w, u *VecK) { - for i := 0; i < K; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecK) Exceeds(bound uint32) bool { - for i := 0; i < K; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Power2Round(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Decompose(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sets v to the hint vector for v0 the modified low bits and v1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint vector. -func (v *VecK) MakeHint(v0, v1 *VecK) (pop uint32) { - for i := 0; i < K; i++ { - pop += PolyMakeHint(&v[i], &v0[i], &v1[i]) - } - return -} - -// Computes corrections to the high bits of the polynomials in the vector -// w using the hints in h and sets v to the corrected high bits. Returns v. -// See useHint(). -func (v *VecK) UseHint(q, hint *VecK) *VecK { - for i := 0; i < K; i++ { - PolyUseHint(&v[i], &q[i], &hint[i]) - } - return v -} - -// Sequentially packs each polynomial using Poly.PackT1(). -func (v *VecK) PackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sets v to the vector packed into buf by PackT1(). -func (v *VecK) UnpackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sequentially packs each polynomial using Poly.PackT0(). -func (v *VecK) PackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sets v to the vector packed into buf by PackT0(). -func (v *VecK) UnpackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecK) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecK.PackLeqEta(). -func (v *VecK) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecK) NTT() { - for i := 0; i < K; i++ { - v[i].NTT() - } -} - -// Sequentially packs each polynomial using PolyPackW1(). -func (v *VecK) PackW1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackW1(&v[i], buf[offset:]) - offset += PolyW1Size - } -} - -// Sets v to a - b. -// -// Warning: assumes coefficients of the polynomials of b are less than 2q. -func (v *VecK) Sub(a, b *VecK) { - for i := 0; i < K; i++ { - v[i].Sub(&a[i], &b[i]) - } -} - -// Sets v to 2ᵈ w without reducing. -func (v *VecK) MulBy2toD(w *VecK) { - for i := 0; i < K; i++ { - v[i].MulBy2toD(&w[i]) - } -} - -// Applies InvNTT componentwise. See Poly.InvNTT() for details. -func (v *VecK) InvNTT() { - for i := 0; i < K; i++ { - v[i].InvNTT() - } -} - -// Applies Poly.ReduceLe2Q() componentwise. -func (v *VecK) ReduceLe2Q() { - for i := 0; i < K; i++ { - v[i].ReduceLe2Q() - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/dilithium.go deleted file mode 100644 index 23a7b9a..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/dilithium.go +++ /dev/null @@ -1,361 +0,0 @@ -// Code generated from pkg.templ.go. DO NOT EDIT. - -// mldsa65 implements NIST signature scheme ML-DSA-65 as defined in FIPS204. -package mldsa65 - -import ( - "crypto" - cryptoRand "crypto/rand" - "encoding/asn1" - "errors" - "io" - - "github.com/cloudflare/circl/sign" - common "github.com/cloudflare/circl/sign/internal/dilithium" - "github.com/cloudflare/circl/sign/mldsa/mldsa65/internal" -) - -const ( - // Size of seed for NewKeyFromSeed - SeedSize = common.SeedSize - - // Size of a packed PublicKey - PublicKeySize = internal.PublicKeySize - - // Size of a packed PrivateKey - PrivateKeySize = internal.PrivateKeySize - - // Size of a signature - SignatureSize = internal.SignatureSize -) - -// PublicKey is the type of ML-DSA-65 public key -type PublicKey internal.PublicKey - -// PrivateKey is the type of ML-DSA-65 private key -type PrivateKey internal.PrivateKey - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - pk, sk, err := internal.GenerateKey(rand) - return (*PublicKey)(pk), (*PrivateKey)(sk), err -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[SeedSize]byte) (*PublicKey, *PrivateKey) { - pk, sk := internal.NewKeyFromSeed(seed) - return (*PublicKey)(pk), (*PrivateKey)(sk) -} - -// SignTo signs the given message and writes the signature into signature. -// It will panic if signature is not of length at least SignatureSize. -// -// ctx is the optional context string. Errors if ctx is larger than 255 bytes. -// A nil context string is equivalent to an empty context string. -func SignTo(sk *PrivateKey, msg, ctx []byte, randomized bool, sig []byte) error { - var rnd [32]byte - if randomized { - _, err := cryptoRand.Read(rnd[:]) - if err != nil { - return err - } - } - - if len(ctx) > 255 { - return sign.ErrContextTooLong - } - - internal.SignTo( - (*internal.PrivateKey)(sk), - func(w io.Writer) { - _, _ = w.Write([]byte{0}) - _, _ = w.Write([]byte{byte(len(ctx))}) - - if ctx != nil { - _, _ = w.Write(ctx) - } - w.Write(msg) - }, - rnd, - sig, - ) - return nil -} - -// Do not use. Implements ML-DSA.Sign_internal used for compatibility tests. -func (sk *PrivateKey) unsafeSignInternal(msg []byte, rnd [32]byte) []byte { - var ret [SignatureSize]byte - internal.SignTo( - (*internal.PrivateKey)(sk), - func(w io.Writer) { - _, _ = w.Write(msg) - }, - rnd, - ret[:], - ) - return ret[:] -} - -// Do not use. Implements ML-DSA.Verify_internal used for compatibility tests. -func unsafeVerifyInternal(pk *PublicKey, msg, sig []byte) bool { - return internal.Verify( - (*internal.PublicKey)(pk), - func(w io.Writer) { - _, _ = w.Write(msg) - }, - sig, - ) -} - -// Verify checks whether the given signature by pk on msg is valid. -// -// ctx is the optional context string. Fails if ctx is larger than 255 bytes. -// A nil context string is equivalent to an empty context string. -func Verify(pk *PublicKey, msg, ctx, sig []byte) bool { - if len(ctx) > 255 { - return false - } - return internal.Verify( - (*internal.PublicKey)(pk), - func(w io.Writer) { - _, _ = w.Write([]byte{0}) - _, _ = w.Write([]byte{byte(len(ctx))}) - - if ctx != nil { - _, _ = w.Write(ctx) - } - _, _ = w.Write(msg) - }, - sig, - ) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Unpack(buf) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Unpack(buf) -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Pack(buf) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Pack(buf) -} - -// Packs the public key. -func (pk *PublicKey) Bytes() []byte { - var buf [PublicKeySize]byte - pk.Pack(&buf) - return buf[:] -} - -// Packs the private key. -func (sk *PrivateKey) Bytes() []byte { - var buf [PrivateKeySize]byte - sk.Pack(&buf) - return buf[:] -} - -// Packs the public key. -func (pk *PublicKey) MarshalBinary() ([]byte, error) { - return pk.Bytes(), nil -} - -// Packs the private key. -func (sk *PrivateKey) MarshalBinary() ([]byte, error) { - return sk.Bytes(), nil -} - -// Unpacks the public key from data. -func (pk *PublicKey) UnmarshalBinary(data []byte) error { - if len(data) != PublicKeySize { - return errors.New("packed public key must be of mldsa65.PublicKeySize bytes") - } - var buf [PublicKeySize]byte - copy(buf[:], data) - pk.Unpack(&buf) - return nil -} - -// Unpacks the private key from data. -func (sk *PrivateKey) UnmarshalBinary(data []byte) error { - if len(data) != PrivateKeySize { - return errors.New("packed private key must be of mldsa65.PrivateKeySize bytes") - } - var buf [PrivateKeySize]byte - copy(buf[:], data) - sk.Unpack(&buf) - return nil -} - -// Sign signs the given message. -// -// opts.HashFunc() must return zero, which can be achieved by passing -// crypto.Hash(0) for opts. rand is ignored. Will only return an error -// if opts.HashFunc() is non-zero. -// -// This function is used to make PrivateKey implement the crypto.Signer -// interface. The package-level SignTo function might be more convenient -// to use. -func (sk *PrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ( - sig []byte, err error) { - var ret [SignatureSize]byte - - if opts.HashFunc() != crypto.Hash(0) { - return nil, errors.New("dilithium: cannot sign hashed message") - } - if err = SignTo(sk, msg, nil, false, ret[:]); err != nil { - return nil, err - } - - return ret[:], nil -} - -// Computes the public key corresponding to this private key. -// -// Returns a *PublicKey. The type crypto.PublicKey is used to make -// PrivateKey implement the crypto.Signer interface. -func (sk *PrivateKey) Public() crypto.PublicKey { - return (*PublicKey)((*internal.PrivateKey)(sk).Public()) -} - -// Equal returns whether the two private keys equal. -func (sk *PrivateKey) Equal(other crypto.PrivateKey) bool { - castOther, ok := other.(*PrivateKey) - if !ok { - return false - } - return (*internal.PrivateKey)(sk).Equal((*internal.PrivateKey)(castOther)) -} - -// Equal returns whether the two public keys equal. -func (pk *PublicKey) Equal(other crypto.PublicKey) bool { - castOther, ok := other.(*PublicKey) - if !ok { - return false - } - return (*internal.PublicKey)(pk).Equal((*internal.PublicKey)(castOther)) -} - -// Boilerplate for generic signatures API - -type scheme struct{} - -var sch sign.Scheme = &scheme{} - -// Scheme returns a generic signature interface for ML-DSA-65. -func Scheme() sign.Scheme { return sch } - -func (*scheme) Name() string { return "ML-DSA-65" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SignatureSize() int { return SignatureSize } -func (*scheme) SeedSize() int { return SeedSize } - -// TODO TLSIdentifier() -func (*scheme) Oid() asn1.ObjectIdentifier { - return asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 18} -} - -func (*scheme) SupportsContext() bool { - return true -} - -func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) { - return GenerateKey(nil) -} - -func (*scheme) Sign( - sk sign.PrivateKey, - msg []byte, - opts *sign.SignatureOpts, -) []byte { - var ctx []byte - sig := make([]byte, SignatureSize) - - priv, ok := sk.(*PrivateKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - ctx = []byte(opts.Context) - } - err := SignTo(priv, msg, ctx, false, sig) - if err != nil { - panic(err) - } - - return sig -} - -func (*scheme) Verify( - pk sign.PublicKey, - msg, sig []byte, - opts *sign.SignatureOpts, -) bool { - var ctx []byte - pub, ok := pk.(*PublicKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - ctx = []byte(opts.Context) - } - return Verify(pub, msg, ctx, sig) -} - -func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) { - if len(seed) != SeedSize { - panic(sign.ErrSeedSize) - } - var seed2 [SeedSize]byte - copy(seed2[:], seed) - return NewKeyFromSeed(&seed2) -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) { - if len(buf) != PublicKeySize { - return nil, sign.ErrPubKeySize - } - - var ( - buf2 [PublicKeySize]byte - ret PublicKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) { - if len(buf) != PrivateKeySize { - return nil, sign.ErrPrivKeySize - } - - var ( - buf2 [PrivateKeySize]byte - ret PrivateKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (sk *PrivateKey) Scheme() sign.Scheme { - return sch -} - -func (sk *PublicKey) Scheme() sign.Scheme { - return sch -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/dilithium.go deleted file mode 100644 index 8f1c8e5..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/dilithium.go +++ /dev/null @@ -1,491 +0,0 @@ -// Code generated from mode3/internal/dilithium.go by gen.go - -package internal - -import ( - cryptoRand "crypto/rand" - "crypto/subtle" - "io" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -const ( - // Size of a packed polynomial of norm ≤η. - // (Note that the formula is not valid in general.) - PolyLeqEtaSize = (common.N * DoubleEtaBits) / 8 - - // β = τη, the maximum size of c s₂. - Beta = Tau * Eta - - // γ₁ range of y - Gamma1 = 1 << Gamma1Bits - - // Size of packed polynomial of norm <γ₁ such as z - PolyLeGamma1Size = (Gamma1Bits + 1) * common.N / 8 - - // α = 2γ₂ parameter for decompose - Alpha = 2 * Gamma2 - - // Size of a packed private key - PrivateKeySize = 32 + 32 + TRSize + PolyLeqEtaSize*(L+K) + common.PolyT0Size*K - - // Size of a packed public key - PublicKeySize = 32 + common.PolyT1Size*K - - // Size of a packed signature - SignatureSize = L*PolyLeGamma1Size + Omega + K + CTildeSize - - // Size of packed w₁ - PolyW1Size = (common.N * (common.QBits - Gamma1Bits)) / 8 -) - -// PublicKey is the type of Dilithium public keys. -type PublicKey struct { - rho [32]byte - t1 VecK - - // Cached values - t1p [common.PolyT1Size * K]byte - A *Mat - tr *[TRSize]byte -} - -// PrivateKey is the type of Dilithium private keys. -type PrivateKey struct { - rho [32]byte - key [32]byte - s1 VecL - s2 VecK - t0 VecK - tr [TRSize]byte - - // Cached values - A Mat // ExpandA(ρ) - s1h VecL // NTT(s₁) - s2h VecK // NTT(s₂) - t0h VecK // NTT(t₀) -} - -type unpackedSignature struct { - z VecL - hint VecK - c [CTildeSize]byte -} - -// Packs the signature into buf. -func (sig *unpackedSignature) Pack(buf []byte) { - copy(buf[:], sig.c[:]) - sig.z.PackLeGamma1(buf[CTildeSize:]) - sig.hint.PackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) -} - -// Sets sig to the signature encoded in the buffer. -// -// Returns whether buf contains a properly packed signature. -func (sig *unpackedSignature) Unpack(buf []byte) bool { - if len(buf) < SignatureSize { - return false - } - copy(sig.c[:], buf[:]) - sig.z.UnpackLeGamma1(buf[CTildeSize:]) - if sig.z.Exceeds(Gamma1 - Beta) { - return false - } - if !sig.hint.UnpackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) { - return false - } - return true -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - copy(buf[:32], pk.rho[:]) - copy(buf[32:], pk.t1p[:]) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - copy(pk.rho[:], buf[:32]) - copy(pk.t1p[:], buf[32:]) - - pk.t1.UnpackT1(pk.t1p[:]) - pk.A = new(Mat) - pk.A.Derive(&pk.rho) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - pk.tr = new([TRSize]byte) - h := sha3.NewShake256() - _, _ = h.Write(buf[:]) - _, _ = h.Read(pk.tr[:]) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - copy(buf[:32], sk.rho[:]) - copy(buf[32:64], sk.key[:]) - copy(buf[64:64+TRSize], sk.tr[:]) - offset := 64 + TRSize - sk.s1.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.PackT0(buf[offset:]) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - copy(sk.rho[:], buf[:32]) - copy(sk.key[:], buf[32:64]) - copy(sk.tr[:], buf[64:64+TRSize]) - offset := 64 + TRSize - sk.s1.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.UnpackT0(buf[offset:]) - - // Cached values - sk.A.Derive(&sk.rho) - sk.t0h = sk.t0 - sk.t0h.NTT() - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() -} - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - var seed [32]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - pk, sk := NewKeyFromSeed(&seed) - return pk, sk, nil -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[common.SeedSize]byte) (*PublicKey, *PrivateKey) { - var eSeed [128]byte // expanded seed - var pk PublicKey - var sk PrivateKey - var sSeed [64]byte - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - - if NIST { - _, _ = h.Write([]byte{byte(K), byte(L)}) - } - - _, _ = h.Read(eSeed[:]) - - copy(pk.rho[:], eSeed[:32]) - copy(sSeed[:], eSeed[32:96]) - copy(sk.key[:], eSeed[96:]) - copy(sk.rho[:], pk.rho[:]) - - sk.A.Derive(&pk.rho) - - for i := uint16(0); i < L; i++ { - PolyDeriveUniformLeqEta(&sk.s1[i], &sSeed, i) - } - - for i := uint16(0); i < K; i++ { - PolyDeriveUniformLeqEta(&sk.s2[i], &sSeed, i+L) - } - - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() - - sk.computeT0andT1(&sk.t0, &pk.t1) - - sk.t0h = sk.t0 - sk.t0h.NTT() - - // Complete public key far enough to be packed - pk.t1.PackT1(pk.t1p[:]) - pk.A = &sk.A - - // Finish private key - var packedPk [PublicKeySize]byte - pk.Pack(&packedPk) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - h.Reset() - _, _ = h.Write(packedPk[:]) - _, _ = h.Read(sk.tr[:]) - - // Finish cache of public key - pk.tr = &sk.tr - - return &pk, &sk -} - -// Computes t0 and t1 from sk.s1h, sk.s2 and sk.A. -func (sk *PrivateKey) computeT0andT1(t0, t1 *VecK) { - var t VecK - - // Set t to A s₁ + s₂ - for i := 0; i < K; i++ { - PolyDotHat(&t[i], &sk.A[i], &sk.s1h) - t[i].ReduceLe2Q() - t[i].InvNTT() - } - t.Add(&t, &sk.s2) - t.Normalize() - - // Compute t₀, t₁ = Power2Round(t) - t.Power2Round(t0, t1) -} - -// Verify checks whether the given signature by pk on msg is valid. -// -// For Dilithium this is the top-level verification function. -// In ML-DSA, this is ML-DSA.Verify_internal. -func Verify(pk *PublicKey, msg func(io.Writer), signature []byte) bool { - var sig unpackedSignature - var mu [64]byte - var zh VecL - var Az, Az2dct1, w1 VecK - var ch common.Poly - var cp [CTildeSize]byte - var w1Packed [PolyW1Size * K]byte - - // Note that Unpack() checked whether ‖z‖_∞ < γ₁ - β - // and ensured that there at most ω ones in pk.hint. - if !sig.Unpack(signature) { - return false - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(pk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // Compute Az - zh = sig.z - zh.NTT() - - for i := 0; i < K; i++ { - PolyDotHat(&Az[i], &pk.A[i], &zh) - } - - // Next, we compute Az - 2ᵈ·c·t₁. - // Note that the coefficients of t₁ are bounded by 256 = 2⁹, - // so the coefficients of Az2dct1 will bounded by 2⁹⁺ᵈ = 2²³ < 2q, - // which is small enough for NTT(). - Az2dct1.MulBy2toD(&pk.t1) - Az2dct1.NTT() - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - for i := 0; i < K; i++ { - Az2dct1[i].MulHat(&Az2dct1[i], &ch) - } - Az2dct1.Sub(&Az, &Az2dct1) - Az2dct1.ReduceLe2Q() - Az2dct1.InvNTT() - Az2dct1.NormalizeAssumingLe2Q() - - // UseHint(pk.hint, Az - 2ᵈ·c·t₁) - // = UseHint(pk.hint, w - c·s₂ + c·t₀) - // = UseHint(pk.hint, r + c·t₀) - // = r₁ = w₁. - w1.UseHint(&Az2dct1, &sig.hint) - w1.PackW1(w1Packed[:]) - - // c' = H(μ, w₁) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(cp[:]) - - return sig.c == cp -} - -// SignTo signs the given message and writes the signature into signature. -// -// For Dilithium this is the top-level signing function. For ML-DSA -// this is ML-DSA.Sign_internal. -// -//nolint:funlen -func SignTo(sk *PrivateKey, msg func(io.Writer), rnd [32]byte, signature []byte) { - var mu, rhop [64]byte - var w1Packed [PolyW1Size * K]byte - var y, yh VecL - var w, w0, w1, w0mcs2, ct0, w0mcs2pct0 VecK - var ch common.Poly - var yNonce uint16 - var sig unpackedSignature - - if len(signature) < SignatureSize { - panic("Signature does not fit in that byteslice") - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(sk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // ρ' = CRH(key ‖ μ) - h.Reset() - _, _ = h.Write(sk.key[:]) - if NIST { - _, _ = h.Write(rnd[:]) - } - _, _ = h.Write(mu[:]) - _, _ = h.Read(rhop[:]) - - // Main rejection loop - attempt := 0 - for { - attempt++ - if attempt >= 576 { - // Depending on the mode, one try has a chance between 1/7 and 1/4 - // of succeeding. Thus it is safe to say that 576 iterations - // are enough as (6/7)⁵⁷⁶ < 2⁻¹²⁸. - panic("This should only happen 1 in 2^{128}: something is wrong.") - } - - // y = ExpandMask(ρ', key) - VecLDeriveUniformLeGamma1(&y, &rhop, yNonce) - yNonce += uint16(L) - - // Set w to A y - yh = y - yh.NTT() - for i := 0; i < K; i++ { - PolyDotHat(&w[i], &sk.A[i], &yh) - w[i].ReduceLe2Q() - w[i].InvNTT() - } - - // Decompose w into w₀ and w₁ - w.NormalizeAssumingLe2Q() - w.Decompose(&w0, &w1) - - // c~ = H(μ ‖ w₁) - w1.PackW1(w1Packed[:]) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(sig.c[:]) - - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - - // Ensure ‖ w₀ - c·s2 ‖_∞ < γ₂ - β. - // - // By Lemma 3 of the specification this is equivalent to checking that - // both ‖ r₀ ‖_∞ < γ₂ - β and r₁ = w₁, for the decomposition - // w - c·s₂ = r₁ α + r₀ as computed by decompose(). - // See also §4.1 of the specification. - for i := 0; i < K; i++ { - w0mcs2[i].MulHat(&ch, &sk.s2h[i]) - w0mcs2[i].InvNTT() - } - w0mcs2.Sub(&w0, &w0mcs2) - w0mcs2.Normalize() - - if w0mcs2.Exceeds(Gamma2 - Beta) { - continue - } - - // z = y + c·s₁ - for i := 0; i < L; i++ { - sig.z[i].MulHat(&ch, &sk.s1h[i]) - sig.z[i].InvNTT() - } - sig.z.Add(&sig.z, &y) - sig.z.Normalize() - - // Ensure ‖z‖_∞ < γ₁ - β - if sig.z.Exceeds(Gamma1 - Beta) { - continue - } - - // Compute c·t₀ - for i := 0; i < K; i++ { - ct0[i].MulHat(&ch, &sk.t0h[i]) - ct0[i].InvNTT() - } - ct0.NormalizeAssumingLe2Q() - - // Ensure ‖c·t₀‖_∞ < γ₂. - if ct0.Exceeds(Gamma2) { - continue - } - - // Create the hint to be able to reconstruct w₁ from w - c·s₂ + c·t0. - // Note that we're not using makeHint() in the obvious way as we - // do not know whether ‖ sc·s₂ - c·t₀ ‖_∞ < γ₂. Instead we note - // that our makeHint() is actually the same as a makeHint for a - // different decomposition: - // - // Earlier we ensured indirectly with a check that r₁ = w₁ where - // r = w - c·s₂. Hence r₀ = r - r₁ α = w - c·s₂ - w₁ α = w₀ - c·s₂. - // Thus MakeHint(w₀ - c·s₂ + c·t₀, w₁) = MakeHint(r0 + c·t₀, r₁) - // and UseHint(w - c·s₂ + c·t₀, w₁) = UseHint(r + c·t₀, r₁). - // As we just ensured that ‖ c·t₀ ‖_∞ < γ₂ our usage is correct. - w0mcs2pct0.Add(&w0mcs2, &ct0) - w0mcs2pct0.NormalizeAssumingLe2Q() - hintPop := sig.hint.MakeHint(&w0mcs2pct0, &w1) - if hintPop > Omega { - continue - } - - break - } - - sig.Pack(signature[:]) -} - -// Computes the public key corresponding to this private key. -func (sk *PrivateKey) Public() *PublicKey { - var t0 VecK - pk := &PublicKey{ - rho: sk.rho, - A: &sk.A, - tr: &sk.tr, - } - sk.computeT0andT1(&t0, &pk.t1) - pk.t1.PackT1(pk.t1p[:]) - return pk -} - -// Equal returns whether the two public keys are equal -func (pk *PublicKey) Equal(other *PublicKey) bool { - return pk.rho == other.rho && pk.t1 == other.t1 -} - -// Equal returns whether the two private keys are equal -func (sk *PrivateKey) Equal(other *PrivateKey) bool { - ret := (subtle.ConstantTimeCompare(sk.rho[:], other.rho[:]) & - subtle.ConstantTimeCompare(sk.key[:], other.key[:]) & - subtle.ConstantTimeCompare(sk.tr[:], other.tr[:])) - - acc := uint32(0) - for i := 0; i < L; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s1[i][j] ^ other.s1[i][j] - } - } - for i := 0; i < K; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s2[i][j] ^ other.s2[i][j] - acc |= sk.t0[i][j] ^ other.t0[i][j] - } - } - return (ret & subtle.ConstantTimeEq(int32(acc), 0)) == 1 -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/mat.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/mat.go deleted file mode 100644 index ceaf634..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/mat.go +++ /dev/null @@ -1,59 +0,0 @@ -// Code generated from mode3/internal/mat.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A k by l matrix of polynomials. -type Mat [K]VecL - -// Expands the given seed to a complete matrix. -// -// This function is called ExpandA in the specification. -func (m *Mat) Derive(seed *[32]byte) { - if !DeriveX4Available { - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - PolyDeriveUniform(&m[i][j], seed, (i<<8)+j) - } - } - return - } - - idx := 0 - var nonces [4]uint16 - var ps [4]*common.Poly - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - nonces[idx] = (i << 8) + j - ps[idx] = &m[i][j] - idx++ - if idx == 4 { - idx = 0 - PolyDeriveUniformX4(ps, seed, nonces) - } - } - } - if idx != 0 { - for i := idx; i < 4; i++ { - ps[i] = nil - } - PolyDeriveUniformX4(ps, seed, nonces) - } -} - -// Set p to the inner product of a and b using pointwise multiplication. -// -// Assumes a and b are in Montgomery form and their coefficients are -// pairwise sufficiently small to multiply, see Poly.MulHat(). Resulting -// coefficients are bounded by 2Lq. -func PolyDotHat(p *common.Poly, a, b *VecL) { - var t common.Poly - *p = common.Poly{} // zero p - for i := 0; i < L; i++ { - t.MulHat(&a[i], &b[i]) - p.Add(&t, p) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/pack.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/pack.go deleted file mode 100644 index 1854b41..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/pack.go +++ /dev/null @@ -1,270 +0,0 @@ -// Code generated from mode3/internal/pack.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Writes p with norm less than or equal η into buf, which must be of -// size PolyLeqEtaSize. -// -// Assumes coefficients of p are not normalized, but in [q-η,q+η]. -func PolyPackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - buf[i] = (byte(common.Q+Eta-p[j]) | - byte(common.Q+Eta-p[j+1])<<4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - buf[i] = (byte(common.Q+Eta-p[j]) | - (byte(common.Q+Eta-p[j+1]) << 3) | - (byte(common.Q+Eta-p[j+2]) << 6)) - buf[i+1] = ((byte(common.Q+Eta-p[j+2]) >> 2) | - (byte(common.Q+Eta-p[j+3]) << 1) | - (byte(common.Q+Eta-p[j+4]) << 4) | - (byte(common.Q+Eta-p[j+5]) << 7)) - buf[i+2] = ((byte(common.Q+Eta-p[j+5]) >> 1) | - (byte(common.Q+Eta-p[j+6]) << 2) | - (byte(common.Q+Eta-p[j+7]) << 5)) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Sets p to the polynomial of norm less than or equal η encoded in the -// given buffer of size PolyLeqEtaSize. -// -// Output coefficients of p are not normalized, but in [q-η,q+η] provided -// buf was created using PackLeqEta. -// -// Beware, for arbitrary buf the coefficients of p might end up in -// the interval [q-2^b,q+2^b] where b is the least b with η≤2^b. -func PolyUnpackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - p[j] = common.Q + Eta - uint32(buf[i]&15) - p[j+1] = common.Q + Eta - uint32(buf[i]>>4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - p[j] = common.Q + Eta - uint32(buf[i]&7) - p[j+1] = common.Q + Eta - uint32((buf[i]>>3)&7) - p[j+2] = common.Q + Eta - uint32((buf[i]>>6)|((buf[i+1]<<2)&7)) - p[j+3] = common.Q + Eta - uint32((buf[i+1]>>1)&7) - p[j+4] = common.Q + Eta - uint32((buf[i+1]>>4)&7) - p[j+5] = common.Q + Eta - uint32((buf[i+1]>>7)|((buf[i+2]<<1)&7)) - p[j+6] = common.Q + Eta - uint32((buf[i+2]>>2)&7) - p[j+7] = common.Q + Eta - uint32((buf[i+2]>>5)&7) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Writes v with coefficients in {0, 1} of which at most ω non-zero -// to buf, which must have length ω+k. -func (v *VecK) PackHint(buf []byte) { - // The packed hint starts with the indices of the non-zero coefficients - // For instance: - // - // (x⁵⁶ + x¹⁰⁰, x²⁵⁵, 0, x² + x²³, x¹) - // - // Yields - // - // 56, 100, 255, 2, 23, 1 - // - // Then we pad with zeroes until we have a list of ω items: - // // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0 - // - // Then we finish with a list of the switch-over-indices in this - // list between polynomials, so: - // - // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0, 2, 3, 3, 5, 6 - - off := uint8(0) - for i := 0; i < K; i++ { - for j := uint16(0); j < common.N; j++ { - if v[i][j] != 0 { - buf[off] = uint8(j) - off++ - } - } - buf[Omega+i] = off - } - for ; off < Omega; off++ { - buf[off] = 0 - } -} - -// Sets v to the vector encoded using VecK.PackHint() -// -// Returns whether unpacking was successful. -func (v *VecK) UnpackHint(buf []byte) bool { - // A priori, there would be several reasonable ways to encode the same - // hint vector. We take care to only allow only one encoding, to ensure - // "strong unforgeability". - // - // See PackHint() source for description of the encoding. - *v = VecK{} // zero v - prevSOP := uint8(0) // previous switch-over-point - for i := 0; i < K; i++ { - SOP := buf[Omega+i] - if SOP < prevSOP || SOP > Omega { - return false // ensures switch-over-points are increasing - } - for j := prevSOP; j < SOP; j++ { - if j > prevSOP && buf[j] <= buf[j-1] { - return false // ensures indices are increasing (within a poly) - } - v[i][buf[j]] = 1 - } - prevSOP = SOP - } - for j := prevSOP; j < Omega; j++ { - if buf[j] != 0 { - return false // ensures padding indices are zero - } - } - - return true -} - -// Sets p to the polynomial packed into buf by PolyPackLeGamma1. -// -// p will be normalized. -func PolyUnpackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0x3) << 16) - p1 := uint32(buf[i+2]>>2) | (uint32(buf[i+3]) << 6) | - (uint32(buf[i+4]&0xf) << 14) - p2 := uint32(buf[i+4]>>4) | (uint32(buf[i+5]) << 4) | - (uint32(buf[i+6]&0x3f) << 12) - p3 := uint32(buf[i+6]>>6) | (uint32(buf[i+7]) << 2) | - (uint32(buf[i+8]) << 10) - - // coefficients in [0,…,2γ₁) - p0 = Gamma1 - p0 // (-γ₁,…,γ₁] - p1 = Gamma1 - p1 - p2 = Gamma1 - p2 - p3 = Gamma1 - p3 - - p0 += uint32(int32(p0)>>31) & common.Q // normalize - p1 += uint32(int32(p1)>>31) & common.Q - p2 += uint32(int32(p2)>>31) & common.Q - p3 += uint32(int32(p3)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - p[j+2] = p2 - p[j+3] = p3 - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0xf) << 16) - p1 := uint32(buf[i+2]>>4) | (uint32(buf[i+3]) << 4) | - (uint32(buf[i+4]) << 12) - - p0 = Gamma1 - p0 - p1 = Gamma1 - p1 - - p0 += uint32(int32(p0)>>31) & common.Q - p1 += uint32(int32(p1)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Writes p whose coefficients are in (-γ₁,γ₁] into buf -// which has to be of length PolyLeGamma1Size. -// -// Assumes p is normalized. -func PolyPackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - // coefficients in [0,…,γ₁] ∪ (q-γ₁,…,q) - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := Gamma1 - p[j] // [0,…,γ₁] ∪ (γ₁-q,…,2γ₁-q) - p0 += uint32(int32(p0)>>31) & common.Q // [0,…,2γ₁) - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - p2 := Gamma1 - p[j+2] - p2 += uint32(int32(p2)>>31) & common.Q - p3 := Gamma1 - p[j+3] - p3 += uint32(int32(p3)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<2) - buf[i+3] = byte(p1 >> 6) - buf[i+4] = byte(p1>>14) | byte(p2<<4) - buf[i+5] = byte(p2 >> 4) - buf[i+6] = byte(p2>>12) | byte(p3<<6) - buf[i+7] = byte(p3 >> 2) - buf[i+8] = byte(p3 >> 10) - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - // Coefficients are in [0, γ₁] ∪ (Q-γ₁, Q) - p0 := Gamma1 - p[j] - p0 += uint32(int32(p0)>>31) & common.Q - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<4) - buf[i+3] = byte(p1 >> 4) - buf[i+4] = byte(p1 >> 12) - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Pack w₁ into buf, which must be of length PolyW1Size. -// -// Assumes w₁ is normalized. -func PolyPackW1(p *common.Poly, buf []byte) { - if Gamma1Bits == 19 { - p.PackLe16(buf) - } else if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyW1Size; i += 3 { - buf[i] = byte(p[j]) | byte(p[j+1]<<6) - buf[i+1] = byte(p[j+1]>>2) | byte(p[j+2]<<4) - buf[i+2] = byte(p[j+2]>>4) | byte(p[j+3]<<2) - j += 4 - } - } else { - panic("unsupported γ₁") - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/params.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/params.go deleted file mode 100644 index 8a1f866..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/params.go +++ /dev/null @@ -1,18 +0,0 @@ -// Code generated from params.templ.go. DO NOT EDIT. - -package internal - -const ( - Name = "ML-DSA-65" - K = 6 - L = 5 - Eta = 4 - DoubleEtaBits = 4 - Omega = 55 - Tau = 49 - Gamma1Bits = 19 - Gamma2 = 261888 - NIST = true - TRSize = 64 - CTildeSize = 48 -) diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/rounding.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/rounding.go deleted file mode 100644 index 58123c0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/rounding.go +++ /dev/null @@ -1,142 +0,0 @@ -// Code generated from mode3/internal/rounding.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, -// except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken -// and -α/2 ≤ a₀ < 0. Returns a₀ + q. Note 0 ≤ a₁ < (q-1)/α. -// Recall α = 2γ₂. -func decompose(a uint32) (a0plusQ, a1 uint32) { - // a₁ = ⌈a / 128⌉ - a1 = (a + 127) >> 7 - - if Alpha == 523776 { - // 1025/2²² is close enough to 1/4092 so that a₁ - // becomes a/α rounded down. - a1 = ((a1*1025 + (1 << 21)) >> 22) - - // For the corner-case a₁ = (q-1)/α = 16, we have to set a₁=0. - a1 &= 15 - } else if Alpha == 190464 { - // 1488/2²⁴ is close enough to 1/1488 so that a₁ - // becomes a/α rounded down. - a1 = ((a1 * 11275) + (1 << 23)) >> 24 - - // For the corner-case a₁ = (q-1)/α = 44, we have to set a₁=0. - a1 ^= uint32(int32(43-a1)>>31) & a1 - } else { - panic("unsupported α") - } - - a0plusQ = a - a1*Alpha - - // In the corner-case, when we set a₁=0, we will incorrectly - // have a₀ > (q-1)/2 and we'll need to subtract q. As we - // return a₀ + q, that comes down to adding q if a₀ < (q-1)/2. - a0plusQ += uint32(int32(a0plusQ-(common.Q-1)/2)>>31) & common.Q - - return -} - -// Assume 0 ≤ r, f < Q with ‖f‖_∞ ≤ α/2. Decompose r as r = r1*α + r0 as -// computed by decompose(). Write r' := r - f (mod Q). Now, decompose -// r'=r-f again as r' = r'1*α + r'0 using decompose(). As f is small, we -// have r'1 = r1 + h, where h ∈ {-1, 0, 1}. makeHint() computes |h| -// given z0 := r0 - f (mod Q) and r1. With |h|, which is called the hint, -// we can reconstruct r1 using only r' = r - f, which is done by useHint(). -// To wit: -// -// useHint( r - f, makeHint( r0 - f, r1 ) ) = r1. -// -// Assumes 0 ≤ z0 < Q. -func makeHint(z0, r1 uint32) uint32 { - // If -α/2 < r0 - f ≤ α/2, then r1*α + r0 - f is a valid decomposition of r' - // with the restrictions of decompose() and so r'1 = r1. So the hint - // should be 0. This is covered by the first two inequalities. - // There is one other case: if r0 - f = -α/2, then r1*α + r0 - f is also - // a valid decomposition if r1 = 0. In the other cases a one is carried - // and the hint should be 1. - if z0 <= Gamma2 || z0 > common.Q-Gamma2 || (z0 == common.Q-Gamma2 && r1 == 0) { - return 0 - } - return 1 -} - -// Uses the hint created by makeHint() to reconstruct r1 from r'=r-f; see -// documentation of makeHint() for context. -// Assumes 0 ≤ r' < Q. -func useHint(rp uint32, hint uint32) uint32 { - rp0plusQ, rp1 := decompose(rp) - if hint == 0 { - return rp1 - } - if rp0plusQ > common.Q { - return (rp1 + 1) & 15 - } - return (rp1 - 1) & 15 -} - -// Sets p to the hint polynomial for p0 the modified low bits and p1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint polynomial. -func PolyMakeHint(p, p0, p1 *common.Poly) (pop uint32) { - for i := 0; i < common.N; i++ { - h := makeHint(p0[i], p1[i]) - pop += h - p[i] = h - } - return -} - -// Computes corrections to the high bits of the polynomial q according -// to the hints in h and sets p to the corrected high bits. Returns p. -func PolyUseHint(p, q, hint *common.Poly) { - var q0PlusQ common.Poly - - // See useHint() and makeHint() for an explanation. We reimplement it - // here so that we can call Poly.Decompose(), which might be way faster - // than calling decompose() in a loop (for instance when having AVX2.) - - PolyDecompose(q, &q0PlusQ, p) - - for i := 0; i < common.N; i++ { - if hint[i] == 0 { - continue - } - if Gamma2 == 261888 { - if q0PlusQ[i] > common.Q { - p[i] = (p[i] + 1) & 15 - } else { - p[i] = (p[i] - 1) & 15 - } - } else if Gamma2 == 95232 { - if q0PlusQ[i] > common.Q { - if p[i] == 43 { - p[i] = 0 - } else { - p[i]++ - } - } else { - if p[i] == 0 { - p[i] = 43 - } else { - p[i]-- - } - } - } else { - panic("unsupported γ₂") - } - } -} - -// Splits each of the coefficients of p using decompose. -func PolyDecompose(p, p0PlusQ, p1 *common.Poly) { - for i := 0; i < common.N; i++ { - p0PlusQ[i], p1[i] = decompose(p[i]) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/sample.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/sample.go deleted file mode 100644 index b37370a..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/sample.go +++ /dev/null @@ -1,339 +0,0 @@ -// Code generated from mode3/internal/sample.go by gen.go - -package internal - -import ( - "encoding/binary" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" - "github.com/cloudflare/circl/simd/keccakf1600" -) - -// DeriveX4Available indicates whether the system supports the quick fourway -// sampling variants like PolyDeriveUniformX4. -var DeriveX4Available = keccakf1600.IsEnabledX4() - -// For each i, sample ps[i] uniformly from the given seed and nonces[i]. -// ps[i] may be nil and is ignored in that case. -// -// Can only be called when DeriveX4Available is true. -func PolyDeriveUniformX4(ps [4]*common.Poly, seed *[32]byte, nonces [4]uint16) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < 4; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // Absorb the nonces, the SHAKE128 domain separator (0b1111), the - // start of the padding (0b...001) and the end of the padding 0b100... - // Recall that the rate of SHAKE128 is 168 --- i.e. 21 uint64s. - for j := 0; j < 4; j++ { - state[4*4+j] = uint64(nonces[j]) | (0x1f << 16) - state[20*4+j] = 0x80 << 56 - } - - var idx [4]int // indices into ps - for j := 0; j < 4; j++ { - if ps[j] == nil { - idx[j] = common.N // mark nil polynomial as completed - } - } - - done := false - for !done { - // Applies KeccaK-f[1600] to state to get the next 21 uint64s of each - // of the four SHAKE128 streams. - perm.Permute() - - done = true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - for i := 0; i < 7; i++ { - var t [8]uint32 - t[0] = uint32(state[i*3*4+j] & 0x7fffff) - t[1] = uint32((state[i*3*4+j] >> 24) & 0x7fffff) - t[2] = uint32((state[i*3*4+j] >> 48) | - ((state[(i*3+1)*4+j] & 0x7f) << 16)) - t[3] = uint32((state[(i*3+1)*4+j] >> 8) & 0x7fffff) - t[4] = uint32((state[(i*3+1)*4+j] >> 32) & 0x7fffff) - t[5] = uint32((state[(i*3+1)*4+j] >> 56) | - ((state[(i*3+2)*4+j] & 0x7fff) << 8)) - t[6] = uint32((state[(i*3+2)*4+j] >> 16) & 0x7fffff) - t[7] = uint32((state[(i*3+2)*4+j] >> 40) & 0x7fffff) - - for k := 0; k < 8; k++ { - if t[k] < common.Q { - ps[j][idx[j]] = t[k] - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - } - done = false - } - } -} - -// Sample p uniformly from the given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniform(p *common.Poly, seed *[32]byte, nonce uint16) { - var i, length int - var buf [12 * 16]byte // fits 168B SHAKE-128 rate - - length = 168 - - sample := func() { - // Note that 3 divides into 168 and 12*16, so we use up buf completely. - for j := 0; j < length && i < common.N; j += 3 { - t := (uint32(buf[j]) | (uint32(buf[j+1]) << 8) | - (uint32(buf[j+2]) << 16)) & 0x7fffff - - // We use rejection sampling - if t < common.Q { - p[i] = t - i++ - } - } - } - - var iv [32 + 2]byte // 32 byte seed + uint16 nonce - h := sha3.NewShake128() - copy(iv[:32], seed[:]) - iv[32] = uint8(nonce) - iv[33] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:168]) - sample() - } -} - -// Sample p uniformly with coefficients of norm less than or equal η, -// using the given seed and nonce. -// -// p will not be normalized, but will have coefficients in [q-η,q+η]. -func PolyDeriveUniformLeqEta(p *common.Poly, seed *[64]byte, nonce uint16) { - // Assumes 2 < η < 8. - var i, length int - var buf [9 * 16]byte // fits 136B SHAKE-256 rate - - length = 136 - - sample := func() { - // We use rejection sampling - for j := 0; j < length && i < common.N; j++ { - t1 := uint32(buf[j]) & 15 - t2 := uint32(buf[j]) >> 4 - if Eta == 2 { // branch is eliminated by compiler - if t1 <= 14 { - t1 -= ((205 * t1) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 14 && i < common.N { - t2 -= ((205 * t2) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t2 - i++ - } - } else if Eta == 4 { - if t1 <= 2*Eta { - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 2*Eta && i < common.N { - p[i] = common.Q + Eta - t2 - i++ - } - } else { - panic("unsupported η") - } - } - } - - var iv [64 + 2]byte // 64 byte seed + uint16 nonce - - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - - // 136 is SHAKE-256 rate - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:136]) - sample() - } -} - -// Sample v[i] uniformly with coefficients in (-γ₁,…,γ₁] using the -// given seed and nonce+i -// -// p will be normalized. -func VecLDeriveUniformLeGamma1(v *VecL, seed *[64]byte, nonce uint16) { - for i := 0; i < L; i++ { - PolyDeriveUniformLeGamma1(&v[i], seed, nonce+uint16(i)) - } -} - -// Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the -// given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniformLeGamma1(p *common.Poly, seed *[64]byte, nonce uint16) { - var buf [PolyLeGamma1Size]byte - - var iv [66]byte - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - _, _ = h.Read(buf[:]) - - PolyUnpackLeGamma1(p, buf[:]) -} - -// For each i, sample ps[i] uniformly with τ non-zero coefficients in {q-1,1} -// using the given seed and w1[i]. ps[i] may be nil and is ignored -// in that case. ps[i] will be normalized. -// -// Can only be called when DeriveX4Available is true. -// -// This function is currently not used (yet). -func PolyDeriveUniformBallX4(ps [4]*common.Poly, seed []byte) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < CTildeSize/8; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // SHAKE256 domain separator and padding - for j := 0; j < 4; j++ { - state[(CTildeSize/8)*4+j] ^= 0x1f - state[16*4+j] ^= 0x80 << 56 - } - perm.Permute() - - var signs [4]uint64 - var idx [4]uint16 // indices into ps - - for j := 0; j < 4; j++ { - if ps[j] != nil { - signs[j] = state[j] - *ps[j] = common.Poly{} // zero ps[j] - idx[j] = common.N - Tau - } else { - idx[j] = common.N // mark as completed - } - } - - stateOffset := 1 - for { - done := true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - - for i := stateOffset; i < 17; i++ { - var bs [8]byte - binary.LittleEndian.PutUint64(bs[:], state[4*i+j]) - for k := 0; k < 8; k++ { - b := uint16(bs[k]) - - if b > idx[j] { - continue - } - - ps[j][idx[j]] = ps[j][b] - ps[j][b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - ps[j][b] ^= uint32((-(signs[j] & 1)) & (1 | (common.Q - 1))) - signs[j] >>= 1 - - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - - done = false - } - - if done { - break - } - - perm.Permute() - stateOffset = 0 - } -} - -// Samples p uniformly with τ non-zero coefficients in {q-1,1}. -// -// The polynomial p will be normalized. -func PolyDeriveUniformBall(p *common.Poly, seed []byte) { - var buf [136]byte // SHAKE-256 rate is 136 - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - _, _ = h.Read(buf[:]) - - // Essentially we generate a sequence of τ ones or minus ones, - // prepend 196 zeroes and shuffle the concatenation using the - // usual algorithm (Fisher--Yates.) - signs := binary.LittleEndian.Uint64(buf[:]) - bufOff := 8 // offset into buf - - *p = common.Poly{} // zero p - for i := uint16(common.N - Tau); i < common.N; i++ { - var b uint16 - - // Find location of where to move the new coefficient to using - // rejection sampling. - for { - if bufOff >= 136 { - _, _ = h.Read(buf[:]) - bufOff = 0 - } - - b = uint16(buf[bufOff]) - bufOff++ - - if b <= i { - break - } - } - - p[i] = p[b] - p[b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - p[b] ^= uint32((-(signs & 1)) & (1 | (common.Q - 1))) - signs >>= 1 - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/vec.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/vec.go deleted file mode 100644 index d07d3b2..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa65/internal/vec.go +++ /dev/null @@ -1,281 +0,0 @@ -// Code generated from mode3/internal/vec.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A vector of L polynomials. -type VecL [L]common.Poly - -// A vector of K polynomials. -type VecK [K]common.Poly - -// Normalize the polynomials in this vector. -func (v *VecL) Normalize() { - for i := 0; i < L; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecL) NormalizeAssumingLe2Q() { - for i := 0; i < L; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecL) Add(w, u *VecL) { - for i := 0; i < L; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecL) NTT() { - for i := 0; i < L; i++ { - v[i].NTT() - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecL) Exceeds(bound uint32) bool { - for i := 0; i < L; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Power2Round(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Decompose(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecL) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeqEta(). -func (v *VecL) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sequentially packs each polynomial using PolyPackLeGamma1(). -func (v *VecL) PackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeGamma1(). -func (v *VecL) UnpackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Normalize the polynomials in this vector. -func (v *VecK) Normalize() { - for i := 0; i < K; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecK) NormalizeAssumingLe2Q() { - for i := 0; i < K; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecK) Add(w, u *VecK) { - for i := 0; i < K; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecK) Exceeds(bound uint32) bool { - for i := 0; i < K; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Power2Round(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Decompose(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sets v to the hint vector for v0 the modified low bits and v1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint vector. -func (v *VecK) MakeHint(v0, v1 *VecK) (pop uint32) { - for i := 0; i < K; i++ { - pop += PolyMakeHint(&v[i], &v0[i], &v1[i]) - } - return -} - -// Computes corrections to the high bits of the polynomials in the vector -// w using the hints in h and sets v to the corrected high bits. Returns v. -// See useHint(). -func (v *VecK) UseHint(q, hint *VecK) *VecK { - for i := 0; i < K; i++ { - PolyUseHint(&v[i], &q[i], &hint[i]) - } - return v -} - -// Sequentially packs each polynomial using Poly.PackT1(). -func (v *VecK) PackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sets v to the vector packed into buf by PackT1(). -func (v *VecK) UnpackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sequentially packs each polynomial using Poly.PackT0(). -func (v *VecK) PackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sets v to the vector packed into buf by PackT0(). -func (v *VecK) UnpackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecK) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecK.PackLeqEta(). -func (v *VecK) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecK) NTT() { - for i := 0; i < K; i++ { - v[i].NTT() - } -} - -// Sequentially packs each polynomial using PolyPackW1(). -func (v *VecK) PackW1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackW1(&v[i], buf[offset:]) - offset += PolyW1Size - } -} - -// Sets v to a - b. -// -// Warning: assumes coefficients of the polynomials of b are less than 2q. -func (v *VecK) Sub(a, b *VecK) { - for i := 0; i < K; i++ { - v[i].Sub(&a[i], &b[i]) - } -} - -// Sets v to 2ᵈ w without reducing. -func (v *VecK) MulBy2toD(w *VecK) { - for i := 0; i < K; i++ { - v[i].MulBy2toD(&w[i]) - } -} - -// Applies InvNTT componentwise. See Poly.InvNTT() for details. -func (v *VecK) InvNTT() { - for i := 0; i < K; i++ { - v[i].InvNTT() - } -} - -// Applies Poly.ReduceLe2Q() componentwise. -func (v *VecK) ReduceLe2Q() { - for i := 0; i < K; i++ { - v[i].ReduceLe2Q() - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/dilithium.go deleted file mode 100644 index cb016e7..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/dilithium.go +++ /dev/null @@ -1,361 +0,0 @@ -// Code generated from pkg.templ.go. DO NOT EDIT. - -// mldsa87 implements NIST signature scheme ML-DSA-87 as defined in FIPS204. -package mldsa87 - -import ( - "crypto" - cryptoRand "crypto/rand" - "encoding/asn1" - "errors" - "io" - - "github.com/cloudflare/circl/sign" - common "github.com/cloudflare/circl/sign/internal/dilithium" - "github.com/cloudflare/circl/sign/mldsa/mldsa87/internal" -) - -const ( - // Size of seed for NewKeyFromSeed - SeedSize = common.SeedSize - - // Size of a packed PublicKey - PublicKeySize = internal.PublicKeySize - - // Size of a packed PrivateKey - PrivateKeySize = internal.PrivateKeySize - - // Size of a signature - SignatureSize = internal.SignatureSize -) - -// PublicKey is the type of ML-DSA-87 public key -type PublicKey internal.PublicKey - -// PrivateKey is the type of ML-DSA-87 private key -type PrivateKey internal.PrivateKey - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - pk, sk, err := internal.GenerateKey(rand) - return (*PublicKey)(pk), (*PrivateKey)(sk), err -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[SeedSize]byte) (*PublicKey, *PrivateKey) { - pk, sk := internal.NewKeyFromSeed(seed) - return (*PublicKey)(pk), (*PrivateKey)(sk) -} - -// SignTo signs the given message and writes the signature into signature. -// It will panic if signature is not of length at least SignatureSize. -// -// ctx is the optional context string. Errors if ctx is larger than 255 bytes. -// A nil context string is equivalent to an empty context string. -func SignTo(sk *PrivateKey, msg, ctx []byte, randomized bool, sig []byte) error { - var rnd [32]byte - if randomized { - _, err := cryptoRand.Read(rnd[:]) - if err != nil { - return err - } - } - - if len(ctx) > 255 { - return sign.ErrContextTooLong - } - - internal.SignTo( - (*internal.PrivateKey)(sk), - func(w io.Writer) { - _, _ = w.Write([]byte{0}) - _, _ = w.Write([]byte{byte(len(ctx))}) - - if ctx != nil { - _, _ = w.Write(ctx) - } - w.Write(msg) - }, - rnd, - sig, - ) - return nil -} - -// Do not use. Implements ML-DSA.Sign_internal used for compatibility tests. -func (sk *PrivateKey) unsafeSignInternal(msg []byte, rnd [32]byte) []byte { - var ret [SignatureSize]byte - internal.SignTo( - (*internal.PrivateKey)(sk), - func(w io.Writer) { - _, _ = w.Write(msg) - }, - rnd, - ret[:], - ) - return ret[:] -} - -// Do not use. Implements ML-DSA.Verify_internal used for compatibility tests. -func unsafeVerifyInternal(pk *PublicKey, msg, sig []byte) bool { - return internal.Verify( - (*internal.PublicKey)(pk), - func(w io.Writer) { - _, _ = w.Write(msg) - }, - sig, - ) -} - -// Verify checks whether the given signature by pk on msg is valid. -// -// ctx is the optional context string. Fails if ctx is larger than 255 bytes. -// A nil context string is equivalent to an empty context string. -func Verify(pk *PublicKey, msg, ctx, sig []byte) bool { - if len(ctx) > 255 { - return false - } - return internal.Verify( - (*internal.PublicKey)(pk), - func(w io.Writer) { - _, _ = w.Write([]byte{0}) - _, _ = w.Write([]byte{byte(len(ctx))}) - - if ctx != nil { - _, _ = w.Write(ctx) - } - _, _ = w.Write(msg) - }, - sig, - ) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Unpack(buf) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Unpack(buf) -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - (*internal.PublicKey)(pk).Pack(buf) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - (*internal.PrivateKey)(sk).Pack(buf) -} - -// Packs the public key. -func (pk *PublicKey) Bytes() []byte { - var buf [PublicKeySize]byte - pk.Pack(&buf) - return buf[:] -} - -// Packs the private key. -func (sk *PrivateKey) Bytes() []byte { - var buf [PrivateKeySize]byte - sk.Pack(&buf) - return buf[:] -} - -// Packs the public key. -func (pk *PublicKey) MarshalBinary() ([]byte, error) { - return pk.Bytes(), nil -} - -// Packs the private key. -func (sk *PrivateKey) MarshalBinary() ([]byte, error) { - return sk.Bytes(), nil -} - -// Unpacks the public key from data. -func (pk *PublicKey) UnmarshalBinary(data []byte) error { - if len(data) != PublicKeySize { - return errors.New("packed public key must be of mldsa87.PublicKeySize bytes") - } - var buf [PublicKeySize]byte - copy(buf[:], data) - pk.Unpack(&buf) - return nil -} - -// Unpacks the private key from data. -func (sk *PrivateKey) UnmarshalBinary(data []byte) error { - if len(data) != PrivateKeySize { - return errors.New("packed private key must be of mldsa87.PrivateKeySize bytes") - } - var buf [PrivateKeySize]byte - copy(buf[:], data) - sk.Unpack(&buf) - return nil -} - -// Sign signs the given message. -// -// opts.HashFunc() must return zero, which can be achieved by passing -// crypto.Hash(0) for opts. rand is ignored. Will only return an error -// if opts.HashFunc() is non-zero. -// -// This function is used to make PrivateKey implement the crypto.Signer -// interface. The package-level SignTo function might be more convenient -// to use. -func (sk *PrivateKey) Sign(rand io.Reader, msg []byte, opts crypto.SignerOpts) ( - sig []byte, err error) { - var ret [SignatureSize]byte - - if opts.HashFunc() != crypto.Hash(0) { - return nil, errors.New("dilithium: cannot sign hashed message") - } - if err = SignTo(sk, msg, nil, false, ret[:]); err != nil { - return nil, err - } - - return ret[:], nil -} - -// Computes the public key corresponding to this private key. -// -// Returns a *PublicKey. The type crypto.PublicKey is used to make -// PrivateKey implement the crypto.Signer interface. -func (sk *PrivateKey) Public() crypto.PublicKey { - return (*PublicKey)((*internal.PrivateKey)(sk).Public()) -} - -// Equal returns whether the two private keys equal. -func (sk *PrivateKey) Equal(other crypto.PrivateKey) bool { - castOther, ok := other.(*PrivateKey) - if !ok { - return false - } - return (*internal.PrivateKey)(sk).Equal((*internal.PrivateKey)(castOther)) -} - -// Equal returns whether the two public keys equal. -func (pk *PublicKey) Equal(other crypto.PublicKey) bool { - castOther, ok := other.(*PublicKey) - if !ok { - return false - } - return (*internal.PublicKey)(pk).Equal((*internal.PublicKey)(castOther)) -} - -// Boilerplate for generic signatures API - -type scheme struct{} - -var sch sign.Scheme = &scheme{} - -// Scheme returns a generic signature interface for ML-DSA-87. -func Scheme() sign.Scheme { return sch } - -func (*scheme) Name() string { return "ML-DSA-87" } -func (*scheme) PublicKeySize() int { return PublicKeySize } -func (*scheme) PrivateKeySize() int { return PrivateKeySize } -func (*scheme) SignatureSize() int { return SignatureSize } -func (*scheme) SeedSize() int { return SeedSize } - -// TODO TLSIdentifier() -func (*scheme) Oid() asn1.ObjectIdentifier { - return asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 19} -} - -func (*scheme) SupportsContext() bool { - return true -} - -func (*scheme) GenerateKey() (sign.PublicKey, sign.PrivateKey, error) { - return GenerateKey(nil) -} - -func (*scheme) Sign( - sk sign.PrivateKey, - msg []byte, - opts *sign.SignatureOpts, -) []byte { - var ctx []byte - sig := make([]byte, SignatureSize) - - priv, ok := sk.(*PrivateKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - ctx = []byte(opts.Context) - } - err := SignTo(priv, msg, ctx, false, sig) - if err != nil { - panic(err) - } - - return sig -} - -func (*scheme) Verify( - pk sign.PublicKey, - msg, sig []byte, - opts *sign.SignatureOpts, -) bool { - var ctx []byte - pub, ok := pk.(*PublicKey) - if !ok { - panic(sign.ErrTypeMismatch) - } - if opts != nil && opts.Context != "" { - ctx = []byte(opts.Context) - } - return Verify(pub, msg, ctx, sig) -} - -func (*scheme) DeriveKey(seed []byte) (sign.PublicKey, sign.PrivateKey) { - if len(seed) != SeedSize { - panic(sign.ErrSeedSize) - } - var seed2 [SeedSize]byte - copy(seed2[:], seed) - return NewKeyFromSeed(&seed2) -} - -func (*scheme) UnmarshalBinaryPublicKey(buf []byte) (sign.PublicKey, error) { - if len(buf) != PublicKeySize { - return nil, sign.ErrPubKeySize - } - - var ( - buf2 [PublicKeySize]byte - ret PublicKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (*scheme) UnmarshalBinaryPrivateKey(buf []byte) (sign.PrivateKey, error) { - if len(buf) != PrivateKeySize { - return nil, sign.ErrPrivKeySize - } - - var ( - buf2 [PrivateKeySize]byte - ret PrivateKey - ) - - copy(buf2[:], buf) - ret.Unpack(&buf2) - return &ret, nil -} - -func (sk *PrivateKey) Scheme() sign.Scheme { - return sch -} - -func (sk *PublicKey) Scheme() sign.Scheme { - return sch -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/dilithium.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/dilithium.go deleted file mode 100644 index 8f1c8e5..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/dilithium.go +++ /dev/null @@ -1,491 +0,0 @@ -// Code generated from mode3/internal/dilithium.go by gen.go - -package internal - -import ( - cryptoRand "crypto/rand" - "crypto/subtle" - "io" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -const ( - // Size of a packed polynomial of norm ≤η. - // (Note that the formula is not valid in general.) - PolyLeqEtaSize = (common.N * DoubleEtaBits) / 8 - - // β = τη, the maximum size of c s₂. - Beta = Tau * Eta - - // γ₁ range of y - Gamma1 = 1 << Gamma1Bits - - // Size of packed polynomial of norm <γ₁ such as z - PolyLeGamma1Size = (Gamma1Bits + 1) * common.N / 8 - - // α = 2γ₂ parameter for decompose - Alpha = 2 * Gamma2 - - // Size of a packed private key - PrivateKeySize = 32 + 32 + TRSize + PolyLeqEtaSize*(L+K) + common.PolyT0Size*K - - // Size of a packed public key - PublicKeySize = 32 + common.PolyT1Size*K - - // Size of a packed signature - SignatureSize = L*PolyLeGamma1Size + Omega + K + CTildeSize - - // Size of packed w₁ - PolyW1Size = (common.N * (common.QBits - Gamma1Bits)) / 8 -) - -// PublicKey is the type of Dilithium public keys. -type PublicKey struct { - rho [32]byte - t1 VecK - - // Cached values - t1p [common.PolyT1Size * K]byte - A *Mat - tr *[TRSize]byte -} - -// PrivateKey is the type of Dilithium private keys. -type PrivateKey struct { - rho [32]byte - key [32]byte - s1 VecL - s2 VecK - t0 VecK - tr [TRSize]byte - - // Cached values - A Mat // ExpandA(ρ) - s1h VecL // NTT(s₁) - s2h VecK // NTT(s₂) - t0h VecK // NTT(t₀) -} - -type unpackedSignature struct { - z VecL - hint VecK - c [CTildeSize]byte -} - -// Packs the signature into buf. -func (sig *unpackedSignature) Pack(buf []byte) { - copy(buf[:], sig.c[:]) - sig.z.PackLeGamma1(buf[CTildeSize:]) - sig.hint.PackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) -} - -// Sets sig to the signature encoded in the buffer. -// -// Returns whether buf contains a properly packed signature. -func (sig *unpackedSignature) Unpack(buf []byte) bool { - if len(buf) < SignatureSize { - return false - } - copy(sig.c[:], buf[:]) - sig.z.UnpackLeGamma1(buf[CTildeSize:]) - if sig.z.Exceeds(Gamma1 - Beta) { - return false - } - if !sig.hint.UnpackHint(buf[CTildeSize+L*PolyLeGamma1Size:]) { - return false - } - return true -} - -// Packs the public key into buf. -func (pk *PublicKey) Pack(buf *[PublicKeySize]byte) { - copy(buf[:32], pk.rho[:]) - copy(buf[32:], pk.t1p[:]) -} - -// Sets pk to the public key encoded in buf. -func (pk *PublicKey) Unpack(buf *[PublicKeySize]byte) { - copy(pk.rho[:], buf[:32]) - copy(pk.t1p[:], buf[32:]) - - pk.t1.UnpackT1(pk.t1p[:]) - pk.A = new(Mat) - pk.A.Derive(&pk.rho) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - pk.tr = new([TRSize]byte) - h := sha3.NewShake256() - _, _ = h.Write(buf[:]) - _, _ = h.Read(pk.tr[:]) -} - -// Packs the private key into buf. -func (sk *PrivateKey) Pack(buf *[PrivateKeySize]byte) { - copy(buf[:32], sk.rho[:]) - copy(buf[32:64], sk.key[:]) - copy(buf[64:64+TRSize], sk.tr[:]) - offset := 64 + TRSize - sk.s1.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.PackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.PackT0(buf[offset:]) -} - -// Sets sk to the private key encoded in buf. -func (sk *PrivateKey) Unpack(buf *[PrivateKeySize]byte) { - copy(sk.rho[:], buf[:32]) - copy(sk.key[:], buf[32:64]) - copy(sk.tr[:], buf[64:64+TRSize]) - offset := 64 + TRSize - sk.s1.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * L - sk.s2.UnpackLeqEta(buf[offset:]) - offset += PolyLeqEtaSize * K - sk.t0.UnpackT0(buf[offset:]) - - // Cached values - sk.A.Derive(&sk.rho) - sk.t0h = sk.t0 - sk.t0h.NTT() - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() -} - -// GenerateKey generates a public/private key pair using entropy from rand. -// If rand is nil, crypto/rand.Reader will be used. -func GenerateKey(rand io.Reader) (*PublicKey, *PrivateKey, error) { - var seed [32]byte - if rand == nil { - rand = cryptoRand.Reader - } - _, err := io.ReadFull(rand, seed[:]) - if err != nil { - return nil, nil, err - } - pk, sk := NewKeyFromSeed(&seed) - return pk, sk, nil -} - -// NewKeyFromSeed derives a public/private key pair using the given seed. -func NewKeyFromSeed(seed *[common.SeedSize]byte) (*PublicKey, *PrivateKey) { - var eSeed [128]byte // expanded seed - var pk PublicKey - var sk PrivateKey - var sSeed [64]byte - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - - if NIST { - _, _ = h.Write([]byte{byte(K), byte(L)}) - } - - _, _ = h.Read(eSeed[:]) - - copy(pk.rho[:], eSeed[:32]) - copy(sSeed[:], eSeed[32:96]) - copy(sk.key[:], eSeed[96:]) - copy(sk.rho[:], pk.rho[:]) - - sk.A.Derive(&pk.rho) - - for i := uint16(0); i < L; i++ { - PolyDeriveUniformLeqEta(&sk.s1[i], &sSeed, i) - } - - for i := uint16(0); i < K; i++ { - PolyDeriveUniformLeqEta(&sk.s2[i], &sSeed, i+L) - } - - sk.s1h = sk.s1 - sk.s1h.NTT() - sk.s2h = sk.s2 - sk.s2h.NTT() - - sk.computeT0andT1(&sk.t0, &pk.t1) - - sk.t0h = sk.t0 - sk.t0h.NTT() - - // Complete public key far enough to be packed - pk.t1.PackT1(pk.t1p[:]) - pk.A = &sk.A - - // Finish private key - var packedPk [PublicKeySize]byte - pk.Pack(&packedPk) - - // tr = CRH(ρ ‖ t1) = CRH(pk) - h.Reset() - _, _ = h.Write(packedPk[:]) - _, _ = h.Read(sk.tr[:]) - - // Finish cache of public key - pk.tr = &sk.tr - - return &pk, &sk -} - -// Computes t0 and t1 from sk.s1h, sk.s2 and sk.A. -func (sk *PrivateKey) computeT0andT1(t0, t1 *VecK) { - var t VecK - - // Set t to A s₁ + s₂ - for i := 0; i < K; i++ { - PolyDotHat(&t[i], &sk.A[i], &sk.s1h) - t[i].ReduceLe2Q() - t[i].InvNTT() - } - t.Add(&t, &sk.s2) - t.Normalize() - - // Compute t₀, t₁ = Power2Round(t) - t.Power2Round(t0, t1) -} - -// Verify checks whether the given signature by pk on msg is valid. -// -// For Dilithium this is the top-level verification function. -// In ML-DSA, this is ML-DSA.Verify_internal. -func Verify(pk *PublicKey, msg func(io.Writer), signature []byte) bool { - var sig unpackedSignature - var mu [64]byte - var zh VecL - var Az, Az2dct1, w1 VecK - var ch common.Poly - var cp [CTildeSize]byte - var w1Packed [PolyW1Size * K]byte - - // Note that Unpack() checked whether ‖z‖_∞ < γ₁ - β - // and ensured that there at most ω ones in pk.hint. - if !sig.Unpack(signature) { - return false - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(pk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // Compute Az - zh = sig.z - zh.NTT() - - for i := 0; i < K; i++ { - PolyDotHat(&Az[i], &pk.A[i], &zh) - } - - // Next, we compute Az - 2ᵈ·c·t₁. - // Note that the coefficients of t₁ are bounded by 256 = 2⁹, - // so the coefficients of Az2dct1 will bounded by 2⁹⁺ᵈ = 2²³ < 2q, - // which is small enough for NTT(). - Az2dct1.MulBy2toD(&pk.t1) - Az2dct1.NTT() - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - for i := 0; i < K; i++ { - Az2dct1[i].MulHat(&Az2dct1[i], &ch) - } - Az2dct1.Sub(&Az, &Az2dct1) - Az2dct1.ReduceLe2Q() - Az2dct1.InvNTT() - Az2dct1.NormalizeAssumingLe2Q() - - // UseHint(pk.hint, Az - 2ᵈ·c·t₁) - // = UseHint(pk.hint, w - c·s₂ + c·t₀) - // = UseHint(pk.hint, r + c·t₀) - // = r₁ = w₁. - w1.UseHint(&Az2dct1, &sig.hint) - w1.PackW1(w1Packed[:]) - - // c' = H(μ, w₁) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(cp[:]) - - return sig.c == cp -} - -// SignTo signs the given message and writes the signature into signature. -// -// For Dilithium this is the top-level signing function. For ML-DSA -// this is ML-DSA.Sign_internal. -// -//nolint:funlen -func SignTo(sk *PrivateKey, msg func(io.Writer), rnd [32]byte, signature []byte) { - var mu, rhop [64]byte - var w1Packed [PolyW1Size * K]byte - var y, yh VecL - var w, w0, w1, w0mcs2, ct0, w0mcs2pct0 VecK - var ch common.Poly - var yNonce uint16 - var sig unpackedSignature - - if len(signature) < SignatureSize { - panic("Signature does not fit in that byteslice") - } - - // μ = CRH(tr ‖ msg) - h := sha3.NewShake256() - _, _ = h.Write(sk.tr[:]) - msg(&h) - _, _ = h.Read(mu[:]) - - // ρ' = CRH(key ‖ μ) - h.Reset() - _, _ = h.Write(sk.key[:]) - if NIST { - _, _ = h.Write(rnd[:]) - } - _, _ = h.Write(mu[:]) - _, _ = h.Read(rhop[:]) - - // Main rejection loop - attempt := 0 - for { - attempt++ - if attempt >= 576 { - // Depending on the mode, one try has a chance between 1/7 and 1/4 - // of succeeding. Thus it is safe to say that 576 iterations - // are enough as (6/7)⁵⁷⁶ < 2⁻¹²⁸. - panic("This should only happen 1 in 2^{128}: something is wrong.") - } - - // y = ExpandMask(ρ', key) - VecLDeriveUniformLeGamma1(&y, &rhop, yNonce) - yNonce += uint16(L) - - // Set w to A y - yh = y - yh.NTT() - for i := 0; i < K; i++ { - PolyDotHat(&w[i], &sk.A[i], &yh) - w[i].ReduceLe2Q() - w[i].InvNTT() - } - - // Decompose w into w₀ and w₁ - w.NormalizeAssumingLe2Q() - w.Decompose(&w0, &w1) - - // c~ = H(μ ‖ w₁) - w1.PackW1(w1Packed[:]) - h.Reset() - _, _ = h.Write(mu[:]) - _, _ = h.Write(w1Packed[:]) - _, _ = h.Read(sig.c[:]) - - PolyDeriveUniformBall(&ch, sig.c[:]) - ch.NTT() - - // Ensure ‖ w₀ - c·s2 ‖_∞ < γ₂ - β. - // - // By Lemma 3 of the specification this is equivalent to checking that - // both ‖ r₀ ‖_∞ < γ₂ - β and r₁ = w₁, for the decomposition - // w - c·s₂ = r₁ α + r₀ as computed by decompose(). - // See also §4.1 of the specification. - for i := 0; i < K; i++ { - w0mcs2[i].MulHat(&ch, &sk.s2h[i]) - w0mcs2[i].InvNTT() - } - w0mcs2.Sub(&w0, &w0mcs2) - w0mcs2.Normalize() - - if w0mcs2.Exceeds(Gamma2 - Beta) { - continue - } - - // z = y + c·s₁ - for i := 0; i < L; i++ { - sig.z[i].MulHat(&ch, &sk.s1h[i]) - sig.z[i].InvNTT() - } - sig.z.Add(&sig.z, &y) - sig.z.Normalize() - - // Ensure ‖z‖_∞ < γ₁ - β - if sig.z.Exceeds(Gamma1 - Beta) { - continue - } - - // Compute c·t₀ - for i := 0; i < K; i++ { - ct0[i].MulHat(&ch, &sk.t0h[i]) - ct0[i].InvNTT() - } - ct0.NormalizeAssumingLe2Q() - - // Ensure ‖c·t₀‖_∞ < γ₂. - if ct0.Exceeds(Gamma2) { - continue - } - - // Create the hint to be able to reconstruct w₁ from w - c·s₂ + c·t0. - // Note that we're not using makeHint() in the obvious way as we - // do not know whether ‖ sc·s₂ - c·t₀ ‖_∞ < γ₂. Instead we note - // that our makeHint() is actually the same as a makeHint for a - // different decomposition: - // - // Earlier we ensured indirectly with a check that r₁ = w₁ where - // r = w - c·s₂. Hence r₀ = r - r₁ α = w - c·s₂ - w₁ α = w₀ - c·s₂. - // Thus MakeHint(w₀ - c·s₂ + c·t₀, w₁) = MakeHint(r0 + c·t₀, r₁) - // and UseHint(w - c·s₂ + c·t₀, w₁) = UseHint(r + c·t₀, r₁). - // As we just ensured that ‖ c·t₀ ‖_∞ < γ₂ our usage is correct. - w0mcs2pct0.Add(&w0mcs2, &ct0) - w0mcs2pct0.NormalizeAssumingLe2Q() - hintPop := sig.hint.MakeHint(&w0mcs2pct0, &w1) - if hintPop > Omega { - continue - } - - break - } - - sig.Pack(signature[:]) -} - -// Computes the public key corresponding to this private key. -func (sk *PrivateKey) Public() *PublicKey { - var t0 VecK - pk := &PublicKey{ - rho: sk.rho, - A: &sk.A, - tr: &sk.tr, - } - sk.computeT0andT1(&t0, &pk.t1) - pk.t1.PackT1(pk.t1p[:]) - return pk -} - -// Equal returns whether the two public keys are equal -func (pk *PublicKey) Equal(other *PublicKey) bool { - return pk.rho == other.rho && pk.t1 == other.t1 -} - -// Equal returns whether the two private keys are equal -func (sk *PrivateKey) Equal(other *PrivateKey) bool { - ret := (subtle.ConstantTimeCompare(sk.rho[:], other.rho[:]) & - subtle.ConstantTimeCompare(sk.key[:], other.key[:]) & - subtle.ConstantTimeCompare(sk.tr[:], other.tr[:])) - - acc := uint32(0) - for i := 0; i < L; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s1[i][j] ^ other.s1[i][j] - } - } - for i := 0; i < K; i++ { - for j := 0; j < common.N; j++ { - acc |= sk.s2[i][j] ^ other.s2[i][j] - acc |= sk.t0[i][j] ^ other.t0[i][j] - } - } - return (ret & subtle.ConstantTimeEq(int32(acc), 0)) == 1 -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/mat.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/mat.go deleted file mode 100644 index ceaf634..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/mat.go +++ /dev/null @@ -1,59 +0,0 @@ -// Code generated from mode3/internal/mat.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A k by l matrix of polynomials. -type Mat [K]VecL - -// Expands the given seed to a complete matrix. -// -// This function is called ExpandA in the specification. -func (m *Mat) Derive(seed *[32]byte) { - if !DeriveX4Available { - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - PolyDeriveUniform(&m[i][j], seed, (i<<8)+j) - } - } - return - } - - idx := 0 - var nonces [4]uint16 - var ps [4]*common.Poly - for i := uint16(0); i < K; i++ { - for j := uint16(0); j < L; j++ { - nonces[idx] = (i << 8) + j - ps[idx] = &m[i][j] - idx++ - if idx == 4 { - idx = 0 - PolyDeriveUniformX4(ps, seed, nonces) - } - } - } - if idx != 0 { - for i := idx; i < 4; i++ { - ps[i] = nil - } - PolyDeriveUniformX4(ps, seed, nonces) - } -} - -// Set p to the inner product of a and b using pointwise multiplication. -// -// Assumes a and b are in Montgomery form and their coefficients are -// pairwise sufficiently small to multiply, see Poly.MulHat(). Resulting -// coefficients are bounded by 2Lq. -func PolyDotHat(p *common.Poly, a, b *VecL) { - var t common.Poly - *p = common.Poly{} // zero p - for i := 0; i < L; i++ { - t.MulHat(&a[i], &b[i]) - p.Add(&t, p) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/pack.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/pack.go deleted file mode 100644 index 1854b41..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/pack.go +++ /dev/null @@ -1,270 +0,0 @@ -// Code generated from mode3/internal/pack.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Writes p with norm less than or equal η into buf, which must be of -// size PolyLeqEtaSize. -// -// Assumes coefficients of p are not normalized, but in [q-η,q+η]. -func PolyPackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - buf[i] = (byte(common.Q+Eta-p[j]) | - byte(common.Q+Eta-p[j+1])<<4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - buf[i] = (byte(common.Q+Eta-p[j]) | - (byte(common.Q+Eta-p[j+1]) << 3) | - (byte(common.Q+Eta-p[j+2]) << 6)) - buf[i+1] = ((byte(common.Q+Eta-p[j+2]) >> 2) | - (byte(common.Q+Eta-p[j+3]) << 1) | - (byte(common.Q+Eta-p[j+4]) << 4) | - (byte(common.Q+Eta-p[j+5]) << 7)) - buf[i+2] = ((byte(common.Q+Eta-p[j+5]) >> 1) | - (byte(common.Q+Eta-p[j+6]) << 2) | - (byte(common.Q+Eta-p[j+7]) << 5)) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Sets p to the polynomial of norm less than or equal η encoded in the -// given buffer of size PolyLeqEtaSize. -// -// Output coefficients of p are not normalized, but in [q-η,q+η] provided -// buf was created using PackLeqEta. -// -// Beware, for arbitrary buf the coefficients of p might end up in -// the interval [q-2^b,q+2^b] where b is the least b with η≤2^b. -func PolyUnpackLeqEta(p *common.Poly, buf []byte) { - if DoubleEtaBits == 4 { // compiler eliminates branch - j := 0 - for i := 0; i < PolyLeqEtaSize; i++ { - p[j] = common.Q + Eta - uint32(buf[i]&15) - p[j+1] = common.Q + Eta - uint32(buf[i]>>4) - j += 2 - } - } else if DoubleEtaBits == 3 { - j := 0 - for i := 0; i < PolyLeqEtaSize; i += 3 { - p[j] = common.Q + Eta - uint32(buf[i]&7) - p[j+1] = common.Q + Eta - uint32((buf[i]>>3)&7) - p[j+2] = common.Q + Eta - uint32((buf[i]>>6)|((buf[i+1]<<2)&7)) - p[j+3] = common.Q + Eta - uint32((buf[i+1]>>1)&7) - p[j+4] = common.Q + Eta - uint32((buf[i+1]>>4)&7) - p[j+5] = common.Q + Eta - uint32((buf[i+1]>>7)|((buf[i+2]<<1)&7)) - p[j+6] = common.Q + Eta - uint32((buf[i+2]>>2)&7) - p[j+7] = common.Q + Eta - uint32((buf[i+2]>>5)&7) - j += 8 - } - } else { - panic("eta not supported") - } -} - -// Writes v with coefficients in {0, 1} of which at most ω non-zero -// to buf, which must have length ω+k. -func (v *VecK) PackHint(buf []byte) { - // The packed hint starts with the indices of the non-zero coefficients - // For instance: - // - // (x⁵⁶ + x¹⁰⁰, x²⁵⁵, 0, x² + x²³, x¹) - // - // Yields - // - // 56, 100, 255, 2, 23, 1 - // - // Then we pad with zeroes until we have a list of ω items: - // // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0 - // - // Then we finish with a list of the switch-over-indices in this - // list between polynomials, so: - // - // 56, 100, 255, 2, 23, 1, 0, 0, ..., 0, 2, 3, 3, 5, 6 - - off := uint8(0) - for i := 0; i < K; i++ { - for j := uint16(0); j < common.N; j++ { - if v[i][j] != 0 { - buf[off] = uint8(j) - off++ - } - } - buf[Omega+i] = off - } - for ; off < Omega; off++ { - buf[off] = 0 - } -} - -// Sets v to the vector encoded using VecK.PackHint() -// -// Returns whether unpacking was successful. -func (v *VecK) UnpackHint(buf []byte) bool { - // A priori, there would be several reasonable ways to encode the same - // hint vector. We take care to only allow only one encoding, to ensure - // "strong unforgeability". - // - // See PackHint() source for description of the encoding. - *v = VecK{} // zero v - prevSOP := uint8(0) // previous switch-over-point - for i := 0; i < K; i++ { - SOP := buf[Omega+i] - if SOP < prevSOP || SOP > Omega { - return false // ensures switch-over-points are increasing - } - for j := prevSOP; j < SOP; j++ { - if j > prevSOP && buf[j] <= buf[j-1] { - return false // ensures indices are increasing (within a poly) - } - v[i][buf[j]] = 1 - } - prevSOP = SOP - } - for j := prevSOP; j < Omega; j++ { - if buf[j] != 0 { - return false // ensures padding indices are zero - } - } - - return true -} - -// Sets p to the polynomial packed into buf by PolyPackLeGamma1. -// -// p will be normalized. -func PolyUnpackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0x3) << 16) - p1 := uint32(buf[i+2]>>2) | (uint32(buf[i+3]) << 6) | - (uint32(buf[i+4]&0xf) << 14) - p2 := uint32(buf[i+4]>>4) | (uint32(buf[i+5]) << 4) | - (uint32(buf[i+6]&0x3f) << 12) - p3 := uint32(buf[i+6]>>6) | (uint32(buf[i+7]) << 2) | - (uint32(buf[i+8]) << 10) - - // coefficients in [0,…,2γ₁) - p0 = Gamma1 - p0 // (-γ₁,…,γ₁] - p1 = Gamma1 - p1 - p2 = Gamma1 - p2 - p3 = Gamma1 - p3 - - p0 += uint32(int32(p0)>>31) & common.Q // normalize - p1 += uint32(int32(p1)>>31) & common.Q - p2 += uint32(int32(p2)>>31) & common.Q - p3 += uint32(int32(p3)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - p[j+2] = p2 - p[j+3] = p3 - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - p0 := uint32(buf[i]) | (uint32(buf[i+1]) << 8) | - (uint32(buf[i+2]&0xf) << 16) - p1 := uint32(buf[i+2]>>4) | (uint32(buf[i+3]) << 4) | - (uint32(buf[i+4]) << 12) - - p0 = Gamma1 - p0 - p1 = Gamma1 - p1 - - p0 += uint32(int32(p0)>>31) & common.Q - p1 += uint32(int32(p1)>>31) & common.Q - - p[j] = p0 - p[j+1] = p1 - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Writes p whose coefficients are in (-γ₁,γ₁] into buf -// which has to be of length PolyLeGamma1Size. -// -// Assumes p is normalized. -func PolyPackLeGamma1(p *common.Poly, buf []byte) { - if Gamma1Bits == 17 { - j := 0 - // coefficients in [0,…,γ₁] ∪ (q-γ₁,…,q) - for i := 0; i < PolyLeGamma1Size; i += 9 { - p0 := Gamma1 - p[j] // [0,…,γ₁] ∪ (γ₁-q,…,2γ₁-q) - p0 += uint32(int32(p0)>>31) & common.Q // [0,…,2γ₁) - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - p2 := Gamma1 - p[j+2] - p2 += uint32(int32(p2)>>31) & common.Q - p3 := Gamma1 - p[j+3] - p3 += uint32(int32(p3)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<2) - buf[i+3] = byte(p1 >> 6) - buf[i+4] = byte(p1>>14) | byte(p2<<4) - buf[i+5] = byte(p2 >> 4) - buf[i+6] = byte(p2>>12) | byte(p3<<6) - buf[i+7] = byte(p3 >> 2) - buf[i+8] = byte(p3 >> 10) - - j += 4 - } - } else if Gamma1Bits == 19 { - j := 0 - for i := 0; i < PolyLeGamma1Size; i += 5 { - // Coefficients are in [0, γ₁] ∪ (Q-γ₁, Q) - p0 := Gamma1 - p[j] - p0 += uint32(int32(p0)>>31) & common.Q - p1 := Gamma1 - p[j+1] - p1 += uint32(int32(p1)>>31) & common.Q - - buf[i+0] = byte(p0) - buf[i+1] = byte(p0 >> 8) - buf[i+2] = byte(p0>>16) | byte(p1<<4) - buf[i+3] = byte(p1 >> 4) - buf[i+4] = byte(p1 >> 12) - - j += 2 - } - } else { - panic("γ₁ not supported") - } -} - -// Pack w₁ into buf, which must be of length PolyW1Size. -// -// Assumes w₁ is normalized. -func PolyPackW1(p *common.Poly, buf []byte) { - if Gamma1Bits == 19 { - p.PackLe16(buf) - } else if Gamma1Bits == 17 { - j := 0 - for i := 0; i < PolyW1Size; i += 3 { - buf[i] = byte(p[j]) | byte(p[j+1]<<6) - buf[i+1] = byte(p[j+1]>>2) | byte(p[j+2]<<4) - buf[i+2] = byte(p[j+2]>>4) | byte(p[j+3]<<2) - j += 4 - } - } else { - panic("unsupported γ₁") - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/params.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/params.go deleted file mode 100644 index b5dc669..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/params.go +++ /dev/null @@ -1,18 +0,0 @@ -// Code generated from params.templ.go. DO NOT EDIT. - -package internal - -const ( - Name = "ML-DSA-87" - K = 8 - L = 7 - Eta = 2 - DoubleEtaBits = 3 - Omega = 75 - Tau = 60 - Gamma1Bits = 19 - Gamma2 = 261888 - NIST = true - TRSize = 64 - CTildeSize = 64 -) diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/rounding.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/rounding.go deleted file mode 100644 index 58123c0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/rounding.go +++ /dev/null @@ -1,142 +0,0 @@ -// Code generated from mode3/internal/rounding.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, -// except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken -// and -α/2 ≤ a₀ < 0. Returns a₀ + q. Note 0 ≤ a₁ < (q-1)/α. -// Recall α = 2γ₂. -func decompose(a uint32) (a0plusQ, a1 uint32) { - // a₁ = ⌈a / 128⌉ - a1 = (a + 127) >> 7 - - if Alpha == 523776 { - // 1025/2²² is close enough to 1/4092 so that a₁ - // becomes a/α rounded down. - a1 = ((a1*1025 + (1 << 21)) >> 22) - - // For the corner-case a₁ = (q-1)/α = 16, we have to set a₁=0. - a1 &= 15 - } else if Alpha == 190464 { - // 1488/2²⁴ is close enough to 1/1488 so that a₁ - // becomes a/α rounded down. - a1 = ((a1 * 11275) + (1 << 23)) >> 24 - - // For the corner-case a₁ = (q-1)/α = 44, we have to set a₁=0. - a1 ^= uint32(int32(43-a1)>>31) & a1 - } else { - panic("unsupported α") - } - - a0plusQ = a - a1*Alpha - - // In the corner-case, when we set a₁=0, we will incorrectly - // have a₀ > (q-1)/2 and we'll need to subtract q. As we - // return a₀ + q, that comes down to adding q if a₀ < (q-1)/2. - a0plusQ += uint32(int32(a0plusQ-(common.Q-1)/2)>>31) & common.Q - - return -} - -// Assume 0 ≤ r, f < Q with ‖f‖_∞ ≤ α/2. Decompose r as r = r1*α + r0 as -// computed by decompose(). Write r' := r - f (mod Q). Now, decompose -// r'=r-f again as r' = r'1*α + r'0 using decompose(). As f is small, we -// have r'1 = r1 + h, where h ∈ {-1, 0, 1}. makeHint() computes |h| -// given z0 := r0 - f (mod Q) and r1. With |h|, which is called the hint, -// we can reconstruct r1 using only r' = r - f, which is done by useHint(). -// To wit: -// -// useHint( r - f, makeHint( r0 - f, r1 ) ) = r1. -// -// Assumes 0 ≤ z0 < Q. -func makeHint(z0, r1 uint32) uint32 { - // If -α/2 < r0 - f ≤ α/2, then r1*α + r0 - f is a valid decomposition of r' - // with the restrictions of decompose() and so r'1 = r1. So the hint - // should be 0. This is covered by the first two inequalities. - // There is one other case: if r0 - f = -α/2, then r1*α + r0 - f is also - // a valid decomposition if r1 = 0. In the other cases a one is carried - // and the hint should be 1. - if z0 <= Gamma2 || z0 > common.Q-Gamma2 || (z0 == common.Q-Gamma2 && r1 == 0) { - return 0 - } - return 1 -} - -// Uses the hint created by makeHint() to reconstruct r1 from r'=r-f; see -// documentation of makeHint() for context. -// Assumes 0 ≤ r' < Q. -func useHint(rp uint32, hint uint32) uint32 { - rp0plusQ, rp1 := decompose(rp) - if hint == 0 { - return rp1 - } - if rp0plusQ > common.Q { - return (rp1 + 1) & 15 - } - return (rp1 - 1) & 15 -} - -// Sets p to the hint polynomial for p0 the modified low bits and p1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint polynomial. -func PolyMakeHint(p, p0, p1 *common.Poly) (pop uint32) { - for i := 0; i < common.N; i++ { - h := makeHint(p0[i], p1[i]) - pop += h - p[i] = h - } - return -} - -// Computes corrections to the high bits of the polynomial q according -// to the hints in h and sets p to the corrected high bits. Returns p. -func PolyUseHint(p, q, hint *common.Poly) { - var q0PlusQ common.Poly - - // See useHint() and makeHint() for an explanation. We reimplement it - // here so that we can call Poly.Decompose(), which might be way faster - // than calling decompose() in a loop (for instance when having AVX2.) - - PolyDecompose(q, &q0PlusQ, p) - - for i := 0; i < common.N; i++ { - if hint[i] == 0 { - continue - } - if Gamma2 == 261888 { - if q0PlusQ[i] > common.Q { - p[i] = (p[i] + 1) & 15 - } else { - p[i] = (p[i] - 1) & 15 - } - } else if Gamma2 == 95232 { - if q0PlusQ[i] > common.Q { - if p[i] == 43 { - p[i] = 0 - } else { - p[i]++ - } - } else { - if p[i] == 0 { - p[i] = 43 - } else { - p[i]-- - } - } - } else { - panic("unsupported γ₂") - } - } -} - -// Splits each of the coefficients of p using decompose. -func PolyDecompose(p, p0PlusQ, p1 *common.Poly) { - for i := 0; i < common.N; i++ { - p0PlusQ[i], p1[i] = decompose(p[i]) - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/sample.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/sample.go deleted file mode 100644 index b37370a..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/sample.go +++ /dev/null @@ -1,339 +0,0 @@ -// Code generated from mode3/internal/sample.go by gen.go - -package internal - -import ( - "encoding/binary" - - "github.com/cloudflare/circl/internal/sha3" - common "github.com/cloudflare/circl/sign/internal/dilithium" - "github.com/cloudflare/circl/simd/keccakf1600" -) - -// DeriveX4Available indicates whether the system supports the quick fourway -// sampling variants like PolyDeriveUniformX4. -var DeriveX4Available = keccakf1600.IsEnabledX4() - -// For each i, sample ps[i] uniformly from the given seed and nonces[i]. -// ps[i] may be nil and is ignored in that case. -// -// Can only be called when DeriveX4Available is true. -func PolyDeriveUniformX4(ps [4]*common.Poly, seed *[32]byte, nonces [4]uint16) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < 4; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // Absorb the nonces, the SHAKE128 domain separator (0b1111), the - // start of the padding (0b...001) and the end of the padding 0b100... - // Recall that the rate of SHAKE128 is 168 --- i.e. 21 uint64s. - for j := 0; j < 4; j++ { - state[4*4+j] = uint64(nonces[j]) | (0x1f << 16) - state[20*4+j] = 0x80 << 56 - } - - var idx [4]int // indices into ps - for j := 0; j < 4; j++ { - if ps[j] == nil { - idx[j] = common.N // mark nil polynomial as completed - } - } - - done := false - for !done { - // Applies KeccaK-f[1600] to state to get the next 21 uint64s of each - // of the four SHAKE128 streams. - perm.Permute() - - done = true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - for i := 0; i < 7; i++ { - var t [8]uint32 - t[0] = uint32(state[i*3*4+j] & 0x7fffff) - t[1] = uint32((state[i*3*4+j] >> 24) & 0x7fffff) - t[2] = uint32((state[i*3*4+j] >> 48) | - ((state[(i*3+1)*4+j] & 0x7f) << 16)) - t[3] = uint32((state[(i*3+1)*4+j] >> 8) & 0x7fffff) - t[4] = uint32((state[(i*3+1)*4+j] >> 32) & 0x7fffff) - t[5] = uint32((state[(i*3+1)*4+j] >> 56) | - ((state[(i*3+2)*4+j] & 0x7fff) << 8)) - t[6] = uint32((state[(i*3+2)*4+j] >> 16) & 0x7fffff) - t[7] = uint32((state[(i*3+2)*4+j] >> 40) & 0x7fffff) - - for k := 0; k < 8; k++ { - if t[k] < common.Q { - ps[j][idx[j]] = t[k] - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - } - done = false - } - } -} - -// Sample p uniformly from the given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniform(p *common.Poly, seed *[32]byte, nonce uint16) { - var i, length int - var buf [12 * 16]byte // fits 168B SHAKE-128 rate - - length = 168 - - sample := func() { - // Note that 3 divides into 168 and 12*16, so we use up buf completely. - for j := 0; j < length && i < common.N; j += 3 { - t := (uint32(buf[j]) | (uint32(buf[j+1]) << 8) | - (uint32(buf[j+2]) << 16)) & 0x7fffff - - // We use rejection sampling - if t < common.Q { - p[i] = t - i++ - } - } - } - - var iv [32 + 2]byte // 32 byte seed + uint16 nonce - h := sha3.NewShake128() - copy(iv[:32], seed[:]) - iv[32] = uint8(nonce) - iv[33] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:168]) - sample() - } -} - -// Sample p uniformly with coefficients of norm less than or equal η, -// using the given seed and nonce. -// -// p will not be normalized, but will have coefficients in [q-η,q+η]. -func PolyDeriveUniformLeqEta(p *common.Poly, seed *[64]byte, nonce uint16) { - // Assumes 2 < η < 8. - var i, length int - var buf [9 * 16]byte // fits 136B SHAKE-256 rate - - length = 136 - - sample := func() { - // We use rejection sampling - for j := 0; j < length && i < common.N; j++ { - t1 := uint32(buf[j]) & 15 - t2 := uint32(buf[j]) >> 4 - if Eta == 2 { // branch is eliminated by compiler - if t1 <= 14 { - t1 -= ((205 * t1) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 14 && i < common.N { - t2 -= ((205 * t2) >> 10) * 5 // reduce mod 5 - p[i] = common.Q + Eta - t2 - i++ - } - } else if Eta == 4 { - if t1 <= 2*Eta { - p[i] = common.Q + Eta - t1 - i++ - } - if t2 <= 2*Eta && i < common.N { - p[i] = common.Q + Eta - t2 - i++ - } - } else { - panic("unsupported η") - } - } - } - - var iv [64 + 2]byte // 64 byte seed + uint16 nonce - - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - - // 136 is SHAKE-256 rate - _, _ = h.Write(iv[:]) - - for i < common.N { - _, _ = h.Read(buf[:136]) - sample() - } -} - -// Sample v[i] uniformly with coefficients in (-γ₁,…,γ₁] using the -// given seed and nonce+i -// -// p will be normalized. -func VecLDeriveUniformLeGamma1(v *VecL, seed *[64]byte, nonce uint16) { - for i := 0; i < L; i++ { - PolyDeriveUniformLeGamma1(&v[i], seed, nonce+uint16(i)) - } -} - -// Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the -// given seed and nonce. -// -// p will be normalized. -func PolyDeriveUniformLeGamma1(p *common.Poly, seed *[64]byte, nonce uint16) { - var buf [PolyLeGamma1Size]byte - - var iv [66]byte - h := sha3.NewShake256() - copy(iv[:64], seed[:]) - iv[64] = uint8(nonce) - iv[65] = uint8(nonce >> 8) - _, _ = h.Write(iv[:]) - _, _ = h.Read(buf[:]) - - PolyUnpackLeGamma1(p, buf[:]) -} - -// For each i, sample ps[i] uniformly with τ non-zero coefficients in {q-1,1} -// using the given seed and w1[i]. ps[i] may be nil and is ignored -// in that case. ps[i] will be normalized. -// -// Can only be called when DeriveX4Available is true. -// -// This function is currently not used (yet). -func PolyDeriveUniformBallX4(ps [4]*common.Poly, seed []byte) { - var perm keccakf1600.StateX4 - state := perm.Initialize(false) - - // Absorb the seed in the four states - for i := 0; i < CTildeSize/8; i++ { - v := binary.LittleEndian.Uint64(seed[8*i : 8*(i+1)]) - for j := 0; j < 4; j++ { - state[i*4+j] = v - } - } - - // SHAKE256 domain separator and padding - for j := 0; j < 4; j++ { - state[(CTildeSize/8)*4+j] ^= 0x1f - state[16*4+j] ^= 0x80 << 56 - } - perm.Permute() - - var signs [4]uint64 - var idx [4]uint16 // indices into ps - - for j := 0; j < 4; j++ { - if ps[j] != nil { - signs[j] = state[j] - *ps[j] = common.Poly{} // zero ps[j] - idx[j] = common.N - Tau - } else { - idx[j] = common.N // mark as completed - } - } - - stateOffset := 1 - for { - done := true - - PolyLoop: - for j := 0; j < 4; j++ { - if idx[j] == common.N { - continue - } - - for i := stateOffset; i < 17; i++ { - var bs [8]byte - binary.LittleEndian.PutUint64(bs[:], state[4*i+j]) - for k := 0; k < 8; k++ { - b := uint16(bs[k]) - - if b > idx[j] { - continue - } - - ps[j][idx[j]] = ps[j][b] - ps[j][b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - ps[j][b] ^= uint32((-(signs[j] & 1)) & (1 | (common.Q - 1))) - signs[j] >>= 1 - - idx[j]++ - if idx[j] == common.N { - continue PolyLoop - } - } - } - - done = false - } - - if done { - break - } - - perm.Permute() - stateOffset = 0 - } -} - -// Samples p uniformly with τ non-zero coefficients in {q-1,1}. -// -// The polynomial p will be normalized. -func PolyDeriveUniformBall(p *common.Poly, seed []byte) { - var buf [136]byte // SHAKE-256 rate is 136 - - h := sha3.NewShake256() - _, _ = h.Write(seed[:]) - _, _ = h.Read(buf[:]) - - // Essentially we generate a sequence of τ ones or minus ones, - // prepend 196 zeroes and shuffle the concatenation using the - // usual algorithm (Fisher--Yates.) - signs := binary.LittleEndian.Uint64(buf[:]) - bufOff := 8 // offset into buf - - *p = common.Poly{} // zero p - for i := uint16(common.N - Tau); i < common.N; i++ { - var b uint16 - - // Find location of where to move the new coefficient to using - // rejection sampling. - for { - if bufOff >= 136 { - _, _ = h.Read(buf[:]) - bufOff = 0 - } - - b = uint16(buf[bufOff]) - bufOff++ - - if b <= i { - break - } - } - - p[i] = p[b] - p[b] = 1 - // Takes least significant bit of signs and uses it for the sign. - // Note 1 ^ (1 | (Q-1)) = Q-1. - p[b] ^= uint32((-(signs & 1)) & (1 | (common.Q - 1))) - signs >>= 1 - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/vec.go b/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/vec.go deleted file mode 100644 index d07d3b2..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/mldsa/mldsa87/internal/vec.go +++ /dev/null @@ -1,281 +0,0 @@ -// Code generated from mode3/internal/vec.go by gen.go - -package internal - -import ( - common "github.com/cloudflare/circl/sign/internal/dilithium" -) - -// A vector of L polynomials. -type VecL [L]common.Poly - -// A vector of K polynomials. -type VecK [K]common.Poly - -// Normalize the polynomials in this vector. -func (v *VecL) Normalize() { - for i := 0; i < L; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecL) NormalizeAssumingLe2Q() { - for i := 0; i < L; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecL) Add(w, u *VecL) { - for i := 0; i < L; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecL) NTT() { - for i := 0; i < L; i++ { - v[i].NTT() - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecL) Exceeds(bound uint32) bool { - for i := 0; i < L; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Power2Round(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecL) Decompose(v0PlusQ, v1 *VecL) { - for i := 0; i < L; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecL) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeqEta(). -func (v *VecL) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sequentially packs each polynomial using PolyPackLeGamma1(). -func (v *VecL) PackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyPackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Sets v to the polynomials packed in buf using VecL.PackLeGamma1(). -func (v *VecL) UnpackLeGamma1(buf []byte) { - offset := 0 - for i := 0; i < L; i++ { - PolyUnpackLeGamma1(&v[i], buf[offset:]) - offset += PolyLeGamma1Size - } -} - -// Normalize the polynomials in this vector. -func (v *VecK) Normalize() { - for i := 0; i < K; i++ { - v[i].Normalize() - } -} - -// Normalize the polynomials in this vector assuming their coefficients -// are already bounded by 2q. -func (v *VecK) NormalizeAssumingLe2Q() { - for i := 0; i < K; i++ { - v[i].NormalizeAssumingLe2Q() - } -} - -// Sets v to w + u. Does not normalize. -func (v *VecK) Add(w, u *VecK) { - for i := 0; i < K; i++ { - v[i].Add(&w[i], &u[i]) - } -} - -// Checks whether any of the coefficients exceeds the given bound in supnorm -// -// Requires the vector to be normalized. -func (v *VecK) Exceeds(bound uint32) bool { - for i := 0; i < K; i++ { - if v[i].Exceeds(bound) { - return true - } - } - return false -} - -// Applies Poly.Power2Round componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Power2Round(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - v[i].Power2Round(&v0PlusQ[i], &v1[i]) - } -} - -// Applies Poly.Decompose componentwise. -// -// Requires the vector to be normalized. -func (v *VecK) Decompose(v0PlusQ, v1 *VecK) { - for i := 0; i < K; i++ { - PolyDecompose(&v[i], &v0PlusQ[i], &v1[i]) - } -} - -// Sets v to the hint vector for v0 the modified low bits and v1 -// the unmodified high bits --- see makeHint(). -// -// Returns the number of ones in the hint vector. -func (v *VecK) MakeHint(v0, v1 *VecK) (pop uint32) { - for i := 0; i < K; i++ { - pop += PolyMakeHint(&v[i], &v0[i], &v1[i]) - } - return -} - -// Computes corrections to the high bits of the polynomials in the vector -// w using the hints in h and sets v to the corrected high bits. Returns v. -// See useHint(). -func (v *VecK) UseHint(q, hint *VecK) *VecK { - for i := 0; i < K; i++ { - PolyUseHint(&v[i], &q[i], &hint[i]) - } - return v -} - -// Sequentially packs each polynomial using Poly.PackT1(). -func (v *VecK) PackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sets v to the vector packed into buf by PackT1(). -func (v *VecK) UnpackT1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT1(buf[offset:]) - offset += common.PolyT1Size - } -} - -// Sequentially packs each polynomial using Poly.PackT0(). -func (v *VecK) PackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].PackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sets v to the vector packed into buf by PackT0(). -func (v *VecK) UnpackT0(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - v[i].UnpackT0(buf[offset:]) - offset += common.PolyT0Size - } -} - -// Sequentially packs each polynomial using Poly.PackLeqEta(). -func (v *VecK) PackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Sets v to the polynomials packed in buf using VecK.PackLeqEta(). -func (v *VecK) UnpackLeqEta(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyUnpackLeqEta(&v[i], buf[offset:]) - offset += PolyLeqEtaSize - } -} - -// Applies NTT componentwise. See Poly.NTT() for details. -func (v *VecK) NTT() { - for i := 0; i < K; i++ { - v[i].NTT() - } -} - -// Sequentially packs each polynomial using PolyPackW1(). -func (v *VecK) PackW1(buf []byte) { - offset := 0 - for i := 0; i < K; i++ { - PolyPackW1(&v[i], buf[offset:]) - offset += PolyW1Size - } -} - -// Sets v to a - b. -// -// Warning: assumes coefficients of the polynomials of b are less than 2q. -func (v *VecK) Sub(a, b *VecK) { - for i := 0; i < K; i++ { - v[i].Sub(&a[i], &b[i]) - } -} - -// Sets v to 2ᵈ w without reducing. -func (v *VecK) MulBy2toD(w *VecK) { - for i := 0; i < K; i++ { - v[i].MulBy2toD(&w[i]) - } -} - -// Applies InvNTT componentwise. See Poly.InvNTT() for details. -func (v *VecK) InvNTT() { - for i := 0; i < K; i++ { - v[i].InvNTT() - } -} - -// Applies Poly.ReduceLe2Q() componentwise. -func (v *VecK) ReduceLe2Q() { - for i := 0; i < K; i++ { - v[i].ReduceLe2Q() - } -} diff --git a/backend/vendor/github.com/cloudflare/circl/sign/schemes/schemes.go b/backend/vendor/github.com/cloudflare/circl/sign/schemes/schemes.go deleted file mode 100644 index d01d8ca..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/schemes/schemes.go +++ /dev/null @@ -1,59 +0,0 @@ -// Package schemes contains a register of signature algorithms. -// -// Implemented schemes: -// -// Ed25519 -// Ed448 -// Ed25519-Dilithium2 -// Ed448-Dilithium3 -package schemes - -import ( - "strings" - - "github.com/cloudflare/circl/sign" - "github.com/cloudflare/circl/sign/ed25519" - "github.com/cloudflare/circl/sign/ed448" - "github.com/cloudflare/circl/sign/eddilithium2" - "github.com/cloudflare/circl/sign/eddilithium3" - - dilithium2 "github.com/cloudflare/circl/sign/dilithium/mode2" - dilithium3 "github.com/cloudflare/circl/sign/dilithium/mode3" - dilithium5 "github.com/cloudflare/circl/sign/dilithium/mode5" - "github.com/cloudflare/circl/sign/mldsa/mldsa44" - "github.com/cloudflare/circl/sign/mldsa/mldsa65" - "github.com/cloudflare/circl/sign/mldsa/mldsa87" -) - -var allSchemes = [...]sign.Scheme{ - ed25519.Scheme(), - ed448.Scheme(), - eddilithium2.Scheme(), - eddilithium3.Scheme(), - dilithium2.Scheme(), - dilithium3.Scheme(), - dilithium5.Scheme(), - mldsa44.Scheme(), - mldsa65.Scheme(), - mldsa87.Scheme(), -} - -var allSchemeNames map[string]sign.Scheme - -func init() { - allSchemeNames = make(map[string]sign.Scheme) - for _, scheme := range allSchemes { - allSchemeNames[strings.ToLower(scheme.Name())] = scheme - } -} - -// ByName returns the scheme with the given name and nil if it is not -// supported. -// -// Names are case insensitive. -func ByName(name string) sign.Scheme { - return allSchemeNames[strings.ToLower(name)] -} - -// All returns all signature schemes supported. -func All() []sign.Scheme { a := allSchemes; return a[:] } diff --git a/backend/vendor/github.com/cloudflare/circl/sign/sign.go b/backend/vendor/github.com/cloudflare/circl/sign/sign.go deleted file mode 100644 index 557d6f0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/sign/sign.go +++ /dev/null @@ -1,113 +0,0 @@ -// Package sign provides unified interfaces for signature schemes. -// -// A register of schemes is available in the package -// -// github.com/cloudflare/circl/sign/schemes -package sign - -import ( - "crypto" - "encoding" - "errors" -) - -type SignatureOpts struct { - // If non-empty, includes the given context in the signature if supported - // and will cause an error during signing otherwise. - Context string -} - -// A public key is used to verify a signature set by the corresponding private -// key. -type PublicKey interface { - // Returns the signature scheme for this public key. - Scheme() Scheme - Equal(crypto.PublicKey) bool - encoding.BinaryMarshaler - crypto.PublicKey -} - -// A private key allows one to create signatures. -type PrivateKey interface { - // Returns the signature scheme for this private key. - Scheme() Scheme - Equal(crypto.PrivateKey) bool - // For compatibility with Go standard library - crypto.Signer - crypto.PrivateKey - encoding.BinaryMarshaler -} - -// A Scheme represents a specific instance of a signature scheme. -type Scheme interface { - // Name of the scheme. - Name() string - - // GenerateKey creates a new key-pair. - GenerateKey() (PublicKey, PrivateKey, error) - - // Creates a signature using the PrivateKey on the given message and - // returns the signature. opts are additional options which can be nil. - // - // Panics if key is nil or wrong type or opts context is not supported. - Sign(sk PrivateKey, message []byte, opts *SignatureOpts) []byte - - // Checks whether the given signature is a valid signature set by - // the private key corresponding to the given public key on the - // given message. opts are additional options which can be nil. - // - // Panics if key is nil or wrong type or opts context is not supported. - Verify(pk PublicKey, message []byte, signature []byte, opts *SignatureOpts) bool - - // Deterministically derives a keypair from a seed. If you're unsure, - // you're better off using GenerateKey(). - // - // Panics if seed is not of length SeedSize(). - DeriveKey(seed []byte) (PublicKey, PrivateKey) - - // Unmarshals a PublicKey from the provided buffer. - UnmarshalBinaryPublicKey([]byte) (PublicKey, error) - - // Unmarshals a PublicKey from the provided buffer. - UnmarshalBinaryPrivateKey([]byte) (PrivateKey, error) - - // Size of binary marshalled public keys. - PublicKeySize() int - - // Size of binary marshalled public keys. - PrivateKeySize() int - - // Size of signatures. - SignatureSize() int - - // Size of seeds. - SeedSize() int - - // Returns whether contexts are supported. - SupportsContext() bool -} - -var ( - // ErrTypeMismatch is the error used if types of, for instance, private - // and public keys don't match. - ErrTypeMismatch = errors.New("types mismatch") - - // ErrSeedSize is the error used if the provided seed is of the wrong - // size. - ErrSeedSize = errors.New("wrong seed size") - - // ErrPubKeySize is the error used if the provided public key is of - // the wrong size. - ErrPubKeySize = errors.New("wrong size for public key") - - // ErrPrivKeySize is the error used if the provided private key is of - // the wrong size. - ErrPrivKeySize = errors.New("wrong size for private key") - - // ErrContextNotSupported is the error used if a context is not - // supported. - ErrContextNotSupported = errors.New("context not supported") - - // ErrContextTooLong is the error used if the context string is too long. - ErrContextTooLong = errors.New("context string too long") -) diff --git a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x.go b/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x.go deleted file mode 100644 index 20ac96f..0000000 --- a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x.go +++ /dev/null @@ -1,163 +0,0 @@ -// Package keccakf1600 provides a two and four-way Keccak-f[1600] permutation in parallel. -// -// Keccak-f[1600] is the permutation underlying several algorithms such as -// Keccak, SHA3 and SHAKE. Running two or four permutations in parallel is -// useful in some scenarios like in hash-based signatures. -// -// # Limitations -// -// Note that not all the architectures support SIMD instructions. This package -// uses AVX2 instructions that are available in some AMD64 architectures -// and NEON instructions that are available in some ARM64 architectures. -// -// For those systems not supporting these, the package still provides the -// expected functionality by means of a generic and slow implementation. -// The recommendation is to beforehand verify IsEnabledX4() and IsEnabledX2() -// to determine if the current system supports the SIMD implementation. -package keccakf1600 - -import ( - "runtime" - "unsafe" - - "github.com/cloudflare/circl/internal/sha3" - "golang.org/x/sys/cpu" -) - -// StateX4 contains state for the four-way permutation including the four -// interleaved [25]uint64 buffers. Call Initialize() before use to initialize -// and get a pointer to the interleaved buffer. -type StateX4 struct { - // Go guarantees a to be aligned on 8 bytes, whereas we need it to be - // aligned on 32 bytes for bet performance. Thus we leave some headroom - // to be able to move the start of the state. - - // 4 x 25 uint64s for the interleaved states and three uint64s headroom - // to fix alignment. - a [103]uint64 - - // Offset into a that is 32 byte aligned. - offset int - - // If true, permute will use 12-round keccak instead of 24-round keccak - turbo bool -} - -// StateX2 contains state for the two-way permutation including the two -// interleaved [25]uint64 buffers. Call Initialize() before use to initialize -// and get a pointer to the interleaved buffer. -type StateX2 struct { - // Go guarantees a to be aligned on 8 bytes, whereas we need it to be - // aligned on 32 bytes for bet performance. Thus we leave some headroom - // to be able to move the start of the state. - - // 2 x 25 uint64s for the interleaved states and three uint64s headroom - // to fix alignment. - a [53]uint64 - - // Offset into a that is 32 byte aligned. - offset int - - // If true, permute will use 12-round keccak instead of 24-round keccak - turbo bool -} - -// IsEnabledX4 returns true if the architecture supports a four-way SIMD -// implementation provided in this package. -func IsEnabledX4() bool { return cpu.X86.HasAVX2 } - -// IsEnabledX2 returns true if the architecture supports a two-way SIMD -// implementation provided in this package. -func IsEnabledX2() bool { return enabledX2 } - -// Initialize the state and returns the buffer on which the four permutations -// will act: a uint64 slice of length 100. The first permutation will act -// on {a[0], a[4], ..., a[96]}, the second on {a[1], a[5], ..., a[97]}, etc. -// If turbo is true, applies 12-round variant instead of the usual 24. -func (s *StateX4) Initialize(turbo bool) []uint64 { - s.turbo = turbo - rp := unsafe.Pointer(&s.a[0]) - - // uint64s are always aligned by a multiple of 8. Compute the remainder - // of the address modulo 32 divided by 8. - rem := (int(uintptr(rp)&31) >> 3) - - if rem != 0 { - s.offset = 4 - rem - } - - // The slice we return will be aligned on 32 byte boundary. - return s.a[s.offset : s.offset+100] -} - -// Initialize the state and returns the buffer on which the two permutations -// will act: a uint64 slice of length 50. The first permutation will act -// on {a[0], a[2], ..., a[48]} and the second on {a[1], a[3], ..., a[49]}. -// If turbo is true, applies 12-round variant instead of the usual 24. -func (s *StateX2) Initialize(turbo bool) []uint64 { - s.turbo = turbo - rp := unsafe.Pointer(&s.a[0]) - - // uint64s are always aligned by a multiple of 8. Compute the remainder - // of the address modulo 32 divided by 8. - rem := (int(uintptr(rp)&31) >> 3) - - if rem != 0 { - s.offset = 4 - rem - } - - // The slice we return will be aligned on 32 byte boundary. - return s.a[s.offset : s.offset+50] -} - -// Permute performs the four parallel Keccak-f[1600]s interleaved on the slice -// returned from Initialize(). -func (s *StateX4) Permute() { - if IsEnabledX4() { - permuteSIMDx4(s.a[s.offset:], s.turbo) - } else { - permuteScalarX4(s.a[s.offset:], s.turbo) // A slower generic implementation. - } -} - -// Permute performs the two parallel Keccak-f[1600]s interleaved on the slice -// returned from Initialize(). -func (s *StateX2) Permute() { - if IsEnabledX2() { - permuteSIMDx2(s.a[s.offset:], s.turbo) - } else { - permuteScalarX2(s.a[s.offset:], s.turbo) // A slower generic implementation. - } -} - -func permuteScalarX4(a []uint64, turbo bool) { - var buf [25]uint64 - for i := 0; i < 4; i++ { - for j := 0; j < 25; j++ { - buf[j] = a[4*j+i] - } - sha3.KeccakF1600(&buf, turbo) - for j := 0; j < 25; j++ { - a[4*j+i] = buf[j] - } - } -} - -func permuteScalarX2(a []uint64, turbo bool) { - var buf [25]uint64 - for i := 0; i < 2; i++ { - for j := 0; j < 25; j++ { - buf[j] = a[2*j+i] - } - sha3.KeccakF1600(&buf, turbo) - for j := 0; j < 25; j++ { - a[2*j+i] = buf[j] - } - } -} - -var enabledX2 bool - -func init() { - enabledX2 = runtime.GOARCH == "arm64" && runtime.GOOS == "darwin" -} diff --git a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x2_arm64.go b/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x2_arm64.go deleted file mode 100644 index 0cb9692..0000000 --- a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x2_arm64.go +++ /dev/null @@ -1,13 +0,0 @@ -//go:build arm64 && go1.16 && !purego -// +build arm64,go1.16,!purego - -package keccakf1600 - -import "github.com/cloudflare/circl/internal/sha3" - -func permuteSIMDx2(state []uint64, turbo bool) { f1600x2ARM(&state[0], &sha3.RC, turbo) } - -func permuteSIMDx4(state []uint64, turbo bool) { permuteScalarX4(state, turbo) } - -//go:noescape -func f1600x2ARM(state *uint64, rc *[24]uint64, turbo bool) diff --git a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x2_arm64.s b/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x2_arm64.s deleted file mode 100644 index 998aeca..0000000 --- a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x2_arm64.s +++ /dev/null @@ -1,136 +0,0 @@ -// +build arm64,go1.16,!purego - -// Taken from https://github.com/bwesterb/armed-keccak - -#include "textflag.h" - -// func f1600x2ARM(state *uint64, rc *[24]uint64, turbo bool) -TEXT ·f1600x2ARM(SB), NOSPLIT, $0-17 - MOVD state+0(FP), R0 - MOVD rc+8(FP), R1 - MOVD R0, R2 - MOVD $24, R3 - - VLD1.P 64(R0), [ V0.B16, V1.B16, V2.B16, V3.B16] - VLD1.P 64(R0), [ V4.B16, V5.B16, V6.B16, V7.B16] - VLD1.P 64(R0), [ V8.B16, V9.B16, V10.B16, V11.B16] - VLD1.P 64(R0), [V12.B16, V13.B16, V14.B16, V15.B16] - VLD1.P 64(R0), [V16.B16, V17.B16, V18.B16, V19.B16] - VLD1.P 64(R0), [V20.B16, V21.B16, V22.B16, V23.B16] - VLD1.P (R0), [V24.B16] - - MOVBU turbo+16(FP), R4 - CBZ R4, loop - - SUB $12, R3, R3 - ADD $96, R1, R1 - -loop: - // Execute theta but without xorring into the state yet. - VEOR3 V10.B16, V5.B16, V0.B16, V25.B16 - VEOR3 V11.B16, V6.B16, V1.B16, V26.B16 - VEOR3 V12.B16, V7.B16, V2.B16, V27.B16 - VEOR3 V13.B16, V8.B16, V3.B16, V28.B16 - VEOR3 V14.B16, V9.B16, V4.B16, V29.B16 - - VEOR3 V20.B16, V15.B16, V25.B16, V25.B16 - VEOR3 V21.B16, V16.B16, V26.B16, V26.B16 - VEOR3 V22.B16, V17.B16, V27.B16, V27.B16 - VEOR3 V23.B16, V18.B16, V28.B16, V28.B16 - VEOR3 V24.B16, V19.B16, V29.B16, V29.B16 - - // Xor parities from step theta into the state at the same time as - // exeuting rho and pi. - VRAX1 V26.D2, V29.D2, V30.D2 - VRAX1 V29.D2, V27.D2, V29.D2 - VRAX1 V27.D2, V25.D2, V27.D2 - VRAX1 V25.D2, V28.D2, V25.D2 - VRAX1 V28.D2, V26.D2, V28.D2 - - VEOR V30.B16, V0.B16, V0.B16 - VMOV V1.B16, V31.B16 - - VXAR $20, V27.D2, V6.D2, V1.D2 - VXAR $44, V25.D2, V9.D2, V6.D2 - VXAR $3 , V28.D2, V22.D2, V9.D2 - VXAR $25, V25.D2, V14.D2, V22.D2 - VXAR $46, V30.D2, V20.D2, V14.D2 - VXAR $2 , V28.D2, V2.D2, V20.D2 - VXAR $21, V28.D2, V12.D2, V2.D2 - VXAR $39, V29.D2, V13.D2, V12.D2 - VXAR $56, V25.D2, V19.D2, V13.D2 - VXAR $8 , V29.D2, V23.D2, V19.D2 - VXAR $23, V30.D2, V15.D2, V23.D2 - VXAR $37, V25.D2, V4.D2, V15.D2 - VXAR $50, V25.D2, V24.D2, V4.D2 - VXAR $62, V27.D2, V21.D2, V24.D2 - VXAR $9 , V29.D2, V8.D2, V21.D2 - VXAR $19, V27.D2, V16.D2, V8.D2 - VXAR $28, V30.D2, V5.D2, V16.D2 - VXAR $36, V29.D2, V3.D2, V5.D2 - VXAR $43, V29.D2, V18.D2, V3.D2 - VXAR $49, V28.D2, V17.D2, V18.D2 - VXAR $54, V27.D2, V11.D2, V17.D2 - VXAR $58, V28.D2, V7.D2, V11.D2 - VXAR $61, V30.D2, V10.D2, V7.D2 - VXAR $63, V27.D2, V31.D2, V10.D2 - - // Chi - VBCAX V1.B16, V2.B16, V0.B16, V25.B16 - VBCAX V2.B16, V3.B16, V1.B16, V26.B16 - VBCAX V3.B16, V4.B16, V2.B16, V2.B16 - VBCAX V4.B16, V0.B16, V3.B16, V3.B16 - VBCAX V0.B16, V1.B16, V4.B16, V4.B16 - VMOV V25.B16, V0.B16 - VMOV V26.B16, V1.B16 - - VBCAX V6.B16, V7.B16, V5.B16, V25.B16 - VBCAX V7.B16, V8.B16, V6.B16, V26.B16 - VBCAX V8.B16, V9.B16, V7.B16, V7.B16 - VBCAX V9.B16, V5.B16, V8.B16, V8.B16 - VBCAX V5.B16, V6.B16, V9.B16, V9.B16 - VMOV V25.B16, V5.B16 - VMOV V26.B16, V6.B16 - - VBCAX V11.B16, V12.B16, V10.B16, V25.B16 - VBCAX V12.B16, V13.B16, V11.B16, V26.B16 - VBCAX V13.B16, V14.B16, V12.B16, V12.B16 - VBCAX V14.B16, V10.B16, V13.B16, V13.B16 - VBCAX V10.B16, V11.B16, V14.B16, V14.B16 - VMOV V25.B16, V10.B16 - VMOV V26.B16, V11.B16 - - VBCAX V16.B16, V17.B16, V15.B16, V25.B16 - VBCAX V17.B16, V18.B16, V16.B16, V26.B16 - VBCAX V18.B16, V19.B16, V17.B16, V17.B16 - VBCAX V19.B16, V15.B16, V18.B16, V18.B16 - VBCAX V15.B16, V16.B16, V19.B16, V19.B16 - VMOV V25.B16, V15.B16 - VMOV V26.B16, V16.B16 - - VBCAX V21.B16, V22.B16, V20.B16, V25.B16 - VBCAX V22.B16, V23.B16, V21.B16, V26.B16 - VBCAX V23.B16, V24.B16, V22.B16, V22.B16 - VBCAX V24.B16, V20.B16, V23.B16, V23.B16 - VBCAX V20.B16, V21.B16, V24.B16, V24.B16 - VMOV V25.B16, V20.B16 - VMOV V26.B16, V21.B16 - - // Iota - VLD1R.P 8(R1), [V25.D2] - VEOR V25.B16, V0.B16, V0.B16 - - SUBS $1, R3, R3 - CBNZ R3, loop - - MOVD R2, R0 - - VST1.P [ V0.B16, V1.B16, V2.B16, V3.B16], 64(R0) - VST1.P [ V4.B16, V5.B16, V6.B16, V7.B16], 64(R0) - VST1.P [ V8.B16, V9.B16, V10.B16, V11.B16], 64(R0) - VST1.P [V12.B16, V13.B16, V14.B16, V15.B16], 64(R0) - VST1.P [V16.B16, V17.B16, V18.B16, V19.B16], 64(R0) - VST1.P [V20.B16, V21.B16, V22.B16, V23.B16], 64(R0) - VST1.P [V24.B16], (R0) - - RET diff --git a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x4_amd64.go b/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x4_amd64.go deleted file mode 100644 index bf5b865..0000000 --- a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x4_amd64.go +++ /dev/null @@ -1,10 +0,0 @@ -//go:build amd64 && !purego -// +build amd64,!purego - -package keccakf1600 - -import "github.com/cloudflare/circl/internal/sha3" - -func permuteSIMDx4(state []uint64, turbo bool) { f1600x4AVX2(&state[0], &sha3.RC, turbo) } - -func permuteSIMDx2(state []uint64, turbo bool) { permuteScalarX2(state, turbo) } diff --git a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x4_amd64.s b/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x4_amd64.s deleted file mode 100644 index 67b6455..0000000 --- a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x4_amd64.s +++ /dev/null @@ -1,899 +0,0 @@ -// Code generated by command: go run src.go -out ../../f1600x4_amd64.s -stubs ../../f1600x4stubs_amd64.go -pkg keccakf1600. DO NOT EDIT. - -//go:build amd64 && !purego - -#include "textflag.h" - -// func f1600x4AVX2(state *uint64, rc *[24]uint64, turbo bool) -// Requires: AVX, AVX2 -TEXT ·f1600x4AVX2(SB), NOSPLIT, $0-17 - MOVQ state+0(FP), AX - MOVQ rc+8(FP), CX - MOVQ $0x0000000000000006, DX - MOVBQZX turbo+16(FP), BX - TESTQ BX, BX - JZ loop - MOVQ $0x0000000000000003, DX - ADDQ $0x60, CX - -loop: - VMOVDQA (AX), Y0 - VMOVDQA 32(AX), Y1 - VMOVDQA 64(AX), Y2 - VMOVDQA 96(AX), Y3 - VMOVDQA 128(AX), Y4 - VPXOR 160(AX), Y0, Y0 - VPXOR 192(AX), Y1, Y1 - VPXOR 224(AX), Y2, Y2 - VPXOR 256(AX), Y3, Y3 - VPXOR 288(AX), Y4, Y4 - VPXOR 320(AX), Y0, Y0 - VPXOR 352(AX), Y1, Y1 - VPXOR 384(AX), Y2, Y2 - VPXOR 416(AX), Y3, Y3 - VPXOR 448(AX), Y4, Y4 - VPXOR 480(AX), Y0, Y0 - VPXOR 512(AX), Y1, Y1 - VPXOR 544(AX), Y2, Y2 - VPXOR 576(AX), Y3, Y3 - VPXOR 608(AX), Y4, Y4 - VPXOR 640(AX), Y0, Y0 - VPXOR 672(AX), Y1, Y1 - VPXOR 704(AX), Y2, Y2 - VPXOR 736(AX), Y3, Y3 - VPXOR 768(AX), Y4, Y4 - VPSLLQ $0x01, Y1, Y5 - VPSLLQ $0x01, Y2, Y6 - VPSLLQ $0x01, Y3, Y7 - VPSLLQ $0x01, Y4, Y8 - VPSLLQ $0x01, Y0, Y9 - VPSRLQ $0x3f, Y1, Y10 - VPSRLQ $0x3f, Y2, Y11 - VPSRLQ $0x3f, Y3, Y12 - VPSRLQ $0x3f, Y4, Y13 - VPSRLQ $0x3f, Y0, Y14 - VPOR Y5, Y10, Y10 - VPOR Y6, Y11, Y11 - VPOR Y7, Y12, Y12 - VPOR Y8, Y13, Y13 - VPOR Y9, Y14, Y14 - VPXOR Y10, Y4, Y10 - VPXOR Y11, Y0, Y11 - VPXOR Y12, Y1, Y12 - VPXOR Y13, Y2, Y13 - VPXOR Y14, Y3, Y14 - VPXOR (AX), Y10, Y0 - VPXOR 192(AX), Y11, Y1 - VPXOR 384(AX), Y12, Y2 - VPXOR 576(AX), Y13, Y3 - VPXOR 768(AX), Y14, Y4 - VPSLLQ $0x2c, Y1, Y6 - VPSLLQ $0x2b, Y2, Y7 - VPSLLQ $0x15, Y3, Y8 - VPSLLQ $0x0e, Y4, Y9 - VPSRLQ $0x14, Y1, Y1 - VPSRLQ $0x15, Y2, Y2 - VPSRLQ $0x2b, Y3, Y3 - VPSRLQ $0x32, Y4, Y4 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VPBROADCASTQ (CX), Y0 - VPXOR Y0, Y5, Y5 - VMOVDQA Y5, (AX) - VMOVDQA Y6, 192(AX) - VMOVDQA Y7, 384(AX) - VMOVDQA Y8, 576(AX) - VMOVDQA Y9, 768(AX) - VPXOR 96(AX), Y13, Y0 - VPXOR 288(AX), Y14, Y1 - VPXOR 320(AX), Y10, Y2 - VPXOR 512(AX), Y11, Y3 - VPXOR 704(AX), Y12, Y4 - VPSLLQ $0x1c, Y0, Y5 - VPSLLQ $0x14, Y1, Y6 - VPSLLQ $0x03, Y2, Y7 - VPSLLQ $0x2d, Y3, Y8 - VPSLLQ $0x3d, Y4, Y9 - VPSRLQ $0x24, Y0, Y0 - VPSRLQ $0x2c, Y1, Y1 - VPSRLQ $0x3d, Y2, Y2 - VPSRLQ $0x13, Y3, Y3 - VPSRLQ $0x03, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 320(AX) - VMOVDQA Y6, 512(AX) - VMOVDQA Y7, 704(AX) - VMOVDQA Y8, 96(AX) - VMOVDQA Y9, 288(AX) - VPXOR 32(AX), Y11, Y0 - VPXOR 224(AX), Y12, Y1 - VPXOR 416(AX), Y13, Y2 - VPXOR 608(AX), Y14, Y3 - VPXOR 640(AX), Y10, Y4 - VPSLLQ $0x01, Y0, Y5 - VPSLLQ $0x06, Y1, Y6 - VPSLLQ $0x19, Y2, Y7 - VPSLLQ $0x08, Y3, Y8 - VPSLLQ $0x12, Y4, Y9 - VPSRLQ $0x3f, Y0, Y0 - VPSRLQ $0x3a, Y1, Y1 - VPSRLQ $0x27, Y2, Y2 - VPSRLQ $0x38, Y3, Y3 - VPSRLQ $0x2e, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 640(AX) - VMOVDQA Y6, 32(AX) - VMOVDQA Y7, 224(AX) - VMOVDQA Y8, 416(AX) - VMOVDQA Y9, 608(AX) - VPXOR 128(AX), Y14, Y0 - VPXOR 160(AX), Y10, Y1 - VPXOR 352(AX), Y11, Y2 - VPXOR 544(AX), Y12, Y3 - VPXOR 736(AX), Y13, Y4 - VPSLLQ $0x1b, Y0, Y5 - VPSLLQ $0x24, Y1, Y6 - VPSLLQ $0x0a, Y2, Y7 - VPSLLQ $0x0f, Y3, Y8 - VPSLLQ $0x38, Y4, Y9 - VPSRLQ $0x25, Y0, Y0 - VPSRLQ $0x1c, Y1, Y1 - VPSRLQ $0x36, Y2, Y2 - VPSRLQ $0x31, Y3, Y3 - VPSRLQ $0x08, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 160(AX) - VMOVDQA Y6, 352(AX) - VMOVDQA Y7, 544(AX) - VMOVDQA Y8, 736(AX) - VMOVDQA Y9, 128(AX) - VPXOR 64(AX), Y12, Y0 - VPXOR 256(AX), Y13, Y1 - VPXOR 448(AX), Y14, Y2 - VPXOR 480(AX), Y10, Y3 - VPXOR 672(AX), Y11, Y4 - VPSLLQ $0x3e, Y0, Y5 - VPSLLQ $0x37, Y1, Y6 - VPSLLQ $0x27, Y2, Y7 - VPSLLQ $0x29, Y3, Y8 - VPSLLQ $0x02, Y4, Y9 - VPSRLQ $0x02, Y0, Y0 - VPSRLQ $0x09, Y1, Y1 - VPSRLQ $0x19, Y2, Y2 - VPSRLQ $0x17, Y3, Y3 - VPSRLQ $0x3e, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 480(AX) - VMOVDQA Y6, 672(AX) - VMOVDQA Y7, 64(AX) - VMOVDQA Y8, 256(AX) - VMOVDQA Y9, 448(AX) - VMOVDQA (AX), Y0 - VMOVDQA 32(AX), Y1 - VMOVDQA 64(AX), Y2 - VMOVDQA 96(AX), Y3 - VMOVDQA 128(AX), Y4 - VPXOR 160(AX), Y0, Y0 - VPXOR 192(AX), Y1, Y1 - VPXOR 224(AX), Y2, Y2 - VPXOR 256(AX), Y3, Y3 - VPXOR 288(AX), Y4, Y4 - VPXOR 320(AX), Y0, Y0 - VPXOR 352(AX), Y1, Y1 - VPXOR 384(AX), Y2, Y2 - VPXOR 416(AX), Y3, Y3 - VPXOR 448(AX), Y4, Y4 - VPXOR 480(AX), Y0, Y0 - VPXOR 512(AX), Y1, Y1 - VPXOR 544(AX), Y2, Y2 - VPXOR 576(AX), Y3, Y3 - VPXOR 608(AX), Y4, Y4 - VPXOR 640(AX), Y0, Y0 - VPXOR 672(AX), Y1, Y1 - VPXOR 704(AX), Y2, Y2 - VPXOR 736(AX), Y3, Y3 - VPXOR 768(AX), Y4, Y4 - VPSLLQ $0x01, Y1, Y5 - VPSLLQ $0x01, Y2, Y6 - VPSLLQ $0x01, Y3, Y7 - VPSLLQ $0x01, Y4, Y8 - VPSLLQ $0x01, Y0, Y9 - VPSRLQ $0x3f, Y1, Y10 - VPSRLQ $0x3f, Y2, Y11 - VPSRLQ $0x3f, Y3, Y12 - VPSRLQ $0x3f, Y4, Y13 - VPSRLQ $0x3f, Y0, Y14 - VPOR Y5, Y10, Y10 - VPOR Y6, Y11, Y11 - VPOR Y7, Y12, Y12 - VPOR Y8, Y13, Y13 - VPOR Y9, Y14, Y14 - VPXOR Y10, Y4, Y10 - VPXOR Y11, Y0, Y11 - VPXOR Y12, Y1, Y12 - VPXOR Y13, Y2, Y13 - VPXOR Y14, Y3, Y14 - VPXOR (AX), Y10, Y0 - VPXOR 512(AX), Y11, Y1 - VPXOR 224(AX), Y12, Y2 - VPXOR 736(AX), Y13, Y3 - VPXOR 448(AX), Y14, Y4 - VPSLLQ $0x2c, Y1, Y6 - VPSLLQ $0x2b, Y2, Y7 - VPSLLQ $0x15, Y3, Y8 - VPSLLQ $0x0e, Y4, Y9 - VPSRLQ $0x14, Y1, Y1 - VPSRLQ $0x15, Y2, Y2 - VPSRLQ $0x2b, Y3, Y3 - VPSRLQ $0x32, Y4, Y4 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VPBROADCASTQ 8(CX), Y0 - VPXOR Y0, Y5, Y5 - VMOVDQA Y5, (AX) - VMOVDQA Y6, 512(AX) - VMOVDQA Y7, 224(AX) - VMOVDQA Y8, 736(AX) - VMOVDQA Y9, 448(AX) - VPXOR 576(AX), Y13, Y0 - VPXOR 288(AX), Y14, Y1 - VPXOR 640(AX), Y10, Y2 - VPXOR 352(AX), Y11, Y3 - VPXOR 64(AX), Y12, Y4 - VPSLLQ $0x1c, Y0, Y5 - VPSLLQ $0x14, Y1, Y6 - VPSLLQ $0x03, Y2, Y7 - VPSLLQ $0x2d, Y3, Y8 - VPSLLQ $0x3d, Y4, Y9 - VPSRLQ $0x24, Y0, Y0 - VPSRLQ $0x2c, Y1, Y1 - VPSRLQ $0x3d, Y2, Y2 - VPSRLQ $0x13, Y3, Y3 - VPSRLQ $0x03, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 640(AX) - VMOVDQA Y6, 352(AX) - VMOVDQA Y7, 64(AX) - VMOVDQA Y8, 576(AX) - VMOVDQA Y9, 288(AX) - VPXOR 192(AX), Y11, Y0 - VPXOR 704(AX), Y12, Y1 - VPXOR 416(AX), Y13, Y2 - VPXOR 128(AX), Y14, Y3 - VPXOR 480(AX), Y10, Y4 - VPSLLQ $0x01, Y0, Y5 - VPSLLQ $0x06, Y1, Y6 - VPSLLQ $0x19, Y2, Y7 - VPSLLQ $0x08, Y3, Y8 - VPSLLQ $0x12, Y4, Y9 - VPSRLQ $0x3f, Y0, Y0 - VPSRLQ $0x3a, Y1, Y1 - VPSRLQ $0x27, Y2, Y2 - VPSRLQ $0x38, Y3, Y3 - VPSRLQ $0x2e, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 480(AX) - VMOVDQA Y6, 192(AX) - VMOVDQA Y7, 704(AX) - VMOVDQA Y8, 416(AX) - VMOVDQA Y9, 128(AX) - VPXOR 768(AX), Y14, Y0 - VPXOR 320(AX), Y10, Y1 - VPXOR 32(AX), Y11, Y2 - VPXOR 544(AX), Y12, Y3 - VPXOR 256(AX), Y13, Y4 - VPSLLQ $0x1b, Y0, Y5 - VPSLLQ $0x24, Y1, Y6 - VPSLLQ $0x0a, Y2, Y7 - VPSLLQ $0x0f, Y3, Y8 - VPSLLQ $0x38, Y4, Y9 - VPSRLQ $0x25, Y0, Y0 - VPSRLQ $0x1c, Y1, Y1 - VPSRLQ $0x36, Y2, Y2 - VPSRLQ $0x31, Y3, Y3 - VPSRLQ $0x08, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 320(AX) - VMOVDQA Y6, 32(AX) - VMOVDQA Y7, 544(AX) - VMOVDQA Y8, 256(AX) - VMOVDQA Y9, 768(AX) - VPXOR 384(AX), Y12, Y0 - VPXOR 96(AX), Y13, Y1 - VPXOR 608(AX), Y14, Y2 - VPXOR 160(AX), Y10, Y3 - VPXOR 672(AX), Y11, Y4 - VPSLLQ $0x3e, Y0, Y5 - VPSLLQ $0x37, Y1, Y6 - VPSLLQ $0x27, Y2, Y7 - VPSLLQ $0x29, Y3, Y8 - VPSLLQ $0x02, Y4, Y9 - VPSRLQ $0x02, Y0, Y0 - VPSRLQ $0x09, Y1, Y1 - VPSRLQ $0x19, Y2, Y2 - VPSRLQ $0x17, Y3, Y3 - VPSRLQ $0x3e, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 160(AX) - VMOVDQA Y6, 672(AX) - VMOVDQA Y7, 384(AX) - VMOVDQA Y8, 96(AX) - VMOVDQA Y9, 608(AX) - VMOVDQA (AX), Y0 - VMOVDQA 32(AX), Y1 - VMOVDQA 64(AX), Y2 - VMOVDQA 96(AX), Y3 - VMOVDQA 128(AX), Y4 - VPXOR 160(AX), Y0, Y0 - VPXOR 192(AX), Y1, Y1 - VPXOR 224(AX), Y2, Y2 - VPXOR 256(AX), Y3, Y3 - VPXOR 288(AX), Y4, Y4 - VPXOR 320(AX), Y0, Y0 - VPXOR 352(AX), Y1, Y1 - VPXOR 384(AX), Y2, Y2 - VPXOR 416(AX), Y3, Y3 - VPXOR 448(AX), Y4, Y4 - VPXOR 480(AX), Y0, Y0 - VPXOR 512(AX), Y1, Y1 - VPXOR 544(AX), Y2, Y2 - VPXOR 576(AX), Y3, Y3 - VPXOR 608(AX), Y4, Y4 - VPXOR 640(AX), Y0, Y0 - VPXOR 672(AX), Y1, Y1 - VPXOR 704(AX), Y2, Y2 - VPXOR 736(AX), Y3, Y3 - VPXOR 768(AX), Y4, Y4 - VPSLLQ $0x01, Y1, Y5 - VPSLLQ $0x01, Y2, Y6 - VPSLLQ $0x01, Y3, Y7 - VPSLLQ $0x01, Y4, Y8 - VPSLLQ $0x01, Y0, Y9 - VPSRLQ $0x3f, Y1, Y10 - VPSRLQ $0x3f, Y2, Y11 - VPSRLQ $0x3f, Y3, Y12 - VPSRLQ $0x3f, Y4, Y13 - VPSRLQ $0x3f, Y0, Y14 - VPOR Y5, Y10, Y10 - VPOR Y6, Y11, Y11 - VPOR Y7, Y12, Y12 - VPOR Y8, Y13, Y13 - VPOR Y9, Y14, Y14 - VPXOR Y10, Y4, Y10 - VPXOR Y11, Y0, Y11 - VPXOR Y12, Y1, Y12 - VPXOR Y13, Y2, Y13 - VPXOR Y14, Y3, Y14 - VPXOR (AX), Y10, Y0 - VPXOR 352(AX), Y11, Y1 - VPXOR 704(AX), Y12, Y2 - VPXOR 256(AX), Y13, Y3 - VPXOR 608(AX), Y14, Y4 - VPSLLQ $0x2c, Y1, Y6 - VPSLLQ $0x2b, Y2, Y7 - VPSLLQ $0x15, Y3, Y8 - VPSLLQ $0x0e, Y4, Y9 - VPSRLQ $0x14, Y1, Y1 - VPSRLQ $0x15, Y2, Y2 - VPSRLQ $0x2b, Y3, Y3 - VPSRLQ $0x32, Y4, Y4 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VPBROADCASTQ 16(CX), Y0 - VPXOR Y0, Y5, Y5 - VMOVDQA Y5, (AX) - VMOVDQA Y6, 352(AX) - VMOVDQA Y7, 704(AX) - VMOVDQA Y8, 256(AX) - VMOVDQA Y9, 608(AX) - VPXOR 736(AX), Y13, Y0 - VPXOR 288(AX), Y14, Y1 - VPXOR 480(AX), Y10, Y2 - VPXOR 32(AX), Y11, Y3 - VPXOR 384(AX), Y12, Y4 - VPSLLQ $0x1c, Y0, Y5 - VPSLLQ $0x14, Y1, Y6 - VPSLLQ $0x03, Y2, Y7 - VPSLLQ $0x2d, Y3, Y8 - VPSLLQ $0x3d, Y4, Y9 - VPSRLQ $0x24, Y0, Y0 - VPSRLQ $0x2c, Y1, Y1 - VPSRLQ $0x3d, Y2, Y2 - VPSRLQ $0x13, Y3, Y3 - VPSRLQ $0x03, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 480(AX) - VMOVDQA Y6, 32(AX) - VMOVDQA Y7, 384(AX) - VMOVDQA Y8, 736(AX) - VMOVDQA Y9, 288(AX) - VPXOR 512(AX), Y11, Y0 - VPXOR 64(AX), Y12, Y1 - VPXOR 416(AX), Y13, Y2 - VPXOR 768(AX), Y14, Y3 - VPXOR 160(AX), Y10, Y4 - VPSLLQ $0x01, Y0, Y5 - VPSLLQ $0x06, Y1, Y6 - VPSLLQ $0x19, Y2, Y7 - VPSLLQ $0x08, Y3, Y8 - VPSLLQ $0x12, Y4, Y9 - VPSRLQ $0x3f, Y0, Y0 - VPSRLQ $0x3a, Y1, Y1 - VPSRLQ $0x27, Y2, Y2 - VPSRLQ $0x38, Y3, Y3 - VPSRLQ $0x2e, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 160(AX) - VMOVDQA Y6, 512(AX) - VMOVDQA Y7, 64(AX) - VMOVDQA Y8, 416(AX) - VMOVDQA Y9, 768(AX) - VPXOR 448(AX), Y14, Y0 - VPXOR 640(AX), Y10, Y1 - VPXOR 192(AX), Y11, Y2 - VPXOR 544(AX), Y12, Y3 - VPXOR 96(AX), Y13, Y4 - VPSLLQ $0x1b, Y0, Y5 - VPSLLQ $0x24, Y1, Y6 - VPSLLQ $0x0a, Y2, Y7 - VPSLLQ $0x0f, Y3, Y8 - VPSLLQ $0x38, Y4, Y9 - VPSRLQ $0x25, Y0, Y0 - VPSRLQ $0x1c, Y1, Y1 - VPSRLQ $0x36, Y2, Y2 - VPSRLQ $0x31, Y3, Y3 - VPSRLQ $0x08, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 640(AX) - VMOVDQA Y6, 192(AX) - VMOVDQA Y7, 544(AX) - VMOVDQA Y8, 96(AX) - VMOVDQA Y9, 448(AX) - VPXOR 224(AX), Y12, Y0 - VPXOR 576(AX), Y13, Y1 - VPXOR 128(AX), Y14, Y2 - VPXOR 320(AX), Y10, Y3 - VPXOR 672(AX), Y11, Y4 - VPSLLQ $0x3e, Y0, Y5 - VPSLLQ $0x37, Y1, Y6 - VPSLLQ $0x27, Y2, Y7 - VPSLLQ $0x29, Y3, Y8 - VPSLLQ $0x02, Y4, Y9 - VPSRLQ $0x02, Y0, Y0 - VPSRLQ $0x09, Y1, Y1 - VPSRLQ $0x19, Y2, Y2 - VPSRLQ $0x17, Y3, Y3 - VPSRLQ $0x3e, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 320(AX) - VMOVDQA Y6, 672(AX) - VMOVDQA Y7, 224(AX) - VMOVDQA Y8, 576(AX) - VMOVDQA Y9, 128(AX) - VMOVDQA (AX), Y0 - VMOVDQA 32(AX), Y1 - VMOVDQA 64(AX), Y2 - VMOVDQA 96(AX), Y3 - VMOVDQA 128(AX), Y4 - VPXOR 160(AX), Y0, Y0 - VPXOR 192(AX), Y1, Y1 - VPXOR 224(AX), Y2, Y2 - VPXOR 256(AX), Y3, Y3 - VPXOR 288(AX), Y4, Y4 - VPXOR 320(AX), Y0, Y0 - VPXOR 352(AX), Y1, Y1 - VPXOR 384(AX), Y2, Y2 - VPXOR 416(AX), Y3, Y3 - VPXOR 448(AX), Y4, Y4 - VPXOR 480(AX), Y0, Y0 - VPXOR 512(AX), Y1, Y1 - VPXOR 544(AX), Y2, Y2 - VPXOR 576(AX), Y3, Y3 - VPXOR 608(AX), Y4, Y4 - VPXOR 640(AX), Y0, Y0 - VPXOR 672(AX), Y1, Y1 - VPXOR 704(AX), Y2, Y2 - VPXOR 736(AX), Y3, Y3 - VPXOR 768(AX), Y4, Y4 - VPSLLQ $0x01, Y1, Y5 - VPSLLQ $0x01, Y2, Y6 - VPSLLQ $0x01, Y3, Y7 - VPSLLQ $0x01, Y4, Y8 - VPSLLQ $0x01, Y0, Y9 - VPSRLQ $0x3f, Y1, Y10 - VPSRLQ $0x3f, Y2, Y11 - VPSRLQ $0x3f, Y3, Y12 - VPSRLQ $0x3f, Y4, Y13 - VPSRLQ $0x3f, Y0, Y14 - VPOR Y5, Y10, Y10 - VPOR Y6, Y11, Y11 - VPOR Y7, Y12, Y12 - VPOR Y8, Y13, Y13 - VPOR Y9, Y14, Y14 - VPXOR Y10, Y4, Y10 - VPXOR Y11, Y0, Y11 - VPXOR Y12, Y1, Y12 - VPXOR Y13, Y2, Y13 - VPXOR Y14, Y3, Y14 - VPXOR (AX), Y10, Y0 - VPXOR 32(AX), Y11, Y1 - VPXOR 64(AX), Y12, Y2 - VPXOR 96(AX), Y13, Y3 - VPXOR 128(AX), Y14, Y4 - VPSLLQ $0x2c, Y1, Y6 - VPSLLQ $0x2b, Y2, Y7 - VPSLLQ $0x15, Y3, Y8 - VPSLLQ $0x0e, Y4, Y9 - VPSRLQ $0x14, Y1, Y1 - VPSRLQ $0x15, Y2, Y2 - VPSRLQ $0x2b, Y3, Y3 - VPSRLQ $0x32, Y4, Y4 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VPBROADCASTQ 24(CX), Y0 - VPXOR Y0, Y5, Y5 - VMOVDQA Y5, (AX) - VMOVDQA Y6, 32(AX) - VMOVDQA Y7, 64(AX) - VMOVDQA Y8, 96(AX) - VMOVDQA Y9, 128(AX) - VPXOR 256(AX), Y13, Y0 - VPXOR 288(AX), Y14, Y1 - VPXOR 160(AX), Y10, Y2 - VPXOR 192(AX), Y11, Y3 - VPXOR 224(AX), Y12, Y4 - VPSLLQ $0x1c, Y0, Y5 - VPSLLQ $0x14, Y1, Y6 - VPSLLQ $0x03, Y2, Y7 - VPSLLQ $0x2d, Y3, Y8 - VPSLLQ $0x3d, Y4, Y9 - VPSRLQ $0x24, Y0, Y0 - VPSRLQ $0x2c, Y1, Y1 - VPSRLQ $0x3d, Y2, Y2 - VPSRLQ $0x13, Y3, Y3 - VPSRLQ $0x03, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 160(AX) - VMOVDQA Y6, 192(AX) - VMOVDQA Y7, 224(AX) - VMOVDQA Y8, 256(AX) - VMOVDQA Y9, 288(AX) - VPXOR 352(AX), Y11, Y0 - VPXOR 384(AX), Y12, Y1 - VPXOR 416(AX), Y13, Y2 - VPXOR 448(AX), Y14, Y3 - VPXOR 320(AX), Y10, Y4 - VPSLLQ $0x01, Y0, Y5 - VPSLLQ $0x06, Y1, Y6 - VPSLLQ $0x19, Y2, Y7 - VPSLLQ $0x08, Y3, Y8 - VPSLLQ $0x12, Y4, Y9 - VPSRLQ $0x3f, Y0, Y0 - VPSRLQ $0x3a, Y1, Y1 - VPSRLQ $0x27, Y2, Y2 - VPSRLQ $0x38, Y3, Y3 - VPSRLQ $0x2e, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 320(AX) - VMOVDQA Y6, 352(AX) - VMOVDQA Y7, 384(AX) - VMOVDQA Y8, 416(AX) - VMOVDQA Y9, 448(AX) - VPXOR 608(AX), Y14, Y0 - VPXOR 480(AX), Y10, Y1 - VPXOR 512(AX), Y11, Y2 - VPXOR 544(AX), Y12, Y3 - VPXOR 576(AX), Y13, Y4 - VPSLLQ $0x1b, Y0, Y5 - VPSLLQ $0x24, Y1, Y6 - VPSLLQ $0x0a, Y2, Y7 - VPSLLQ $0x0f, Y3, Y8 - VPSLLQ $0x38, Y4, Y9 - VPSRLQ $0x25, Y0, Y0 - VPSRLQ $0x1c, Y1, Y1 - VPSRLQ $0x36, Y2, Y2 - VPSRLQ $0x31, Y3, Y3 - VPSRLQ $0x08, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 480(AX) - VMOVDQA Y6, 512(AX) - VMOVDQA Y7, 544(AX) - VMOVDQA Y8, 576(AX) - VMOVDQA Y9, 608(AX) - VPXOR 704(AX), Y12, Y0 - VPXOR 736(AX), Y13, Y1 - VPXOR 768(AX), Y14, Y2 - VPXOR 640(AX), Y10, Y3 - VPXOR 672(AX), Y11, Y4 - VPSLLQ $0x3e, Y0, Y5 - VPSLLQ $0x37, Y1, Y6 - VPSLLQ $0x27, Y2, Y7 - VPSLLQ $0x29, Y3, Y8 - VPSLLQ $0x02, Y4, Y9 - VPSRLQ $0x02, Y0, Y0 - VPSRLQ $0x09, Y1, Y1 - VPSRLQ $0x19, Y2, Y2 - VPSRLQ $0x17, Y3, Y3 - VPSRLQ $0x3e, Y4, Y4 - VPOR Y5, Y0, Y0 - VPOR Y6, Y1, Y1 - VPOR Y7, Y2, Y2 - VPOR Y8, Y3, Y3 - VPOR Y9, Y4, Y4 - VPANDN Y2, Y1, Y5 - VPANDN Y3, Y2, Y6 - VPANDN Y4, Y3, Y7 - VPANDN Y0, Y4, Y8 - VPANDN Y1, Y0, Y9 - VPXOR Y0, Y5, Y5 - VPXOR Y1, Y6, Y6 - VPXOR Y2, Y7, Y7 - VPXOR Y3, Y8, Y8 - VPXOR Y4, Y9, Y9 - VMOVDQA Y5, 640(AX) - VMOVDQA Y6, 672(AX) - VMOVDQA Y7, 704(AX) - VMOVDQA Y8, 736(AX) - VMOVDQA Y9, 768(AX) - ADDQ $0x20, CX - SUBQ $0x00000001, DX - JNZ loop - RET diff --git a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x4stubs_amd64.go b/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x4stubs_amd64.go deleted file mode 100644 index 102fdd0..0000000 --- a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/f1600x4stubs_amd64.go +++ /dev/null @@ -1,8 +0,0 @@ -// Code generated by command: go run src.go -out ../../f1600x4_amd64.s -stubs ../../f1600x4stubs_amd64.go -pkg keccakf1600. DO NOT EDIT. - -//go:build amd64 && !purego - -package keccakf1600 - -//go:noescape -func f1600x4AVX2(state *uint64, rc *[24]uint64, turbo bool) diff --git a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/fallback.go b/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/fallback.go deleted file mode 100644 index 0da75e9..0000000 --- a/backend/vendor/github.com/cloudflare/circl/simd/keccakf1600/fallback.go +++ /dev/null @@ -1,8 +0,0 @@ -//go:build (!amd64 && !arm64) || (arm64 && !go1.16) || purego -// +build !amd64,!arm64 arm64,!go1.16 purego - -package keccakf1600 - -func permuteSIMDx2(state []uint64, turbo bool) { permuteScalarX2(state, turbo) } - -func permuteSIMDx4(state []uint64, turbo bool) { permuteScalarX4(state, turbo) } diff --git a/backend/vendor/github.com/gorilla/websocket/.gitignore b/backend/vendor/github.com/gorilla/websocket/.gitignore deleted file mode 100644 index cd3fcd1..0000000 --- a/backend/vendor/github.com/gorilla/websocket/.gitignore +++ /dev/null @@ -1,25 +0,0 @@ -# Compiled Object files, Static and Dynamic libs (Shared Objects) -*.o -*.a -*.so - -# Folders -_obj -_test - -# Architecture specific extensions/prefixes -*.[568vq] -[568vq].out - -*.cgo1.go -*.cgo2.c -_cgo_defun.c -_cgo_gotypes.go -_cgo_export.* - -_testmain.go - -*.exe - -.idea/ -*.iml diff --git a/backend/vendor/github.com/gorilla/websocket/AUTHORS b/backend/vendor/github.com/gorilla/websocket/AUTHORS deleted file mode 100644 index 1931f40..0000000 --- a/backend/vendor/github.com/gorilla/websocket/AUTHORS +++ /dev/null @@ -1,9 +0,0 @@ -# This is the official list of Gorilla WebSocket authors for copyright -# purposes. -# -# Please keep the list sorted. - -Gary Burd -Google LLC (https://opensource.google.com/) -Joachim Bauch - diff --git a/backend/vendor/github.com/gorilla/websocket/LICENSE b/backend/vendor/github.com/gorilla/websocket/LICENSE deleted file mode 100644 index 9171c97..0000000 --- a/backend/vendor/github.com/gorilla/websocket/LICENSE +++ /dev/null @@ -1,22 +0,0 @@ -Copyright (c) 2013 The Gorilla WebSocket Authors. All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are met: - - Redistributions of source code must retain the above copyright notice, this - list of conditions and the following disclaimer. - - Redistributions in binary form must reproduce the above copyright notice, - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/backend/vendor/github.com/gorilla/websocket/README.md b/backend/vendor/github.com/gorilla/websocket/README.md deleted file mode 100644 index d33ed7f..0000000 --- a/backend/vendor/github.com/gorilla/websocket/README.md +++ /dev/null @@ -1,33 +0,0 @@ -# Gorilla WebSocket - -[![GoDoc](https://godoc.org/github.com/gorilla/websocket?status.svg)](https://godoc.org/github.com/gorilla/websocket) -[![CircleCI](https://circleci.com/gh/gorilla/websocket.svg?style=svg)](https://circleci.com/gh/gorilla/websocket) - -Gorilla WebSocket is a [Go](http://golang.org/) implementation of the -[WebSocket](http://www.rfc-editor.org/rfc/rfc6455.txt) protocol. - - -### Documentation - -* [API Reference](https://pkg.go.dev/github.com/gorilla/websocket?tab=doc) -* [Chat example](https://github.com/gorilla/websocket/tree/master/examples/chat) -* [Command example](https://github.com/gorilla/websocket/tree/master/examples/command) -* [Client and server example](https://github.com/gorilla/websocket/tree/master/examples/echo) -* [File watch example](https://github.com/gorilla/websocket/tree/master/examples/filewatch) - -### Status - -The Gorilla WebSocket package provides a complete and tested implementation of -the [WebSocket](http://www.rfc-editor.org/rfc/rfc6455.txt) protocol. The -package API is stable. - -### Installation - - go get github.com/gorilla/websocket - -### Protocol Compliance - -The Gorilla WebSocket package passes the server tests in the [Autobahn Test -Suite](https://github.com/crossbario/autobahn-testsuite) using the application in the [examples/autobahn -subdirectory](https://github.com/gorilla/websocket/tree/master/examples/autobahn). - diff --git a/backend/vendor/github.com/gorilla/websocket/client.go b/backend/vendor/github.com/gorilla/websocket/client.go deleted file mode 100644 index 04fdafe..0000000 --- a/backend/vendor/github.com/gorilla/websocket/client.go +++ /dev/null @@ -1,434 +0,0 @@ -// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package websocket - -import ( - "bytes" - "context" - "crypto/tls" - "errors" - "fmt" - "io" - "io/ioutil" - "net" - "net/http" - "net/http/httptrace" - "net/url" - "strings" - "time" -) - -// ErrBadHandshake is returned when the server response to opening handshake is -// invalid. -var ErrBadHandshake = errors.New("websocket: bad handshake") - -var errInvalidCompression = errors.New("websocket: invalid compression negotiation") - -// NewClient creates a new client connection using the given net connection. -// The URL u specifies the host and request URI. Use requestHeader to specify -// the origin (Origin), subprotocols (Sec-WebSocket-Protocol) and cookies -// (Cookie). Use the response.Header to get the selected subprotocol -// (Sec-WebSocket-Protocol) and cookies (Set-Cookie). -// -// If the WebSocket handshake fails, ErrBadHandshake is returned along with a -// non-nil *http.Response so that callers can handle redirects, authentication, -// etc. -// -// Deprecated: Use Dialer instead. -func NewClient(netConn net.Conn, u *url.URL, requestHeader http.Header, readBufSize, writeBufSize int) (c *Conn, response *http.Response, err error) { - d := Dialer{ - ReadBufferSize: readBufSize, - WriteBufferSize: writeBufSize, - NetDial: func(net, addr string) (net.Conn, error) { - return netConn, nil - }, - } - return d.Dial(u.String(), requestHeader) -} - -// A Dialer contains options for connecting to WebSocket server. -// -// It is safe to call Dialer's methods concurrently. -type Dialer struct { - // NetDial specifies the dial function for creating TCP connections. If - // NetDial is nil, net.Dial is used. - NetDial func(network, addr string) (net.Conn, error) - - // NetDialContext specifies the dial function for creating TCP connections. If - // NetDialContext is nil, NetDial is used. - NetDialContext func(ctx context.Context, network, addr string) (net.Conn, error) - - // NetDialTLSContext specifies the dial function for creating TLS/TCP connections. If - // NetDialTLSContext is nil, NetDialContext is used. - // If NetDialTLSContext is set, Dial assumes the TLS handshake is done there and - // TLSClientConfig is ignored. - NetDialTLSContext func(ctx context.Context, network, addr string) (net.Conn, error) - - // Proxy specifies a function to return a proxy for a given - // Request. If the function returns a non-nil error, the - // request is aborted with the provided error. - // If Proxy is nil or returns a nil *URL, no proxy is used. - Proxy func(*http.Request) (*url.URL, error) - - // TLSClientConfig specifies the TLS configuration to use with tls.Client. - // If nil, the default configuration is used. - // If either NetDialTLS or NetDialTLSContext are set, Dial assumes the TLS handshake - // is done there and TLSClientConfig is ignored. - TLSClientConfig *tls.Config - - // HandshakeTimeout specifies the duration for the handshake to complete. - HandshakeTimeout time.Duration - - // ReadBufferSize and WriteBufferSize specify I/O buffer sizes in bytes. If a buffer - // size is zero, then a useful default size is used. The I/O buffer sizes - // do not limit the size of the messages that can be sent or received. - ReadBufferSize, WriteBufferSize int - - // WriteBufferPool is a pool of buffers for write operations. If the value - // is not set, then write buffers are allocated to the connection for the - // lifetime of the connection. - // - // A pool is most useful when the application has a modest volume of writes - // across a large number of connections. - // - // Applications should use a single pool for each unique value of - // WriteBufferSize. - WriteBufferPool BufferPool - - // Subprotocols specifies the client's requested subprotocols. - Subprotocols []string - - // EnableCompression specifies if the client should attempt to negotiate - // per message compression (RFC 7692). Setting this value to true does not - // guarantee that compression will be supported. Currently only "no context - // takeover" modes are supported. - EnableCompression bool - - // Jar specifies the cookie jar. - // If Jar is nil, cookies are not sent in requests and ignored - // in responses. - Jar http.CookieJar -} - -// Dial creates a new client connection by calling DialContext with a background context. -func (d *Dialer) Dial(urlStr string, requestHeader http.Header) (*Conn, *http.Response, error) { - return d.DialContext(context.Background(), urlStr, requestHeader) -} - -var errMalformedURL = errors.New("malformed ws or wss URL") - -func hostPortNoPort(u *url.URL) (hostPort, hostNoPort string) { - hostPort = u.Host - hostNoPort = u.Host - if i := strings.LastIndex(u.Host, ":"); i > strings.LastIndex(u.Host, "]") { - hostNoPort = hostNoPort[:i] - } else { - switch u.Scheme { - case "wss": - hostPort += ":443" - case "https": - hostPort += ":443" - default: - hostPort += ":80" - } - } - return hostPort, hostNoPort -} - -// DefaultDialer is a dialer with all fields set to the default values. -var DefaultDialer = &Dialer{ - Proxy: http.ProxyFromEnvironment, - HandshakeTimeout: 45 * time.Second, -} - -// nilDialer is dialer to use when receiver is nil. -var nilDialer = *DefaultDialer - -// DialContext creates a new client connection. Use requestHeader to specify the -// origin (Origin), subprotocols (Sec-WebSocket-Protocol) and cookies (Cookie). -// Use the response.Header to get the selected subprotocol -// (Sec-WebSocket-Protocol) and cookies (Set-Cookie). -// -// The context will be used in the request and in the Dialer. -// -// If the WebSocket handshake fails, ErrBadHandshake is returned along with a -// non-nil *http.Response so that callers can handle redirects, authentication, -// etcetera. The response body may not contain the entire response and does not -// need to be closed by the application. -func (d *Dialer) DialContext(ctx context.Context, urlStr string, requestHeader http.Header) (*Conn, *http.Response, error) { - if d == nil { - d = &nilDialer - } - - challengeKey, err := generateChallengeKey() - if err != nil { - return nil, nil, err - } - - u, err := url.Parse(urlStr) - if err != nil { - return nil, nil, err - } - - switch u.Scheme { - case "ws": - u.Scheme = "http" - case "wss": - u.Scheme = "https" - default: - return nil, nil, errMalformedURL - } - - if u.User != nil { - // User name and password are not allowed in websocket URIs. - return nil, nil, errMalformedURL - } - - req := &http.Request{ - Method: http.MethodGet, - URL: u, - Proto: "HTTP/1.1", - ProtoMajor: 1, - ProtoMinor: 1, - Header: make(http.Header), - Host: u.Host, - } - req = req.WithContext(ctx) - - // Set the cookies present in the cookie jar of the dialer - if d.Jar != nil { - for _, cookie := range d.Jar.Cookies(u) { - req.AddCookie(cookie) - } - } - - // Set the request headers using the capitalization for names and values in - // RFC examples. Although the capitalization shouldn't matter, there are - // servers that depend on it. The Header.Set method is not used because the - // method canonicalizes the header names. - req.Header["Upgrade"] = []string{"websocket"} - req.Header["Connection"] = []string{"Upgrade"} - req.Header["Sec-WebSocket-Key"] = []string{challengeKey} - req.Header["Sec-WebSocket-Version"] = []string{"13"} - if len(d.Subprotocols) > 0 { - req.Header["Sec-WebSocket-Protocol"] = []string{strings.Join(d.Subprotocols, ", ")} - } - for k, vs := range requestHeader { - switch { - case k == "Host": - if len(vs) > 0 { - req.Host = vs[0] - } - case k == "Upgrade" || - k == "Connection" || - k == "Sec-Websocket-Key" || - k == "Sec-Websocket-Version" || - k == "Sec-Websocket-Extensions" || - (k == "Sec-Websocket-Protocol" && len(d.Subprotocols) > 0): - return nil, nil, errors.New("websocket: duplicate header not allowed: " + k) - case k == "Sec-Websocket-Protocol": - req.Header["Sec-WebSocket-Protocol"] = vs - default: - req.Header[k] = vs - } - } - - if d.EnableCompression { - req.Header["Sec-WebSocket-Extensions"] = []string{"permessage-deflate; server_no_context_takeover; client_no_context_takeover"} - } - - if d.HandshakeTimeout != 0 { - var cancel func() - ctx, cancel = context.WithTimeout(ctx, d.HandshakeTimeout) - defer cancel() - } - - // Get network dial function. - var netDial func(network, add string) (net.Conn, error) - - switch u.Scheme { - case "http": - if d.NetDialContext != nil { - netDial = func(network, addr string) (net.Conn, error) { - return d.NetDialContext(ctx, network, addr) - } - } else if d.NetDial != nil { - netDial = d.NetDial - } - case "https": - if d.NetDialTLSContext != nil { - netDial = func(network, addr string) (net.Conn, error) { - return d.NetDialTLSContext(ctx, network, addr) - } - } else if d.NetDialContext != nil { - netDial = func(network, addr string) (net.Conn, error) { - return d.NetDialContext(ctx, network, addr) - } - } else if d.NetDial != nil { - netDial = d.NetDial - } - default: - return nil, nil, errMalformedURL - } - - if netDial == nil { - netDialer := &net.Dialer{} - netDial = func(network, addr string) (net.Conn, error) { - return netDialer.DialContext(ctx, network, addr) - } - } - - // If needed, wrap the dial function to set the connection deadline. - if deadline, ok := ctx.Deadline(); ok { - forwardDial := netDial - netDial = func(network, addr string) (net.Conn, error) { - c, err := forwardDial(network, addr) - if err != nil { - return nil, err - } - err = c.SetDeadline(deadline) - if err != nil { - c.Close() - return nil, err - } - return c, nil - } - } - - // If needed, wrap the dial function to connect through a proxy. - if d.Proxy != nil { - proxyURL, err := d.Proxy(req) - if err != nil { - return nil, nil, err - } - if proxyURL != nil { - dialer, err := proxy_FromURL(proxyURL, netDialerFunc(netDial)) - if err != nil { - return nil, nil, err - } - netDial = dialer.Dial - } - } - - hostPort, hostNoPort := hostPortNoPort(u) - trace := httptrace.ContextClientTrace(ctx) - if trace != nil && trace.GetConn != nil { - trace.GetConn(hostPort) - } - - netConn, err := netDial("tcp", hostPort) - if err != nil { - return nil, nil, err - } - if trace != nil && trace.GotConn != nil { - trace.GotConn(httptrace.GotConnInfo{ - Conn: netConn, - }) - } - - defer func() { - if netConn != nil { - netConn.Close() - } - }() - - if u.Scheme == "https" && d.NetDialTLSContext == nil { - // If NetDialTLSContext is set, assume that the TLS handshake has already been done - - cfg := cloneTLSConfig(d.TLSClientConfig) - if cfg.ServerName == "" { - cfg.ServerName = hostNoPort - } - tlsConn := tls.Client(netConn, cfg) - netConn = tlsConn - - if trace != nil && trace.TLSHandshakeStart != nil { - trace.TLSHandshakeStart() - } - err := doHandshake(ctx, tlsConn, cfg) - if trace != nil && trace.TLSHandshakeDone != nil { - trace.TLSHandshakeDone(tlsConn.ConnectionState(), err) - } - - if err != nil { - return nil, nil, err - } - } - - conn := newConn(netConn, false, d.ReadBufferSize, d.WriteBufferSize, d.WriteBufferPool, nil, nil) - - if err := req.Write(netConn); err != nil { - return nil, nil, err - } - - if trace != nil && trace.GotFirstResponseByte != nil { - if peek, err := conn.br.Peek(1); err == nil && len(peek) == 1 { - trace.GotFirstResponseByte() - } - } - - resp, err := http.ReadResponse(conn.br, req) - if err != nil { - if d.TLSClientConfig != nil { - for _, proto := range d.TLSClientConfig.NextProtos { - if proto != "http/1.1" { - return nil, nil, fmt.Errorf( - "websocket: protocol %q was given but is not supported;"+ - "sharing tls.Config with net/http Transport can cause this error: %w", - proto, err, - ) - } - } - } - return nil, nil, err - } - - if d.Jar != nil { - if rc := resp.Cookies(); len(rc) > 0 { - d.Jar.SetCookies(u, rc) - } - } - - if resp.StatusCode != 101 || - !tokenListContainsValue(resp.Header, "Upgrade", "websocket") || - !tokenListContainsValue(resp.Header, "Connection", "upgrade") || - resp.Header.Get("Sec-Websocket-Accept") != computeAcceptKey(challengeKey) { - // Before closing the network connection on return from this - // function, slurp up some of the response to aid application - // debugging. - buf := make([]byte, 1024) - n, _ := io.ReadFull(resp.Body, buf) - resp.Body = ioutil.NopCloser(bytes.NewReader(buf[:n])) - return nil, resp, ErrBadHandshake - } - - for _, ext := range parseExtensions(resp.Header) { - if ext[""] != "permessage-deflate" { - continue - } - _, snct := ext["server_no_context_takeover"] - _, cnct := ext["client_no_context_takeover"] - if !snct || !cnct { - return nil, resp, errInvalidCompression - } - conn.newCompressionWriter = compressNoContextTakeover - conn.newDecompressionReader = decompressNoContextTakeover - break - } - - resp.Body = ioutil.NopCloser(bytes.NewReader([]byte{})) - conn.subprotocol = resp.Header.Get("Sec-Websocket-Protocol") - - netConn.SetDeadline(time.Time{}) - netConn = nil // to avoid close in defer. - return conn, resp, nil -} - -func cloneTLSConfig(cfg *tls.Config) *tls.Config { - if cfg == nil { - return &tls.Config{} - } - return cfg.Clone() -} diff --git a/backend/vendor/github.com/gorilla/websocket/compression.go b/backend/vendor/github.com/gorilla/websocket/compression.go deleted file mode 100644 index 813ffb1..0000000 --- a/backend/vendor/github.com/gorilla/websocket/compression.go +++ /dev/null @@ -1,148 +0,0 @@ -// Copyright 2017 The Gorilla WebSocket Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package websocket - -import ( - "compress/flate" - "errors" - "io" - "strings" - "sync" -) - -const ( - minCompressionLevel = -2 // flate.HuffmanOnly not defined in Go < 1.6 - maxCompressionLevel = flate.BestCompression - defaultCompressionLevel = 1 -) - -var ( - flateWriterPools [maxCompressionLevel - minCompressionLevel + 1]sync.Pool - flateReaderPool = sync.Pool{New: func() interface{} { - return flate.NewReader(nil) - }} -) - -func decompressNoContextTakeover(r io.Reader) io.ReadCloser { - const tail = - // Add four bytes as specified in RFC - "\x00\x00\xff\xff" + - // Add final block to squelch unexpected EOF error from flate reader. - "\x01\x00\x00\xff\xff" - - fr, _ := flateReaderPool.Get().(io.ReadCloser) - fr.(flate.Resetter).Reset(io.MultiReader(r, strings.NewReader(tail)), nil) - return &flateReadWrapper{fr} -} - -func isValidCompressionLevel(level int) bool { - return minCompressionLevel <= level && level <= maxCompressionLevel -} - -func compressNoContextTakeover(w io.WriteCloser, level int) io.WriteCloser { - p := &flateWriterPools[level-minCompressionLevel] - tw := &truncWriter{w: w} - fw, _ := p.Get().(*flate.Writer) - if fw == nil { - fw, _ = flate.NewWriter(tw, level) - } else { - fw.Reset(tw) - } - return &flateWriteWrapper{fw: fw, tw: tw, p: p} -} - -// truncWriter is an io.Writer that writes all but the last four bytes of the -// stream to another io.Writer. -type truncWriter struct { - w io.WriteCloser - n int - p [4]byte -} - -func (w *truncWriter) Write(p []byte) (int, error) { - n := 0 - - // fill buffer first for simplicity. - if w.n < len(w.p) { - n = copy(w.p[w.n:], p) - p = p[n:] - w.n += n - if len(p) == 0 { - return n, nil - } - } - - m := len(p) - if m > len(w.p) { - m = len(w.p) - } - - if nn, err := w.w.Write(w.p[:m]); err != nil { - return n + nn, err - } - - copy(w.p[:], w.p[m:]) - copy(w.p[len(w.p)-m:], p[len(p)-m:]) - nn, err := w.w.Write(p[:len(p)-m]) - return n + nn, err -} - -type flateWriteWrapper struct { - fw *flate.Writer - tw *truncWriter - p *sync.Pool -} - -func (w *flateWriteWrapper) Write(p []byte) (int, error) { - if w.fw == nil { - return 0, errWriteClosed - } - return w.fw.Write(p) -} - -func (w *flateWriteWrapper) Close() error { - if w.fw == nil { - return errWriteClosed - } - err1 := w.fw.Flush() - w.p.Put(w.fw) - w.fw = nil - if w.tw.p != [4]byte{0, 0, 0xff, 0xff} { - return errors.New("websocket: internal error, unexpected bytes at end of flate stream") - } - err2 := w.tw.w.Close() - if err1 != nil { - return err1 - } - return err2 -} - -type flateReadWrapper struct { - fr io.ReadCloser -} - -func (r *flateReadWrapper) Read(p []byte) (int, error) { - if r.fr == nil { - return 0, io.ErrClosedPipe - } - n, err := r.fr.Read(p) - if err == io.EOF { - // Preemptively place the reader back in the pool. This helps with - // scenarios where the application does not call NextReader() soon after - // this final read. - r.Close() - } - return n, err -} - -func (r *flateReadWrapper) Close() error { - if r.fr == nil { - return io.ErrClosedPipe - } - err := r.fr.Close() - flateReaderPool.Put(r.fr) - r.fr = nil - return err -} diff --git a/backend/vendor/github.com/gorilla/websocket/conn.go b/backend/vendor/github.com/gorilla/websocket/conn.go deleted file mode 100644 index 5161ef8..0000000 --- a/backend/vendor/github.com/gorilla/websocket/conn.go +++ /dev/null @@ -1,1238 +0,0 @@ -// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package websocket - -import ( - "bufio" - "encoding/binary" - "errors" - "io" - "io/ioutil" - "math/rand" - "net" - "strconv" - "strings" - "sync" - "time" - "unicode/utf8" -) - -const ( - // Frame header byte 0 bits from Section 5.2 of RFC 6455 - finalBit = 1 << 7 - rsv1Bit = 1 << 6 - rsv2Bit = 1 << 5 - rsv3Bit = 1 << 4 - - // Frame header byte 1 bits from Section 5.2 of RFC 6455 - maskBit = 1 << 7 - - maxFrameHeaderSize = 2 + 8 + 4 // Fixed header + length + mask - maxControlFramePayloadSize = 125 - - writeWait = time.Second - - defaultReadBufferSize = 4096 - defaultWriteBufferSize = 4096 - - continuationFrame = 0 - noFrame = -1 -) - -// Close codes defined in RFC 6455, section 11.7. -const ( - CloseNormalClosure = 1000 - CloseGoingAway = 1001 - CloseProtocolError = 1002 - CloseUnsupportedData = 1003 - CloseNoStatusReceived = 1005 - CloseAbnormalClosure = 1006 - CloseInvalidFramePayloadData = 1007 - ClosePolicyViolation = 1008 - CloseMessageTooBig = 1009 - CloseMandatoryExtension = 1010 - CloseInternalServerErr = 1011 - CloseServiceRestart = 1012 - CloseTryAgainLater = 1013 - CloseTLSHandshake = 1015 -) - -// The message types are defined in RFC 6455, section 11.8. -const ( - // TextMessage denotes a text data message. The text message payload is - // interpreted as UTF-8 encoded text data. - TextMessage = 1 - - // BinaryMessage denotes a binary data message. - BinaryMessage = 2 - - // CloseMessage denotes a close control message. The optional message - // payload contains a numeric code and text. Use the FormatCloseMessage - // function to format a close message payload. - CloseMessage = 8 - - // PingMessage denotes a ping control message. The optional message payload - // is UTF-8 encoded text. - PingMessage = 9 - - // PongMessage denotes a pong control message. The optional message payload - // is UTF-8 encoded text. - PongMessage = 10 -) - -// ErrCloseSent is returned when the application writes a message to the -// connection after sending a close message. -var ErrCloseSent = errors.New("websocket: close sent") - -// ErrReadLimit is returned when reading a message that is larger than the -// read limit set for the connection. -var ErrReadLimit = errors.New("websocket: read limit exceeded") - -// netError satisfies the net Error interface. -type netError struct { - msg string - temporary bool - timeout bool -} - -func (e *netError) Error() string { return e.msg } -func (e *netError) Temporary() bool { return e.temporary } -func (e *netError) Timeout() bool { return e.timeout } - -// CloseError represents a close message. -type CloseError struct { - // Code is defined in RFC 6455, section 11.7. - Code int - - // Text is the optional text payload. - Text string -} - -func (e *CloseError) Error() string { - s := []byte("websocket: close ") - s = strconv.AppendInt(s, int64(e.Code), 10) - switch e.Code { - case CloseNormalClosure: - s = append(s, " (normal)"...) - case CloseGoingAway: - s = append(s, " (going away)"...) - case CloseProtocolError: - s = append(s, " (protocol error)"...) - case CloseUnsupportedData: - s = append(s, " (unsupported data)"...) - case CloseNoStatusReceived: - s = append(s, " (no status)"...) - case CloseAbnormalClosure: - s = append(s, " (abnormal closure)"...) - case CloseInvalidFramePayloadData: - s = append(s, " (invalid payload data)"...) - case ClosePolicyViolation: - s = append(s, " (policy violation)"...) - case CloseMessageTooBig: - s = append(s, " (message too big)"...) - case CloseMandatoryExtension: - s = append(s, " (mandatory extension missing)"...) - case CloseInternalServerErr: - s = append(s, " (internal server error)"...) - case CloseTLSHandshake: - s = append(s, " (TLS handshake error)"...) - } - if e.Text != "" { - s = append(s, ": "...) - s = append(s, e.Text...) - } - return string(s) -} - -// IsCloseError returns boolean indicating whether the error is a *CloseError -// with one of the specified codes. -func IsCloseError(err error, codes ...int) bool { - if e, ok := err.(*CloseError); ok { - for _, code := range codes { - if e.Code == code { - return true - } - } - } - return false -} - -// IsUnexpectedCloseError returns boolean indicating whether the error is a -// *CloseError with a code not in the list of expected codes. -func IsUnexpectedCloseError(err error, expectedCodes ...int) bool { - if e, ok := err.(*CloseError); ok { - for _, code := range expectedCodes { - if e.Code == code { - return false - } - } - return true - } - return false -} - -var ( - errWriteTimeout = &netError{msg: "websocket: write timeout", timeout: true, temporary: true} - errUnexpectedEOF = &CloseError{Code: CloseAbnormalClosure, Text: io.ErrUnexpectedEOF.Error()} - errBadWriteOpCode = errors.New("websocket: bad write message type") - errWriteClosed = errors.New("websocket: write closed") - errInvalidControlFrame = errors.New("websocket: invalid control frame") -) - -func newMaskKey() [4]byte { - n := rand.Uint32() - return [4]byte{byte(n), byte(n >> 8), byte(n >> 16), byte(n >> 24)} -} - -func hideTempErr(err error) error { - if e, ok := err.(net.Error); ok && e.Temporary() { - err = &netError{msg: e.Error(), timeout: e.Timeout()} - } - return err -} - -func isControl(frameType int) bool { - return frameType == CloseMessage || frameType == PingMessage || frameType == PongMessage -} - -func isData(frameType int) bool { - return frameType == TextMessage || frameType == BinaryMessage -} - -var validReceivedCloseCodes = map[int]bool{ - // see http://www.iana.org/assignments/websocket/websocket.xhtml#close-code-number - - CloseNormalClosure: true, - CloseGoingAway: true, - CloseProtocolError: true, - CloseUnsupportedData: true, - CloseNoStatusReceived: false, - CloseAbnormalClosure: false, - CloseInvalidFramePayloadData: true, - ClosePolicyViolation: true, - CloseMessageTooBig: true, - CloseMandatoryExtension: true, - CloseInternalServerErr: true, - CloseServiceRestart: true, - CloseTryAgainLater: true, - CloseTLSHandshake: false, -} - -func isValidReceivedCloseCode(code int) bool { - return validReceivedCloseCodes[code] || (code >= 3000 && code <= 4999) -} - -// BufferPool represents a pool of buffers. The *sync.Pool type satisfies this -// interface. The type of the value stored in a pool is not specified. -type BufferPool interface { - // Get gets a value from the pool or returns nil if the pool is empty. - Get() interface{} - // Put adds a value to the pool. - Put(interface{}) -} - -// writePoolData is the type added to the write buffer pool. This wrapper is -// used to prevent applications from peeking at and depending on the values -// added to the pool. -type writePoolData struct{ buf []byte } - -// The Conn type represents a WebSocket connection. -type Conn struct { - conn net.Conn - isServer bool - subprotocol string - - // Write fields - mu chan struct{} // used as mutex to protect write to conn - writeBuf []byte // frame is constructed in this buffer. - writePool BufferPool - writeBufSize int - writeDeadline time.Time - writer io.WriteCloser // the current writer returned to the application - isWriting bool // for best-effort concurrent write detection - - writeErrMu sync.Mutex - writeErr error - - enableWriteCompression bool - compressionLevel int - newCompressionWriter func(io.WriteCloser, int) io.WriteCloser - - // Read fields - reader io.ReadCloser // the current reader returned to the application - readErr error - br *bufio.Reader - // bytes remaining in current frame. - // set setReadRemaining to safely update this value and prevent overflow - readRemaining int64 - readFinal bool // true the current message has more frames. - readLength int64 // Message size. - readLimit int64 // Maximum message size. - readMaskPos int - readMaskKey [4]byte - handlePong func(string) error - handlePing func(string) error - handleClose func(int, string) error - readErrCount int - messageReader *messageReader // the current low-level reader - - readDecompress bool // whether last read frame had RSV1 set - newDecompressionReader func(io.Reader) io.ReadCloser -} - -func newConn(conn net.Conn, isServer bool, readBufferSize, writeBufferSize int, writeBufferPool BufferPool, br *bufio.Reader, writeBuf []byte) *Conn { - - if br == nil { - if readBufferSize == 0 { - readBufferSize = defaultReadBufferSize - } else if readBufferSize < maxControlFramePayloadSize { - // must be large enough for control frame - readBufferSize = maxControlFramePayloadSize - } - br = bufio.NewReaderSize(conn, readBufferSize) - } - - if writeBufferSize <= 0 { - writeBufferSize = defaultWriteBufferSize - } - writeBufferSize += maxFrameHeaderSize - - if writeBuf == nil && writeBufferPool == nil { - writeBuf = make([]byte, writeBufferSize) - } - - mu := make(chan struct{}, 1) - mu <- struct{}{} - c := &Conn{ - isServer: isServer, - br: br, - conn: conn, - mu: mu, - readFinal: true, - writeBuf: writeBuf, - writePool: writeBufferPool, - writeBufSize: writeBufferSize, - enableWriteCompression: true, - compressionLevel: defaultCompressionLevel, - } - c.SetCloseHandler(nil) - c.SetPingHandler(nil) - c.SetPongHandler(nil) - return c -} - -// setReadRemaining tracks the number of bytes remaining on the connection. If n -// overflows, an ErrReadLimit is returned. -func (c *Conn) setReadRemaining(n int64) error { - if n < 0 { - return ErrReadLimit - } - - c.readRemaining = n - return nil -} - -// Subprotocol returns the negotiated protocol for the connection. -func (c *Conn) Subprotocol() string { - return c.subprotocol -} - -// Close closes the underlying network connection without sending or waiting -// for a close message. -func (c *Conn) Close() error { - return c.conn.Close() -} - -// LocalAddr returns the local network address. -func (c *Conn) LocalAddr() net.Addr { - return c.conn.LocalAddr() -} - -// RemoteAddr returns the remote network address. -func (c *Conn) RemoteAddr() net.Addr { - return c.conn.RemoteAddr() -} - -// Write methods - -func (c *Conn) writeFatal(err error) error { - err = hideTempErr(err) - c.writeErrMu.Lock() - if c.writeErr == nil { - c.writeErr = err - } - c.writeErrMu.Unlock() - return err -} - -func (c *Conn) read(n int) ([]byte, error) { - p, err := c.br.Peek(n) - if err == io.EOF { - err = errUnexpectedEOF - } - c.br.Discard(len(p)) - return p, err -} - -func (c *Conn) write(frameType int, deadline time.Time, buf0, buf1 []byte) error { - <-c.mu - defer func() { c.mu <- struct{}{} }() - - c.writeErrMu.Lock() - err := c.writeErr - c.writeErrMu.Unlock() - if err != nil { - return err - } - - c.conn.SetWriteDeadline(deadline) - if len(buf1) == 0 { - _, err = c.conn.Write(buf0) - } else { - err = c.writeBufs(buf0, buf1) - } - if err != nil { - return c.writeFatal(err) - } - if frameType == CloseMessage { - c.writeFatal(ErrCloseSent) - } - return nil -} - -func (c *Conn) writeBufs(bufs ...[]byte) error { - b := net.Buffers(bufs) - _, err := b.WriteTo(c.conn) - return err -} - -// WriteControl writes a control message with the given deadline. The allowed -// message types are CloseMessage, PingMessage and PongMessage. -func (c *Conn) WriteControl(messageType int, data []byte, deadline time.Time) error { - if !isControl(messageType) { - return errBadWriteOpCode - } - if len(data) > maxControlFramePayloadSize { - return errInvalidControlFrame - } - - b0 := byte(messageType) | finalBit - b1 := byte(len(data)) - if !c.isServer { - b1 |= maskBit - } - - buf := make([]byte, 0, maxFrameHeaderSize+maxControlFramePayloadSize) - buf = append(buf, b0, b1) - - if c.isServer { - buf = append(buf, data...) - } else { - key := newMaskKey() - buf = append(buf, key[:]...) - buf = append(buf, data...) - maskBytes(key, 0, buf[6:]) - } - - d := 1000 * time.Hour - if !deadline.IsZero() { - d = deadline.Sub(time.Now()) - if d < 0 { - return errWriteTimeout - } - } - - timer := time.NewTimer(d) - select { - case <-c.mu: - timer.Stop() - case <-timer.C: - return errWriteTimeout - } - defer func() { c.mu <- struct{}{} }() - - c.writeErrMu.Lock() - err := c.writeErr - c.writeErrMu.Unlock() - if err != nil { - return err - } - - c.conn.SetWriteDeadline(deadline) - _, err = c.conn.Write(buf) - if err != nil { - return c.writeFatal(err) - } - if messageType == CloseMessage { - c.writeFatal(ErrCloseSent) - } - return err -} - -// beginMessage prepares a connection and message writer for a new message. -func (c *Conn) beginMessage(mw *messageWriter, messageType int) error { - // Close previous writer if not already closed by the application. It's - // probably better to return an error in this situation, but we cannot - // change this without breaking existing applications. - if c.writer != nil { - c.writer.Close() - c.writer = nil - } - - if !isControl(messageType) && !isData(messageType) { - return errBadWriteOpCode - } - - c.writeErrMu.Lock() - err := c.writeErr - c.writeErrMu.Unlock() - if err != nil { - return err - } - - mw.c = c - mw.frameType = messageType - mw.pos = maxFrameHeaderSize - - if c.writeBuf == nil { - wpd, ok := c.writePool.Get().(writePoolData) - if ok { - c.writeBuf = wpd.buf - } else { - c.writeBuf = make([]byte, c.writeBufSize) - } - } - return nil -} - -// NextWriter returns a writer for the next message to send. The writer's Close -// method flushes the complete message to the network. -// -// There can be at most one open writer on a connection. NextWriter closes the -// previous writer if the application has not already done so. -// -// All message types (TextMessage, BinaryMessage, CloseMessage, PingMessage and -// PongMessage) are supported. -func (c *Conn) NextWriter(messageType int) (io.WriteCloser, error) { - var mw messageWriter - if err := c.beginMessage(&mw, messageType); err != nil { - return nil, err - } - c.writer = &mw - if c.newCompressionWriter != nil && c.enableWriteCompression && isData(messageType) { - w := c.newCompressionWriter(c.writer, c.compressionLevel) - mw.compress = true - c.writer = w - } - return c.writer, nil -} - -type messageWriter struct { - c *Conn - compress bool // whether next call to flushFrame should set RSV1 - pos int // end of data in writeBuf. - frameType int // type of the current frame. - err error -} - -func (w *messageWriter) endMessage(err error) error { - if w.err != nil { - return err - } - c := w.c - w.err = err - c.writer = nil - if c.writePool != nil { - c.writePool.Put(writePoolData{buf: c.writeBuf}) - c.writeBuf = nil - } - return err -} - -// flushFrame writes buffered data and extra as a frame to the network. The -// final argument indicates that this is the last frame in the message. -func (w *messageWriter) flushFrame(final bool, extra []byte) error { - c := w.c - length := w.pos - maxFrameHeaderSize + len(extra) - - // Check for invalid control frames. - if isControl(w.frameType) && - (!final || length > maxControlFramePayloadSize) { - return w.endMessage(errInvalidControlFrame) - } - - b0 := byte(w.frameType) - if final { - b0 |= finalBit - } - if w.compress { - b0 |= rsv1Bit - } - w.compress = false - - b1 := byte(0) - if !c.isServer { - b1 |= maskBit - } - - // Assume that the frame starts at beginning of c.writeBuf. - framePos := 0 - if c.isServer { - // Adjust up if mask not included in the header. - framePos = 4 - } - - switch { - case length >= 65536: - c.writeBuf[framePos] = b0 - c.writeBuf[framePos+1] = b1 | 127 - binary.BigEndian.PutUint64(c.writeBuf[framePos+2:], uint64(length)) - case length > 125: - framePos += 6 - c.writeBuf[framePos] = b0 - c.writeBuf[framePos+1] = b1 | 126 - binary.BigEndian.PutUint16(c.writeBuf[framePos+2:], uint16(length)) - default: - framePos += 8 - c.writeBuf[framePos] = b0 - c.writeBuf[framePos+1] = b1 | byte(length) - } - - if !c.isServer { - key := newMaskKey() - copy(c.writeBuf[maxFrameHeaderSize-4:], key[:]) - maskBytes(key, 0, c.writeBuf[maxFrameHeaderSize:w.pos]) - if len(extra) > 0 { - return w.endMessage(c.writeFatal(errors.New("websocket: internal error, extra used in client mode"))) - } - } - - // Write the buffers to the connection with best-effort detection of - // concurrent writes. See the concurrency section in the package - // documentation for more info. - - if c.isWriting { - panic("concurrent write to websocket connection") - } - c.isWriting = true - - err := c.write(w.frameType, c.writeDeadline, c.writeBuf[framePos:w.pos], extra) - - if !c.isWriting { - panic("concurrent write to websocket connection") - } - c.isWriting = false - - if err != nil { - return w.endMessage(err) - } - - if final { - w.endMessage(errWriteClosed) - return nil - } - - // Setup for next frame. - w.pos = maxFrameHeaderSize - w.frameType = continuationFrame - return nil -} - -func (w *messageWriter) ncopy(max int) (int, error) { - n := len(w.c.writeBuf) - w.pos - if n <= 0 { - if err := w.flushFrame(false, nil); err != nil { - return 0, err - } - n = len(w.c.writeBuf) - w.pos - } - if n > max { - n = max - } - return n, nil -} - -func (w *messageWriter) Write(p []byte) (int, error) { - if w.err != nil { - return 0, w.err - } - - if len(p) > 2*len(w.c.writeBuf) && w.c.isServer { - // Don't buffer large messages. - err := w.flushFrame(false, p) - if err != nil { - return 0, err - } - return len(p), nil - } - - nn := len(p) - for len(p) > 0 { - n, err := w.ncopy(len(p)) - if err != nil { - return 0, err - } - copy(w.c.writeBuf[w.pos:], p[:n]) - w.pos += n - p = p[n:] - } - return nn, nil -} - -func (w *messageWriter) WriteString(p string) (int, error) { - if w.err != nil { - return 0, w.err - } - - nn := len(p) - for len(p) > 0 { - n, err := w.ncopy(len(p)) - if err != nil { - return 0, err - } - copy(w.c.writeBuf[w.pos:], p[:n]) - w.pos += n - p = p[n:] - } - return nn, nil -} - -func (w *messageWriter) ReadFrom(r io.Reader) (nn int64, err error) { - if w.err != nil { - return 0, w.err - } - for { - if w.pos == len(w.c.writeBuf) { - err = w.flushFrame(false, nil) - if err != nil { - break - } - } - var n int - n, err = r.Read(w.c.writeBuf[w.pos:]) - w.pos += n - nn += int64(n) - if err != nil { - if err == io.EOF { - err = nil - } - break - } - } - return nn, err -} - -func (w *messageWriter) Close() error { - if w.err != nil { - return w.err - } - return w.flushFrame(true, nil) -} - -// WritePreparedMessage writes prepared message into connection. -func (c *Conn) WritePreparedMessage(pm *PreparedMessage) error { - frameType, frameData, err := pm.frame(prepareKey{ - isServer: c.isServer, - compress: c.newCompressionWriter != nil && c.enableWriteCompression && isData(pm.messageType), - compressionLevel: c.compressionLevel, - }) - if err != nil { - return err - } - if c.isWriting { - panic("concurrent write to websocket connection") - } - c.isWriting = true - err = c.write(frameType, c.writeDeadline, frameData, nil) - if !c.isWriting { - panic("concurrent write to websocket connection") - } - c.isWriting = false - return err -} - -// WriteMessage is a helper method for getting a writer using NextWriter, -// writing the message and closing the writer. -func (c *Conn) WriteMessage(messageType int, data []byte) error { - - if c.isServer && (c.newCompressionWriter == nil || !c.enableWriteCompression) { - // Fast path with no allocations and single frame. - - var mw messageWriter - if err := c.beginMessage(&mw, messageType); err != nil { - return err - } - n := copy(c.writeBuf[mw.pos:], data) - mw.pos += n - data = data[n:] - return mw.flushFrame(true, data) - } - - w, err := c.NextWriter(messageType) - if err != nil { - return err - } - if _, err = w.Write(data); err != nil { - return err - } - return w.Close() -} - -// SetWriteDeadline sets the write deadline on the underlying network -// connection. After a write has timed out, the websocket state is corrupt and -// all future writes will return an error. A zero value for t means writes will -// not time out. -func (c *Conn) SetWriteDeadline(t time.Time) error { - c.writeDeadline = t - return nil -} - -// Read methods - -func (c *Conn) advanceFrame() (int, error) { - // 1. Skip remainder of previous frame. - - if c.readRemaining > 0 { - if _, err := io.CopyN(ioutil.Discard, c.br, c.readRemaining); err != nil { - return noFrame, err - } - } - - // 2. Read and parse first two bytes of frame header. - // To aid debugging, collect and report all errors in the first two bytes - // of the header. - - var errors []string - - p, err := c.read(2) - if err != nil { - return noFrame, err - } - - frameType := int(p[0] & 0xf) - final := p[0]&finalBit != 0 - rsv1 := p[0]&rsv1Bit != 0 - rsv2 := p[0]&rsv2Bit != 0 - rsv3 := p[0]&rsv3Bit != 0 - mask := p[1]&maskBit != 0 - c.setReadRemaining(int64(p[1] & 0x7f)) - - c.readDecompress = false - if rsv1 { - if c.newDecompressionReader != nil { - c.readDecompress = true - } else { - errors = append(errors, "RSV1 set") - } - } - - if rsv2 { - errors = append(errors, "RSV2 set") - } - - if rsv3 { - errors = append(errors, "RSV3 set") - } - - switch frameType { - case CloseMessage, PingMessage, PongMessage: - if c.readRemaining > maxControlFramePayloadSize { - errors = append(errors, "len > 125 for control") - } - if !final { - errors = append(errors, "FIN not set on control") - } - case TextMessage, BinaryMessage: - if !c.readFinal { - errors = append(errors, "data before FIN") - } - c.readFinal = final - case continuationFrame: - if c.readFinal { - errors = append(errors, "continuation after FIN") - } - c.readFinal = final - default: - errors = append(errors, "bad opcode "+strconv.Itoa(frameType)) - } - - if mask != c.isServer { - errors = append(errors, "bad MASK") - } - - if len(errors) > 0 { - return noFrame, c.handleProtocolError(strings.Join(errors, ", ")) - } - - // 3. Read and parse frame length as per - // https://tools.ietf.org/html/rfc6455#section-5.2 - // - // The length of the "Payload data", in bytes: if 0-125, that is the payload - // length. - // - If 126, the following 2 bytes interpreted as a 16-bit unsigned - // integer are the payload length. - // - If 127, the following 8 bytes interpreted as - // a 64-bit unsigned integer (the most significant bit MUST be 0) are the - // payload length. Multibyte length quantities are expressed in network byte - // order. - - switch c.readRemaining { - case 126: - p, err := c.read(2) - if err != nil { - return noFrame, err - } - - if err := c.setReadRemaining(int64(binary.BigEndian.Uint16(p))); err != nil { - return noFrame, err - } - case 127: - p, err := c.read(8) - if err != nil { - return noFrame, err - } - - if err := c.setReadRemaining(int64(binary.BigEndian.Uint64(p))); err != nil { - return noFrame, err - } - } - - // 4. Handle frame masking. - - if mask { - c.readMaskPos = 0 - p, err := c.read(len(c.readMaskKey)) - if err != nil { - return noFrame, err - } - copy(c.readMaskKey[:], p) - } - - // 5. For text and binary messages, enforce read limit and return. - - if frameType == continuationFrame || frameType == TextMessage || frameType == BinaryMessage { - - c.readLength += c.readRemaining - // Don't allow readLength to overflow in the presence of a large readRemaining - // counter. - if c.readLength < 0 { - return noFrame, ErrReadLimit - } - - if c.readLimit > 0 && c.readLength > c.readLimit { - c.WriteControl(CloseMessage, FormatCloseMessage(CloseMessageTooBig, ""), time.Now().Add(writeWait)) - return noFrame, ErrReadLimit - } - - return frameType, nil - } - - // 6. Read control frame payload. - - var payload []byte - if c.readRemaining > 0 { - payload, err = c.read(int(c.readRemaining)) - c.setReadRemaining(0) - if err != nil { - return noFrame, err - } - if c.isServer { - maskBytes(c.readMaskKey, 0, payload) - } - } - - // 7. Process control frame payload. - - switch frameType { - case PongMessage: - if err := c.handlePong(string(payload)); err != nil { - return noFrame, err - } - case PingMessage: - if err := c.handlePing(string(payload)); err != nil { - return noFrame, err - } - case CloseMessage: - closeCode := CloseNoStatusReceived - closeText := "" - if len(payload) >= 2 { - closeCode = int(binary.BigEndian.Uint16(payload)) - if !isValidReceivedCloseCode(closeCode) { - return noFrame, c.handleProtocolError("bad close code " + strconv.Itoa(closeCode)) - } - closeText = string(payload[2:]) - if !utf8.ValidString(closeText) { - return noFrame, c.handleProtocolError("invalid utf8 payload in close frame") - } - } - if err := c.handleClose(closeCode, closeText); err != nil { - return noFrame, err - } - return noFrame, &CloseError{Code: closeCode, Text: closeText} - } - - return frameType, nil -} - -func (c *Conn) handleProtocolError(message string) error { - data := FormatCloseMessage(CloseProtocolError, message) - if len(data) > maxControlFramePayloadSize { - data = data[:maxControlFramePayloadSize] - } - c.WriteControl(CloseMessage, data, time.Now().Add(writeWait)) - return errors.New("websocket: " + message) -} - -// NextReader returns the next data message received from the peer. The -// returned messageType is either TextMessage or BinaryMessage. -// -// There can be at most one open reader on a connection. NextReader discards -// the previous message if the application has not already consumed it. -// -// Applications must break out of the application's read loop when this method -// returns a non-nil error value. Errors returned from this method are -// permanent. Once this method returns a non-nil error, all subsequent calls to -// this method return the same error. -func (c *Conn) NextReader() (messageType int, r io.Reader, err error) { - // Close previous reader, only relevant for decompression. - if c.reader != nil { - c.reader.Close() - c.reader = nil - } - - c.messageReader = nil - c.readLength = 0 - - for c.readErr == nil { - frameType, err := c.advanceFrame() - if err != nil { - c.readErr = hideTempErr(err) - break - } - - if frameType == TextMessage || frameType == BinaryMessage { - c.messageReader = &messageReader{c} - c.reader = c.messageReader - if c.readDecompress { - c.reader = c.newDecompressionReader(c.reader) - } - return frameType, c.reader, nil - } - } - - // Applications that do handle the error returned from this method spin in - // tight loop on connection failure. To help application developers detect - // this error, panic on repeated reads to the failed connection. - c.readErrCount++ - if c.readErrCount >= 1000 { - panic("repeated read on failed websocket connection") - } - - return noFrame, nil, c.readErr -} - -type messageReader struct{ c *Conn } - -func (r *messageReader) Read(b []byte) (int, error) { - c := r.c - if c.messageReader != r { - return 0, io.EOF - } - - for c.readErr == nil { - - if c.readRemaining > 0 { - if int64(len(b)) > c.readRemaining { - b = b[:c.readRemaining] - } - n, err := c.br.Read(b) - c.readErr = hideTempErr(err) - if c.isServer { - c.readMaskPos = maskBytes(c.readMaskKey, c.readMaskPos, b[:n]) - } - rem := c.readRemaining - rem -= int64(n) - c.setReadRemaining(rem) - if c.readRemaining > 0 && c.readErr == io.EOF { - c.readErr = errUnexpectedEOF - } - return n, c.readErr - } - - if c.readFinal { - c.messageReader = nil - return 0, io.EOF - } - - frameType, err := c.advanceFrame() - switch { - case err != nil: - c.readErr = hideTempErr(err) - case frameType == TextMessage || frameType == BinaryMessage: - c.readErr = errors.New("websocket: internal error, unexpected text or binary in Reader") - } - } - - err := c.readErr - if err == io.EOF && c.messageReader == r { - err = errUnexpectedEOF - } - return 0, err -} - -func (r *messageReader) Close() error { - return nil -} - -// ReadMessage is a helper method for getting a reader using NextReader and -// reading from that reader to a buffer. -func (c *Conn) ReadMessage() (messageType int, p []byte, err error) { - var r io.Reader - messageType, r, err = c.NextReader() - if err != nil { - return messageType, nil, err - } - p, err = ioutil.ReadAll(r) - return messageType, p, err -} - -// SetReadDeadline sets the read deadline on the underlying network connection. -// After a read has timed out, the websocket connection state is corrupt and -// all future reads will return an error. A zero value for t means reads will -// not time out. -func (c *Conn) SetReadDeadline(t time.Time) error { - return c.conn.SetReadDeadline(t) -} - -// SetReadLimit sets the maximum size in bytes for a message read from the peer. If a -// message exceeds the limit, the connection sends a close message to the peer -// and returns ErrReadLimit to the application. -func (c *Conn) SetReadLimit(limit int64) { - c.readLimit = limit -} - -// CloseHandler returns the current close handler -func (c *Conn) CloseHandler() func(code int, text string) error { - return c.handleClose -} - -// SetCloseHandler sets the handler for close messages received from the peer. -// The code argument to h is the received close code or CloseNoStatusReceived -// if the close message is empty. The default close handler sends a close -// message back to the peer. -// -// The handler function is called from the NextReader, ReadMessage and message -// reader Read methods. The application must read the connection to process -// close messages as described in the section on Control Messages above. -// -// The connection read methods return a CloseError when a close message is -// received. Most applications should handle close messages as part of their -// normal error handling. Applications should only set a close handler when the -// application must perform some action before sending a close message back to -// the peer. -func (c *Conn) SetCloseHandler(h func(code int, text string) error) { - if h == nil { - h = func(code int, text string) error { - message := FormatCloseMessage(code, "") - c.WriteControl(CloseMessage, message, time.Now().Add(writeWait)) - return nil - } - } - c.handleClose = h -} - -// PingHandler returns the current ping handler -func (c *Conn) PingHandler() func(appData string) error { - return c.handlePing -} - -// SetPingHandler sets the handler for ping messages received from the peer. -// The appData argument to h is the PING message application data. The default -// ping handler sends a pong to the peer. -// -// The handler function is called from the NextReader, ReadMessage and message -// reader Read methods. The application must read the connection to process -// ping messages as described in the section on Control Messages above. -func (c *Conn) SetPingHandler(h func(appData string) error) { - if h == nil { - h = func(message string) error { - err := c.WriteControl(PongMessage, []byte(message), time.Now().Add(writeWait)) - if err == ErrCloseSent { - return nil - } else if e, ok := err.(net.Error); ok && e.Temporary() { - return nil - } - return err - } - } - c.handlePing = h -} - -// PongHandler returns the current pong handler -func (c *Conn) PongHandler() func(appData string) error { - return c.handlePong -} - -// SetPongHandler sets the handler for pong messages received from the peer. -// The appData argument to h is the PONG message application data. The default -// pong handler does nothing. -// -// The handler function is called from the NextReader, ReadMessage and message -// reader Read methods. The application must read the connection to process -// pong messages as described in the section on Control Messages above. -func (c *Conn) SetPongHandler(h func(appData string) error) { - if h == nil { - h = func(string) error { return nil } - } - c.handlePong = h -} - -// NetConn returns the underlying connection that is wrapped by c. -// Note that writing to or reading from this connection directly will corrupt the -// WebSocket connection. -func (c *Conn) NetConn() net.Conn { - return c.conn -} - -// UnderlyingConn returns the internal net.Conn. This can be used to further -// modifications to connection specific flags. -// Deprecated: Use the NetConn method. -func (c *Conn) UnderlyingConn() net.Conn { - return c.conn -} - -// EnableWriteCompression enables and disables write compression of -// subsequent text and binary messages. This function is a noop if -// compression was not negotiated with the peer. -func (c *Conn) EnableWriteCompression(enable bool) { - c.enableWriteCompression = enable -} - -// SetCompressionLevel sets the flate compression level for subsequent text and -// binary messages. This function is a noop if compression was not negotiated -// with the peer. See the compress/flate package for a description of -// compression levels. -func (c *Conn) SetCompressionLevel(level int) error { - if !isValidCompressionLevel(level) { - return errors.New("websocket: invalid compression level") - } - c.compressionLevel = level - return nil -} - -// FormatCloseMessage formats closeCode and text as a WebSocket close message. -// An empty message is returned for code CloseNoStatusReceived. -func FormatCloseMessage(closeCode int, text string) []byte { - if closeCode == CloseNoStatusReceived { - // Return empty message because it's illegal to send - // CloseNoStatusReceived. Return non-nil value in case application - // checks for nil. - return []byte{} - } - buf := make([]byte, 2+len(text)) - binary.BigEndian.PutUint16(buf, uint16(closeCode)) - copy(buf[2:], text) - return buf -} diff --git a/backend/vendor/github.com/gorilla/websocket/doc.go b/backend/vendor/github.com/gorilla/websocket/doc.go deleted file mode 100644 index 8db0cef..0000000 --- a/backend/vendor/github.com/gorilla/websocket/doc.go +++ /dev/null @@ -1,227 +0,0 @@ -// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -// Package websocket implements the WebSocket protocol defined in RFC 6455. -// -// Overview -// -// The Conn type represents a WebSocket connection. A server application calls -// the Upgrader.Upgrade method from an HTTP request handler to get a *Conn: -// -// var upgrader = websocket.Upgrader{ -// ReadBufferSize: 1024, -// WriteBufferSize: 1024, -// } -// -// func handler(w http.ResponseWriter, r *http.Request) { -// conn, err := upgrader.Upgrade(w, r, nil) -// if err != nil { -// log.Println(err) -// return -// } -// ... Use conn to send and receive messages. -// } -// -// Call the connection's WriteMessage and ReadMessage methods to send and -// receive messages as a slice of bytes. This snippet of code shows how to echo -// messages using these methods: -// -// for { -// messageType, p, err := conn.ReadMessage() -// if err != nil { -// log.Println(err) -// return -// } -// if err := conn.WriteMessage(messageType, p); err != nil { -// log.Println(err) -// return -// } -// } -// -// In above snippet of code, p is a []byte and messageType is an int with value -// websocket.BinaryMessage or websocket.TextMessage. -// -// An application can also send and receive messages using the io.WriteCloser -// and io.Reader interfaces. To send a message, call the connection NextWriter -// method to get an io.WriteCloser, write the message to the writer and close -// the writer when done. To receive a message, call the connection NextReader -// method to get an io.Reader and read until io.EOF is returned. This snippet -// shows how to echo messages using the NextWriter and NextReader methods: -// -// for { -// messageType, r, err := conn.NextReader() -// if err != nil { -// return -// } -// w, err := conn.NextWriter(messageType) -// if err != nil { -// return err -// } -// if _, err := io.Copy(w, r); err != nil { -// return err -// } -// if err := w.Close(); err != nil { -// return err -// } -// } -// -// Data Messages -// -// The WebSocket protocol distinguishes between text and binary data messages. -// Text messages are interpreted as UTF-8 encoded text. The interpretation of -// binary messages is left to the application. -// -// This package uses the TextMessage and BinaryMessage integer constants to -// identify the two data message types. The ReadMessage and NextReader methods -// return the type of the received message. The messageType argument to the -// WriteMessage and NextWriter methods specifies the type of a sent message. -// -// It is the application's responsibility to ensure that text messages are -// valid UTF-8 encoded text. -// -// Control Messages -// -// The WebSocket protocol defines three types of control messages: close, ping -// and pong. Call the connection WriteControl, WriteMessage or NextWriter -// methods to send a control message to the peer. -// -// Connections handle received close messages by calling the handler function -// set with the SetCloseHandler method and by returning a *CloseError from the -// NextReader, ReadMessage or the message Read method. The default close -// handler sends a close message to the peer. -// -// Connections handle received ping messages by calling the handler function -// set with the SetPingHandler method. The default ping handler sends a pong -// message to the peer. -// -// Connections handle received pong messages by calling the handler function -// set with the SetPongHandler method. The default pong handler does nothing. -// If an application sends ping messages, then the application should set a -// pong handler to receive the corresponding pong. -// -// The control message handler functions are called from the NextReader, -// ReadMessage and message reader Read methods. The default close and ping -// handlers can block these methods for a short time when the handler writes to -// the connection. -// -// The application must read the connection to process close, ping and pong -// messages sent from the peer. If the application is not otherwise interested -// in messages from the peer, then the application should start a goroutine to -// read and discard messages from the peer. A simple example is: -// -// func readLoop(c *websocket.Conn) { -// for { -// if _, _, err := c.NextReader(); err != nil { -// c.Close() -// break -// } -// } -// } -// -// Concurrency -// -// Connections support one concurrent reader and one concurrent writer. -// -// Applications are responsible for ensuring that no more than one goroutine -// calls the write methods (NextWriter, SetWriteDeadline, WriteMessage, -// WriteJSON, EnableWriteCompression, SetCompressionLevel) concurrently and -// that no more than one goroutine calls the read methods (NextReader, -// SetReadDeadline, ReadMessage, ReadJSON, SetPongHandler, SetPingHandler) -// concurrently. -// -// The Close and WriteControl methods can be called concurrently with all other -// methods. -// -// Origin Considerations -// -// Web browsers allow Javascript applications to open a WebSocket connection to -// any host. It's up to the server to enforce an origin policy using the Origin -// request header sent by the browser. -// -// The Upgrader calls the function specified in the CheckOrigin field to check -// the origin. If the CheckOrigin function returns false, then the Upgrade -// method fails the WebSocket handshake with HTTP status 403. -// -// If the CheckOrigin field is nil, then the Upgrader uses a safe default: fail -// the handshake if the Origin request header is present and the Origin host is -// not equal to the Host request header. -// -// The deprecated package-level Upgrade function does not perform origin -// checking. The application is responsible for checking the Origin header -// before calling the Upgrade function. -// -// Buffers -// -// Connections buffer network input and output to reduce the number -// of system calls when reading or writing messages. -// -// Write buffers are also used for constructing WebSocket frames. See RFC 6455, -// Section 5 for a discussion of message framing. A WebSocket frame header is -// written to the network each time a write buffer is flushed to the network. -// Decreasing the size of the write buffer can increase the amount of framing -// overhead on the connection. -// -// The buffer sizes in bytes are specified by the ReadBufferSize and -// WriteBufferSize fields in the Dialer and Upgrader. The Dialer uses a default -// size of 4096 when a buffer size field is set to zero. The Upgrader reuses -// buffers created by the HTTP server when a buffer size field is set to zero. -// The HTTP server buffers have a size of 4096 at the time of this writing. -// -// The buffer sizes do not limit the size of a message that can be read or -// written by a connection. -// -// Buffers are held for the lifetime of the connection by default. If the -// Dialer or Upgrader WriteBufferPool field is set, then a connection holds the -// write buffer only when writing a message. -// -// Applications should tune the buffer sizes to balance memory use and -// performance. Increasing the buffer size uses more memory, but can reduce the -// number of system calls to read or write the network. In the case of writing, -// increasing the buffer size can reduce the number of frame headers written to -// the network. -// -// Some guidelines for setting buffer parameters are: -// -// Limit the buffer sizes to the maximum expected message size. Buffers larger -// than the largest message do not provide any benefit. -// -// Depending on the distribution of message sizes, setting the buffer size to -// a value less than the maximum expected message size can greatly reduce memory -// use with a small impact on performance. Here's an example: If 99% of the -// messages are smaller than 256 bytes and the maximum message size is 512 -// bytes, then a buffer size of 256 bytes will result in 1.01 more system calls -// than a buffer size of 512 bytes. The memory savings is 50%. -// -// A write buffer pool is useful when the application has a modest number -// writes over a large number of connections. when buffers are pooled, a larger -// buffer size has a reduced impact on total memory use and has the benefit of -// reducing system calls and frame overhead. -// -// Compression EXPERIMENTAL -// -// Per message compression extensions (RFC 7692) are experimentally supported -// by this package in a limited capacity. Setting the EnableCompression option -// to true in Dialer or Upgrader will attempt to negotiate per message deflate -// support. -// -// var upgrader = websocket.Upgrader{ -// EnableCompression: true, -// } -// -// If compression was successfully negotiated with the connection's peer, any -// message received in compressed form will be automatically decompressed. -// All Read methods will return uncompressed bytes. -// -// Per message compression of messages written to a connection can be enabled -// or disabled by calling the corresponding Conn method: -// -// conn.EnableWriteCompression(false) -// -// Currently this package does not support compression with "context takeover". -// This means that messages must be compressed and decompressed in isolation, -// without retaining sliding window or dictionary state across messages. For -// more details refer to RFC 7692. -// -// Use of compression is experimental and may result in decreased performance. -package websocket diff --git a/backend/vendor/github.com/gorilla/websocket/join.go b/backend/vendor/github.com/gorilla/websocket/join.go deleted file mode 100644 index c64f8c8..0000000 --- a/backend/vendor/github.com/gorilla/websocket/join.go +++ /dev/null @@ -1,42 +0,0 @@ -// Copyright 2019 The Gorilla WebSocket Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package websocket - -import ( - "io" - "strings" -) - -// JoinMessages concatenates received messages to create a single io.Reader. -// The string term is appended to each message. The returned reader does not -// support concurrent calls to the Read method. -func JoinMessages(c *Conn, term string) io.Reader { - return &joinReader{c: c, term: term} -} - -type joinReader struct { - c *Conn - term string - r io.Reader -} - -func (r *joinReader) Read(p []byte) (int, error) { - if r.r == nil { - var err error - _, r.r, err = r.c.NextReader() - if err != nil { - return 0, err - } - if r.term != "" { - r.r = io.MultiReader(r.r, strings.NewReader(r.term)) - } - } - n, err := r.r.Read(p) - if err == io.EOF { - err = nil - r.r = nil - } - return n, err -} diff --git a/backend/vendor/github.com/gorilla/websocket/json.go b/backend/vendor/github.com/gorilla/websocket/json.go deleted file mode 100644 index dc2c1f6..0000000 --- a/backend/vendor/github.com/gorilla/websocket/json.go +++ /dev/null @@ -1,60 +0,0 @@ -// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package websocket - -import ( - "encoding/json" - "io" -) - -// WriteJSON writes the JSON encoding of v as a message. -// -// Deprecated: Use c.WriteJSON instead. -func WriteJSON(c *Conn, v interface{}) error { - return c.WriteJSON(v) -} - -// WriteJSON writes the JSON encoding of v as a message. -// -// See the documentation for encoding/json Marshal for details about the -// conversion of Go values to JSON. -func (c *Conn) WriteJSON(v interface{}) error { - w, err := c.NextWriter(TextMessage) - if err != nil { - return err - } - err1 := json.NewEncoder(w).Encode(v) - err2 := w.Close() - if err1 != nil { - return err1 - } - return err2 -} - -// ReadJSON reads the next JSON-encoded message from the connection and stores -// it in the value pointed to by v. -// -// Deprecated: Use c.ReadJSON instead. -func ReadJSON(c *Conn, v interface{}) error { - return c.ReadJSON(v) -} - -// ReadJSON reads the next JSON-encoded message from the connection and stores -// it in the value pointed to by v. -// -// See the documentation for the encoding/json Unmarshal function for details -// about the conversion of JSON to a Go value. -func (c *Conn) ReadJSON(v interface{}) error { - _, r, err := c.NextReader() - if err != nil { - return err - } - err = json.NewDecoder(r).Decode(v) - if err == io.EOF { - // One value is expected in the message. - err = io.ErrUnexpectedEOF - } - return err -} diff --git a/backend/vendor/github.com/gorilla/websocket/mask.go b/backend/vendor/github.com/gorilla/websocket/mask.go deleted file mode 100644 index d0742bf..0000000 --- a/backend/vendor/github.com/gorilla/websocket/mask.go +++ /dev/null @@ -1,55 +0,0 @@ -// Copyright 2016 The Gorilla WebSocket Authors. All rights reserved. Use of -// this source code is governed by a BSD-style license that can be found in the -// LICENSE file. - -//go:build !appengine -// +build !appengine - -package websocket - -import "unsafe" - -const wordSize = int(unsafe.Sizeof(uintptr(0))) - -func maskBytes(key [4]byte, pos int, b []byte) int { - // Mask one byte at a time for small buffers. - if len(b) < 2*wordSize { - for i := range b { - b[i] ^= key[pos&3] - pos++ - } - return pos & 3 - } - - // Mask one byte at a time to word boundary. - if n := int(uintptr(unsafe.Pointer(&b[0]))) % wordSize; n != 0 { - n = wordSize - n - for i := range b[:n] { - b[i] ^= key[pos&3] - pos++ - } - b = b[n:] - } - - // Create aligned word size key. - var k [wordSize]byte - for i := range k { - k[i] = key[(pos+i)&3] - } - kw := *(*uintptr)(unsafe.Pointer(&k)) - - // Mask one word at a time. - n := (len(b) / wordSize) * wordSize - for i := 0; i < n; i += wordSize { - *(*uintptr)(unsafe.Pointer(uintptr(unsafe.Pointer(&b[0])) + uintptr(i))) ^= kw - } - - // Mask one byte at a time for remaining bytes. - b = b[n:] - for i := range b { - b[i] ^= key[pos&3] - pos++ - } - - return pos & 3 -} diff --git a/backend/vendor/github.com/gorilla/websocket/mask_safe.go b/backend/vendor/github.com/gorilla/websocket/mask_safe.go deleted file mode 100644 index 36250ca..0000000 --- a/backend/vendor/github.com/gorilla/websocket/mask_safe.go +++ /dev/null @@ -1,16 +0,0 @@ -// Copyright 2016 The Gorilla WebSocket Authors. All rights reserved. Use of -// this source code is governed by a BSD-style license that can be found in the -// LICENSE file. - -//go:build appengine -// +build appengine - -package websocket - -func maskBytes(key [4]byte, pos int, b []byte) int { - for i := range b { - b[i] ^= key[pos&3] - pos++ - } - return pos & 3 -} diff --git a/backend/vendor/github.com/gorilla/websocket/prepared.go b/backend/vendor/github.com/gorilla/websocket/prepared.go deleted file mode 100644 index c854225..0000000 --- a/backend/vendor/github.com/gorilla/websocket/prepared.go +++ /dev/null @@ -1,102 +0,0 @@ -// Copyright 2017 The Gorilla WebSocket Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package websocket - -import ( - "bytes" - "net" - "sync" - "time" -) - -// PreparedMessage caches on the wire representations of a message payload. -// Use PreparedMessage to efficiently send a message payload to multiple -// connections. PreparedMessage is especially useful when compression is used -// because the CPU and memory expensive compression operation can be executed -// once for a given set of compression options. -type PreparedMessage struct { - messageType int - data []byte - mu sync.Mutex - frames map[prepareKey]*preparedFrame -} - -// prepareKey defines a unique set of options to cache prepared frames in PreparedMessage. -type prepareKey struct { - isServer bool - compress bool - compressionLevel int -} - -// preparedFrame contains data in wire representation. -type preparedFrame struct { - once sync.Once - data []byte -} - -// NewPreparedMessage returns an initialized PreparedMessage. You can then send -// it to connection using WritePreparedMessage method. Valid wire -// representation will be calculated lazily only once for a set of current -// connection options. -func NewPreparedMessage(messageType int, data []byte) (*PreparedMessage, error) { - pm := &PreparedMessage{ - messageType: messageType, - frames: make(map[prepareKey]*preparedFrame), - data: data, - } - - // Prepare a plain server frame. - _, frameData, err := pm.frame(prepareKey{isServer: true, compress: false}) - if err != nil { - return nil, err - } - - // To protect against caller modifying the data argument, remember the data - // copied to the plain server frame. - pm.data = frameData[len(frameData)-len(data):] - return pm, nil -} - -func (pm *PreparedMessage) frame(key prepareKey) (int, []byte, error) { - pm.mu.Lock() - frame, ok := pm.frames[key] - if !ok { - frame = &preparedFrame{} - pm.frames[key] = frame - } - pm.mu.Unlock() - - var err error - frame.once.Do(func() { - // Prepare a frame using a 'fake' connection. - // TODO: Refactor code in conn.go to allow more direct construction of - // the frame. - mu := make(chan struct{}, 1) - mu <- struct{}{} - var nc prepareConn - c := &Conn{ - conn: &nc, - mu: mu, - isServer: key.isServer, - compressionLevel: key.compressionLevel, - enableWriteCompression: true, - writeBuf: make([]byte, defaultWriteBufferSize+maxFrameHeaderSize), - } - if key.compress { - c.newCompressionWriter = compressNoContextTakeover - } - err = c.WriteMessage(pm.messageType, pm.data) - frame.data = nc.buf.Bytes() - }) - return pm.messageType, frame.data, err -} - -type prepareConn struct { - buf bytes.Buffer - net.Conn -} - -func (pc *prepareConn) Write(p []byte) (int, error) { return pc.buf.Write(p) } -func (pc *prepareConn) SetWriteDeadline(t time.Time) error { return nil } diff --git a/backend/vendor/github.com/gorilla/websocket/proxy.go b/backend/vendor/github.com/gorilla/websocket/proxy.go deleted file mode 100644 index e0f466b..0000000 --- a/backend/vendor/github.com/gorilla/websocket/proxy.go +++ /dev/null @@ -1,77 +0,0 @@ -// Copyright 2017 The Gorilla WebSocket Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package websocket - -import ( - "bufio" - "encoding/base64" - "errors" - "net" - "net/http" - "net/url" - "strings" -) - -type netDialerFunc func(network, addr string) (net.Conn, error) - -func (fn netDialerFunc) Dial(network, addr string) (net.Conn, error) { - return fn(network, addr) -} - -func init() { - proxy_RegisterDialerType("http", func(proxyURL *url.URL, forwardDialer proxy_Dialer) (proxy_Dialer, error) { - return &httpProxyDialer{proxyURL: proxyURL, forwardDial: forwardDialer.Dial}, nil - }) -} - -type httpProxyDialer struct { - proxyURL *url.URL - forwardDial func(network, addr string) (net.Conn, error) -} - -func (hpd *httpProxyDialer) Dial(network string, addr string) (net.Conn, error) { - hostPort, _ := hostPortNoPort(hpd.proxyURL) - conn, err := hpd.forwardDial(network, hostPort) - if err != nil { - return nil, err - } - - connectHeader := make(http.Header) - if user := hpd.proxyURL.User; user != nil { - proxyUser := user.Username() - if proxyPassword, passwordSet := user.Password(); passwordSet { - credential := base64.StdEncoding.EncodeToString([]byte(proxyUser + ":" + proxyPassword)) - connectHeader.Set("Proxy-Authorization", "Basic "+credential) - } - } - - connectReq := &http.Request{ - Method: http.MethodConnect, - URL: &url.URL{Opaque: addr}, - Host: addr, - Header: connectHeader, - } - - if err := connectReq.Write(conn); err != nil { - conn.Close() - return nil, err - } - - // Read response. It's OK to use and discard buffered reader here becaue - // the remote server does not speak until spoken to. - br := bufio.NewReader(conn) - resp, err := http.ReadResponse(br, connectReq) - if err != nil { - conn.Close() - return nil, err - } - - if resp.StatusCode != 200 { - conn.Close() - f := strings.SplitN(resp.Status, " ", 2) - return nil, errors.New(f[1]) - } - return conn, nil -} diff --git a/backend/vendor/github.com/gorilla/websocket/server.go b/backend/vendor/github.com/gorilla/websocket/server.go deleted file mode 100644 index bb33597..0000000 --- a/backend/vendor/github.com/gorilla/websocket/server.go +++ /dev/null @@ -1,365 +0,0 @@ -// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package websocket - -import ( - "bufio" - "errors" - "io" - "net/http" - "net/url" - "strings" - "time" -) - -// HandshakeError describes an error with the handshake from the peer. -type HandshakeError struct { - message string -} - -func (e HandshakeError) Error() string { return e.message } - -// Upgrader specifies parameters for upgrading an HTTP connection to a -// WebSocket connection. -// -// It is safe to call Upgrader's methods concurrently. -type Upgrader struct { - // HandshakeTimeout specifies the duration for the handshake to complete. - HandshakeTimeout time.Duration - - // ReadBufferSize and WriteBufferSize specify I/O buffer sizes in bytes. If a buffer - // size is zero, then buffers allocated by the HTTP server are used. The - // I/O buffer sizes do not limit the size of the messages that can be sent - // or received. - ReadBufferSize, WriteBufferSize int - - // WriteBufferPool is a pool of buffers for write operations. If the value - // is not set, then write buffers are allocated to the connection for the - // lifetime of the connection. - // - // A pool is most useful when the application has a modest volume of writes - // across a large number of connections. - // - // Applications should use a single pool for each unique value of - // WriteBufferSize. - WriteBufferPool BufferPool - - // Subprotocols specifies the server's supported protocols in order of - // preference. If this field is not nil, then the Upgrade method negotiates a - // subprotocol by selecting the first match in this list with a protocol - // requested by the client. If there's no match, then no protocol is - // negotiated (the Sec-Websocket-Protocol header is not included in the - // handshake response). - Subprotocols []string - - // Error specifies the function for generating HTTP error responses. If Error - // is nil, then http.Error is used to generate the HTTP response. - Error func(w http.ResponseWriter, r *http.Request, status int, reason error) - - // CheckOrigin returns true if the request Origin header is acceptable. If - // CheckOrigin is nil, then a safe default is used: return false if the - // Origin request header is present and the origin host is not equal to - // request Host header. - // - // A CheckOrigin function should carefully validate the request origin to - // prevent cross-site request forgery. - CheckOrigin func(r *http.Request) bool - - // EnableCompression specify if the server should attempt to negotiate per - // message compression (RFC 7692). Setting this value to true does not - // guarantee that compression will be supported. Currently only "no context - // takeover" modes are supported. - EnableCompression bool -} - -func (u *Upgrader) returnError(w http.ResponseWriter, r *http.Request, status int, reason string) (*Conn, error) { - err := HandshakeError{reason} - if u.Error != nil { - u.Error(w, r, status, err) - } else { - w.Header().Set("Sec-Websocket-Version", "13") - http.Error(w, http.StatusText(status), status) - } - return nil, err -} - -// checkSameOrigin returns true if the origin is not set or is equal to the request host. -func checkSameOrigin(r *http.Request) bool { - origin := r.Header["Origin"] - if len(origin) == 0 { - return true - } - u, err := url.Parse(origin[0]) - if err != nil { - return false - } - return equalASCIIFold(u.Host, r.Host) -} - -func (u *Upgrader) selectSubprotocol(r *http.Request, responseHeader http.Header) string { - if u.Subprotocols != nil { - clientProtocols := Subprotocols(r) - for _, serverProtocol := range u.Subprotocols { - for _, clientProtocol := range clientProtocols { - if clientProtocol == serverProtocol { - return clientProtocol - } - } - } - } else if responseHeader != nil { - return responseHeader.Get("Sec-Websocket-Protocol") - } - return "" -} - -// Upgrade upgrades the HTTP server connection to the WebSocket protocol. -// -// The responseHeader is included in the response to the client's upgrade -// request. Use the responseHeader to specify cookies (Set-Cookie). To specify -// subprotocols supported by the server, set Upgrader.Subprotocols directly. -// -// If the upgrade fails, then Upgrade replies to the client with an HTTP error -// response. -func (u *Upgrader) Upgrade(w http.ResponseWriter, r *http.Request, responseHeader http.Header) (*Conn, error) { - const badHandshake = "websocket: the client is not using the websocket protocol: " - - if !tokenListContainsValue(r.Header, "Connection", "upgrade") { - return u.returnError(w, r, http.StatusBadRequest, badHandshake+"'upgrade' token not found in 'Connection' header") - } - - if !tokenListContainsValue(r.Header, "Upgrade", "websocket") { - return u.returnError(w, r, http.StatusBadRequest, badHandshake+"'websocket' token not found in 'Upgrade' header") - } - - if r.Method != http.MethodGet { - return u.returnError(w, r, http.StatusMethodNotAllowed, badHandshake+"request method is not GET") - } - - if !tokenListContainsValue(r.Header, "Sec-Websocket-Version", "13") { - return u.returnError(w, r, http.StatusBadRequest, "websocket: unsupported version: 13 not found in 'Sec-Websocket-Version' header") - } - - if _, ok := responseHeader["Sec-Websocket-Extensions"]; ok { - return u.returnError(w, r, http.StatusInternalServerError, "websocket: application specific 'Sec-WebSocket-Extensions' headers are unsupported") - } - - checkOrigin := u.CheckOrigin - if checkOrigin == nil { - checkOrigin = checkSameOrigin - } - if !checkOrigin(r) { - return u.returnError(w, r, http.StatusForbidden, "websocket: request origin not allowed by Upgrader.CheckOrigin") - } - - challengeKey := r.Header.Get("Sec-Websocket-Key") - if !isValidChallengeKey(challengeKey) { - return u.returnError(w, r, http.StatusBadRequest, "websocket: not a websocket handshake: 'Sec-WebSocket-Key' header must be Base64 encoded value of 16-byte in length") - } - - subprotocol := u.selectSubprotocol(r, responseHeader) - - // Negotiate PMCE - var compress bool - if u.EnableCompression { - for _, ext := range parseExtensions(r.Header) { - if ext[""] != "permessage-deflate" { - continue - } - compress = true - break - } - } - - h, ok := w.(http.Hijacker) - if !ok { - return u.returnError(w, r, http.StatusInternalServerError, "websocket: response does not implement http.Hijacker") - } - var brw *bufio.ReadWriter - netConn, brw, err := h.Hijack() - if err != nil { - return u.returnError(w, r, http.StatusInternalServerError, err.Error()) - } - - if brw.Reader.Buffered() > 0 { - netConn.Close() - return nil, errors.New("websocket: client sent data before handshake is complete") - } - - var br *bufio.Reader - if u.ReadBufferSize == 0 && bufioReaderSize(netConn, brw.Reader) > 256 { - // Reuse hijacked buffered reader as connection reader. - br = brw.Reader - } - - buf := bufioWriterBuffer(netConn, brw.Writer) - - var writeBuf []byte - if u.WriteBufferPool == nil && u.WriteBufferSize == 0 && len(buf) >= maxFrameHeaderSize+256 { - // Reuse hijacked write buffer as connection buffer. - writeBuf = buf - } - - c := newConn(netConn, true, u.ReadBufferSize, u.WriteBufferSize, u.WriteBufferPool, br, writeBuf) - c.subprotocol = subprotocol - - if compress { - c.newCompressionWriter = compressNoContextTakeover - c.newDecompressionReader = decompressNoContextTakeover - } - - // Use larger of hijacked buffer and connection write buffer for header. - p := buf - if len(c.writeBuf) > len(p) { - p = c.writeBuf - } - p = p[:0] - - p = append(p, "HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: "...) - p = append(p, computeAcceptKey(challengeKey)...) - p = append(p, "\r\n"...) - if c.subprotocol != "" { - p = append(p, "Sec-WebSocket-Protocol: "...) - p = append(p, c.subprotocol...) - p = append(p, "\r\n"...) - } - if compress { - p = append(p, "Sec-WebSocket-Extensions: permessage-deflate; server_no_context_takeover; client_no_context_takeover\r\n"...) - } - for k, vs := range responseHeader { - if k == "Sec-Websocket-Protocol" { - continue - } - for _, v := range vs { - p = append(p, k...) - p = append(p, ": "...) - for i := 0; i < len(v); i++ { - b := v[i] - if b <= 31 { - // prevent response splitting. - b = ' ' - } - p = append(p, b) - } - p = append(p, "\r\n"...) - } - } - p = append(p, "\r\n"...) - - // Clear deadlines set by HTTP server. - netConn.SetDeadline(time.Time{}) - - if u.HandshakeTimeout > 0 { - netConn.SetWriteDeadline(time.Now().Add(u.HandshakeTimeout)) - } - if _, err = netConn.Write(p); err != nil { - netConn.Close() - return nil, err - } - if u.HandshakeTimeout > 0 { - netConn.SetWriteDeadline(time.Time{}) - } - - return c, nil -} - -// Upgrade upgrades the HTTP server connection to the WebSocket protocol. -// -// Deprecated: Use websocket.Upgrader instead. -// -// Upgrade does not perform origin checking. The application is responsible for -// checking the Origin header before calling Upgrade. An example implementation -// of the same origin policy check is: -// -// if req.Header.Get("Origin") != "http://"+req.Host { -// http.Error(w, "Origin not allowed", http.StatusForbidden) -// return -// } -// -// If the endpoint supports subprotocols, then the application is responsible -// for negotiating the protocol used on the connection. Use the Subprotocols() -// function to get the subprotocols requested by the client. Use the -// Sec-Websocket-Protocol response header to specify the subprotocol selected -// by the application. -// -// The responseHeader is included in the response to the client's upgrade -// request. Use the responseHeader to specify cookies (Set-Cookie) and the -// negotiated subprotocol (Sec-Websocket-Protocol). -// -// The connection buffers IO to the underlying network connection. The -// readBufSize and writeBufSize parameters specify the size of the buffers to -// use. Messages can be larger than the buffers. -// -// If the request is not a valid WebSocket handshake, then Upgrade returns an -// error of type HandshakeError. Applications should handle this error by -// replying to the client with an HTTP error response. -func Upgrade(w http.ResponseWriter, r *http.Request, responseHeader http.Header, readBufSize, writeBufSize int) (*Conn, error) { - u := Upgrader{ReadBufferSize: readBufSize, WriteBufferSize: writeBufSize} - u.Error = func(w http.ResponseWriter, r *http.Request, status int, reason error) { - // don't return errors to maintain backwards compatibility - } - u.CheckOrigin = func(r *http.Request) bool { - // allow all connections by default - return true - } - return u.Upgrade(w, r, responseHeader) -} - -// Subprotocols returns the subprotocols requested by the client in the -// Sec-Websocket-Protocol header. -func Subprotocols(r *http.Request) []string { - h := strings.TrimSpace(r.Header.Get("Sec-Websocket-Protocol")) - if h == "" { - return nil - } - protocols := strings.Split(h, ",") - for i := range protocols { - protocols[i] = strings.TrimSpace(protocols[i]) - } - return protocols -} - -// IsWebSocketUpgrade returns true if the client requested upgrade to the -// WebSocket protocol. -func IsWebSocketUpgrade(r *http.Request) bool { - return tokenListContainsValue(r.Header, "Connection", "upgrade") && - tokenListContainsValue(r.Header, "Upgrade", "websocket") -} - -// bufioReaderSize size returns the size of a bufio.Reader. -func bufioReaderSize(originalReader io.Reader, br *bufio.Reader) int { - // This code assumes that peek on a reset reader returns - // bufio.Reader.buf[:0]. - // TODO: Use bufio.Reader.Size() after Go 1.10 - br.Reset(originalReader) - if p, err := br.Peek(0); err == nil { - return cap(p) - } - return 0 -} - -// writeHook is an io.Writer that records the last slice passed to it vio -// io.Writer.Write. -type writeHook struct { - p []byte -} - -func (wh *writeHook) Write(p []byte) (int, error) { - wh.p = p - return len(p), nil -} - -// bufioWriterBuffer grabs the buffer from a bufio.Writer. -func bufioWriterBuffer(originalWriter io.Writer, bw *bufio.Writer) []byte { - // This code assumes that bufio.Writer.buf[:1] is passed to the - // bufio.Writer's underlying writer. - var wh writeHook - bw.Reset(&wh) - bw.WriteByte(0) - bw.Flush() - - bw.Reset(originalWriter) - - return wh.p[:cap(wh.p)] -} diff --git a/backend/vendor/github.com/gorilla/websocket/tls_handshake.go b/backend/vendor/github.com/gorilla/websocket/tls_handshake.go deleted file mode 100644 index a62b68c..0000000 --- a/backend/vendor/github.com/gorilla/websocket/tls_handshake.go +++ /dev/null @@ -1,21 +0,0 @@ -//go:build go1.17 -// +build go1.17 - -package websocket - -import ( - "context" - "crypto/tls" -) - -func doHandshake(ctx context.Context, tlsConn *tls.Conn, cfg *tls.Config) error { - if err := tlsConn.HandshakeContext(ctx); err != nil { - return err - } - if !cfg.InsecureSkipVerify { - if err := tlsConn.VerifyHostname(cfg.ServerName); err != nil { - return err - } - } - return nil -} diff --git a/backend/vendor/github.com/gorilla/websocket/tls_handshake_116.go b/backend/vendor/github.com/gorilla/websocket/tls_handshake_116.go deleted file mode 100644 index e1b2b44..0000000 --- a/backend/vendor/github.com/gorilla/websocket/tls_handshake_116.go +++ /dev/null @@ -1,21 +0,0 @@ -//go:build !go1.17 -// +build !go1.17 - -package websocket - -import ( - "context" - "crypto/tls" -) - -func doHandshake(ctx context.Context, tlsConn *tls.Conn, cfg *tls.Config) error { - if err := tlsConn.Handshake(); err != nil { - return err - } - if !cfg.InsecureSkipVerify { - if err := tlsConn.VerifyHostname(cfg.ServerName); err != nil { - return err - } - } - return nil -} diff --git a/backend/vendor/github.com/gorilla/websocket/util.go b/backend/vendor/github.com/gorilla/websocket/util.go deleted file mode 100644 index 31a5dee..0000000 --- a/backend/vendor/github.com/gorilla/websocket/util.go +++ /dev/null @@ -1,298 +0,0 @@ -// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved. -// Use of this source code is governed by a BSD-style -// license that can be found in the LICENSE file. - -package websocket - -import ( - "crypto/rand" - "crypto/sha1" - "encoding/base64" - "io" - "net/http" - "strings" - "unicode/utf8" -) - -var keyGUID = []byte("258EAFA5-E914-47DA-95CA-C5AB0DC85B11") - -func computeAcceptKey(challengeKey string) string { - h := sha1.New() - h.Write([]byte(challengeKey)) - h.Write(keyGUID) - return base64.StdEncoding.EncodeToString(h.Sum(nil)) -} - -func generateChallengeKey() (string, error) { - p := make([]byte, 16) - if _, err := io.ReadFull(rand.Reader, p); err != nil { - return "", err - } - return base64.StdEncoding.EncodeToString(p), nil -} - -// Token octets per RFC 2616. -var isTokenOctet = [256]bool{ - '!': true, - '#': true, - '$': true, - '%': true, - '&': true, - '\'': true, - '*': true, - '+': true, - '-': true, - '.': true, - '0': true, - '1': true, - '2': true, - '3': true, - '4': true, - '5': true, - '6': true, - '7': true, - '8': true, - '9': true, - 'A': true, - 'B': true, - 'C': true, - 'D': true, - 'E': true, - 'F': true, - 'G': true, - 'H': true, - 'I': true, - 'J': true, - 'K': true, - 'L': true, - 'M': true, - 'N': true, - 'O': true, - 'P': true, - 'Q': true, - 'R': true, - 'S': true, - 'T': true, - 'U': true, - 'W': true, - 'V': true, - 'X': true, - 'Y': true, - 'Z': true, - '^': true, - '_': true, - '`': true, - 'a': true, - 'b': true, - 'c': true, - 'd': true, - 'e': true, - 'f': true, - 'g': true, - 'h': true, - 'i': true, - 'j': true, - 'k': true, - 'l': true, - 'm': true, - 'n': true, - 'o': true, - 'p': true, - 'q': true, - 'r': true, - 's': true, - 't': true, - 'u': true, - 'v': true, - 'w': true, - 'x': true, - 'y': true, - 'z': true, - '|': true, - '~': true, -} - -// skipSpace returns a slice of the string s with all leading RFC 2616 linear -// whitespace removed. -func skipSpace(s string) (rest string) { - i := 0 - for ; i < len(s); i++ { - if b := s[i]; b != ' ' && b != '\t' { - break - } - } - return s[i:] -} - -// nextToken returns the leading RFC 2616 token of s and the string following -// the token. -func nextToken(s string) (token, rest string) { - i := 0 - for ; i < len(s); i++ { - if !isTokenOctet[s[i]] { - break - } - } - return s[:i], s[i:] -} - -// nextTokenOrQuoted returns the leading token or quoted string per RFC 2616 -// and the string following the token or quoted string. -func nextTokenOrQuoted(s string) (value string, rest string) { - if !strings.HasPrefix(s, "\"") { - return nextToken(s) - } - s = s[1:] - for i := 0; i < len(s); i++ { - switch s[i] { - case '"': - return s[:i], s[i+1:] - case '\\': - p := make([]byte, len(s)-1) - j := copy(p, s[:i]) - escape := true - for i = i + 1; i < len(s); i++ { - b := s[i] - switch { - case escape: - escape = false - p[j] = b - j++ - case b == '\\': - escape = true - case b == '"': - return string(p[:j]), s[i+1:] - default: - p[j] = b - j++ - } - } - return "", "" - } - } - return "", "" -} - -// equalASCIIFold returns true if s is equal to t with ASCII case folding as -// defined in RFC 4790. -func equalASCIIFold(s, t string) bool { - for s != "" && t != "" { - sr, size := utf8.DecodeRuneInString(s) - s = s[size:] - tr, size := utf8.DecodeRuneInString(t) - t = t[size:] - if sr == tr { - continue - } - if 'A' <= sr && sr <= 'Z' { - sr = sr + 'a' - 'A' - } - if 'A' <= tr && tr <= 'Z' { - tr = tr + 'a' - 'A' - } - if sr != tr { - return false - } - } - return s == t -} - -// tokenListContainsValue returns true if the 1#token header with the given -// name contains a token equal to value with ASCII case folding. -func tokenListContainsValue(header http.Header, name string, value string) bool { -headers: - for _, s := range header[name] { - for { - var t string - t, s = nextToken(skipSpace(s)) - if t == "" { - continue headers - } - s = skipSpace(s) - if s != "" && s[0] != ',' { - continue headers - } - if equalASCIIFold(t, value) { - return true - } - if s == "" { - continue headers - } - s = s[1:] - } - } - return false -} - -// parseExtensions parses WebSocket extensions from a header. -func parseExtensions(header http.Header) []map[string]string { - // From RFC 6455: - // - // Sec-WebSocket-Extensions = extension-list - // extension-list = 1#extension - // extension = extension-token *( ";" extension-param ) - // extension-token = registered-token - // registered-token = token - // extension-param = token [ "=" (token | quoted-string) ] - // ;When using the quoted-string syntax variant, the value - // ;after quoted-string unescaping MUST conform to the - // ;'token' ABNF. - - var result []map[string]string -headers: - for _, s := range header["Sec-Websocket-Extensions"] { - for { - var t string - t, s = nextToken(skipSpace(s)) - if t == "" { - continue headers - } - ext := map[string]string{"": t} - for { - s = skipSpace(s) - if !strings.HasPrefix(s, ";") { - break - } - var k string - k, s = nextToken(skipSpace(s[1:])) - if k == "" { - continue headers - } - s = skipSpace(s) - var v string - if strings.HasPrefix(s, "=") { - v, s = nextTokenOrQuoted(skipSpace(s[1:])) - s = skipSpace(s) - } - if s != "" && s[0] != ',' && s[0] != ';' { - continue headers - } - ext[k] = v - } - if s != "" && s[0] != ',' { - continue headers - } - result = append(result, ext) - if s == "" { - continue headers - } - s = s[1:] - } - } - return result -} - -// isValidChallengeKey checks if the argument meets RFC6455 specification. -func isValidChallengeKey(s string) bool { - // From RFC6455: - // - // A |Sec-WebSocket-Key| header field with a base64-encoded (see - // Section 4 of [RFC4648]) value that, when decoded, is 16 bytes in - // length. - - if s == "" { - return false - } - decoded, err := base64.StdEncoding.DecodeString(s) - return err == nil && len(decoded) == 16 -} diff --git a/backend/vendor/github.com/gorilla/websocket/x_net_proxy.go b/backend/vendor/github.com/gorilla/websocket/x_net_proxy.go deleted file mode 100644 index 2e668f6..0000000 --- a/backend/vendor/github.com/gorilla/websocket/x_net_proxy.go +++ /dev/null @@ -1,473 +0,0 @@ -// Code generated by golang.org/x/tools/cmd/bundle. DO NOT EDIT. -//go:generate bundle -o x_net_proxy.go golang.org/x/net/proxy - -// Package proxy provides support for a variety of protocols to proxy network -// data. -// - -package websocket - -import ( - "errors" - "io" - "net" - "net/url" - "os" - "strconv" - "strings" - "sync" -) - -type proxy_direct struct{} - -// Direct is a direct proxy: one that makes network connections directly. -var proxy_Direct = proxy_direct{} - -func (proxy_direct) Dial(network, addr string) (net.Conn, error) { - return net.Dial(network, addr) -} - -// A PerHost directs connections to a default Dialer unless the host name -// requested matches one of a number of exceptions. -type proxy_PerHost struct { - def, bypass proxy_Dialer - - bypassNetworks []*net.IPNet - bypassIPs []net.IP - bypassZones []string - bypassHosts []string -} - -// NewPerHost returns a PerHost Dialer that directs connections to either -// defaultDialer or bypass, depending on whether the connection matches one of -// the configured rules. -func proxy_NewPerHost(defaultDialer, bypass proxy_Dialer) *proxy_PerHost { - return &proxy_PerHost{ - def: defaultDialer, - bypass: bypass, - } -} - -// Dial connects to the address addr on the given network through either -// defaultDialer or bypass. -func (p *proxy_PerHost) Dial(network, addr string) (c net.Conn, err error) { - host, _, err := net.SplitHostPort(addr) - if err != nil { - return nil, err - } - - return p.dialerForRequest(host).Dial(network, addr) -} - -func (p *proxy_PerHost) dialerForRequest(host string) proxy_Dialer { - if ip := net.ParseIP(host); ip != nil { - for _, net := range p.bypassNetworks { - if net.Contains(ip) { - return p.bypass - } - } - for _, bypassIP := range p.bypassIPs { - if bypassIP.Equal(ip) { - return p.bypass - } - } - return p.def - } - - for _, zone := range p.bypassZones { - if strings.HasSuffix(host, zone) { - return p.bypass - } - if host == zone[1:] { - // For a zone ".example.com", we match "example.com" - // too. - return p.bypass - } - } - for _, bypassHost := range p.bypassHosts { - if bypassHost == host { - return p.bypass - } - } - return p.def -} - -// AddFromString parses a string that contains comma-separated values -// specifying hosts that should use the bypass proxy. Each value is either an -// IP address, a CIDR range, a zone (*.example.com) or a host name -// (localhost). A best effort is made to parse the string and errors are -// ignored. -func (p *proxy_PerHost) AddFromString(s string) { - hosts := strings.Split(s, ",") - for _, host := range hosts { - host = strings.TrimSpace(host) - if len(host) == 0 { - continue - } - if strings.Contains(host, "/") { - // We assume that it's a CIDR address like 127.0.0.0/8 - if _, net, err := net.ParseCIDR(host); err == nil { - p.AddNetwork(net) - } - continue - } - if ip := net.ParseIP(host); ip != nil { - p.AddIP(ip) - continue - } - if strings.HasPrefix(host, "*.") { - p.AddZone(host[1:]) - continue - } - p.AddHost(host) - } -} - -// AddIP specifies an IP address that will use the bypass proxy. Note that -// this will only take effect if a literal IP address is dialed. A connection -// to a named host will never match an IP. -func (p *proxy_PerHost) AddIP(ip net.IP) { - p.bypassIPs = append(p.bypassIPs, ip) -} - -// AddNetwork specifies an IP range that will use the bypass proxy. Note that -// this will only take effect if a literal IP address is dialed. A connection -// to a named host will never match. -func (p *proxy_PerHost) AddNetwork(net *net.IPNet) { - p.bypassNetworks = append(p.bypassNetworks, net) -} - -// AddZone specifies a DNS suffix that will use the bypass proxy. A zone of -// "example.com" matches "example.com" and all of its subdomains. -func (p *proxy_PerHost) AddZone(zone string) { - if strings.HasSuffix(zone, ".") { - zone = zone[:len(zone)-1] - } - if !strings.HasPrefix(zone, ".") { - zone = "." + zone - } - p.bypassZones = append(p.bypassZones, zone) -} - -// AddHost specifies a host name that will use the bypass proxy. -func (p *proxy_PerHost) AddHost(host string) { - if strings.HasSuffix(host, ".") { - host = host[:len(host)-1] - } - p.bypassHosts = append(p.bypassHosts, host) -} - -// A Dialer is a means to establish a connection. -type proxy_Dialer interface { - // Dial connects to the given address via the proxy. - Dial(network, addr string) (c net.Conn, err error) -} - -// Auth contains authentication parameters that specific Dialers may require. -type proxy_Auth struct { - User, Password string -} - -// FromEnvironment returns the dialer specified by the proxy related variables in -// the environment. -func proxy_FromEnvironment() proxy_Dialer { - allProxy := proxy_allProxyEnv.Get() - if len(allProxy) == 0 { - return proxy_Direct - } - - proxyURL, err := url.Parse(allProxy) - if err != nil { - return proxy_Direct - } - proxy, err := proxy_FromURL(proxyURL, proxy_Direct) - if err != nil { - return proxy_Direct - } - - noProxy := proxy_noProxyEnv.Get() - if len(noProxy) == 0 { - return proxy - } - - perHost := proxy_NewPerHost(proxy, proxy_Direct) - perHost.AddFromString(noProxy) - return perHost -} - -// proxySchemes is a map from URL schemes to a function that creates a Dialer -// from a URL with such a scheme. -var proxy_proxySchemes map[string]func(*url.URL, proxy_Dialer) (proxy_Dialer, error) - -// RegisterDialerType takes a URL scheme and a function to generate Dialers from -// a URL with that scheme and a forwarding Dialer. Registered schemes are used -// by FromURL. -func proxy_RegisterDialerType(scheme string, f func(*url.URL, proxy_Dialer) (proxy_Dialer, error)) { - if proxy_proxySchemes == nil { - proxy_proxySchemes = make(map[string]func(*url.URL, proxy_Dialer) (proxy_Dialer, error)) - } - proxy_proxySchemes[scheme] = f -} - -// FromURL returns a Dialer given a URL specification and an underlying -// Dialer for it to make network requests. -func proxy_FromURL(u *url.URL, forward proxy_Dialer) (proxy_Dialer, error) { - var auth *proxy_Auth - if u.User != nil { - auth = new(proxy_Auth) - auth.User = u.User.Username() - if p, ok := u.User.Password(); ok { - auth.Password = p - } - } - - switch u.Scheme { - case "socks5": - return proxy_SOCKS5("tcp", u.Host, auth, forward) - } - - // If the scheme doesn't match any of the built-in schemes, see if it - // was registered by another package. - if proxy_proxySchemes != nil { - if f, ok := proxy_proxySchemes[u.Scheme]; ok { - return f(u, forward) - } - } - - return nil, errors.New("proxy: unknown scheme: " + u.Scheme) -} - -var ( - proxy_allProxyEnv = &proxy_envOnce{ - names: []string{"ALL_PROXY", "all_proxy"}, - } - proxy_noProxyEnv = &proxy_envOnce{ - names: []string{"NO_PROXY", "no_proxy"}, - } -) - -// envOnce looks up an environment variable (optionally by multiple -// names) once. It mitigates expensive lookups on some platforms -// (e.g. Windows). -// (Borrowed from net/http/transport.go) -type proxy_envOnce struct { - names []string - once sync.Once - val string -} - -func (e *proxy_envOnce) Get() string { - e.once.Do(e.init) - return e.val -} - -func (e *proxy_envOnce) init() { - for _, n := range e.names { - e.val = os.Getenv(n) - if e.val != "" { - return - } - } -} - -// SOCKS5 returns a Dialer that makes SOCKSv5 connections to the given address -// with an optional username and password. See RFC 1928 and RFC 1929. -func proxy_SOCKS5(network, addr string, auth *proxy_Auth, forward proxy_Dialer) (proxy_Dialer, error) { - s := &proxy_socks5{ - network: network, - addr: addr, - forward: forward, - } - if auth != nil { - s.user = auth.User - s.password = auth.Password - } - - return s, nil -} - -type proxy_socks5 struct { - user, password string - network, addr string - forward proxy_Dialer -} - -const proxy_socks5Version = 5 - -const ( - proxy_socks5AuthNone = 0 - proxy_socks5AuthPassword = 2 -) - -const proxy_socks5Connect = 1 - -const ( - proxy_socks5IP4 = 1 - proxy_socks5Domain = 3 - proxy_socks5IP6 = 4 -) - -var proxy_socks5Errors = []string{ - "", - "general failure", - "connection forbidden", - "network unreachable", - "host unreachable", - "connection refused", - "TTL expired", - "command not supported", - "address type not supported", -} - -// Dial connects to the address addr on the given network via the SOCKS5 proxy. -func (s *proxy_socks5) Dial(network, addr string) (net.Conn, error) { - switch network { - case "tcp", "tcp6", "tcp4": - default: - return nil, errors.New("proxy: no support for SOCKS5 proxy connections of type " + network) - } - - conn, err := s.forward.Dial(s.network, s.addr) - if err != nil { - return nil, err - } - if err := s.connect(conn, addr); err != nil { - conn.Close() - return nil, err - } - return conn, nil -} - -// connect takes an existing connection to a socks5 proxy server, -// and commands the server to extend that connection to target, -// which must be a canonical address with a host and port. -func (s *proxy_socks5) connect(conn net.Conn, target string) error { - host, portStr, err := net.SplitHostPort(target) - if err != nil { - return err - } - - port, err := strconv.Atoi(portStr) - if err != nil { - return errors.New("proxy: failed to parse port number: " + portStr) - } - if port < 1 || port > 0xffff { - return errors.New("proxy: port number out of range: " + portStr) - } - - // the size here is just an estimate - buf := make([]byte, 0, 6+len(host)) - - buf = append(buf, proxy_socks5Version) - if len(s.user) > 0 && len(s.user) < 256 && len(s.password) < 256 { - buf = append(buf, 2 /* num auth methods */, proxy_socks5AuthNone, proxy_socks5AuthPassword) - } else { - buf = append(buf, 1 /* num auth methods */, proxy_socks5AuthNone) - } - - if _, err := conn.Write(buf); err != nil { - return errors.New("proxy: failed to write greeting to SOCKS5 proxy at " + s.addr + ": " + err.Error()) - } - - if _, err := io.ReadFull(conn, buf[:2]); err != nil { - return errors.New("proxy: failed to read greeting from SOCKS5 proxy at " + s.addr + ": " + err.Error()) - } - if buf[0] != 5 { - return errors.New("proxy: SOCKS5 proxy at " + s.addr + " has unexpected version " + strconv.Itoa(int(buf[0]))) - } - if buf[1] == 0xff { - return errors.New("proxy: SOCKS5 proxy at " + s.addr + " requires authentication") - } - - // See RFC 1929 - if buf[1] == proxy_socks5AuthPassword { - buf = buf[:0] - buf = append(buf, 1 /* password protocol version */) - buf = append(buf, uint8(len(s.user))) - buf = append(buf, s.user...) - buf = append(buf, uint8(len(s.password))) - buf = append(buf, s.password...) - - if _, err := conn.Write(buf); err != nil { - return errors.New("proxy: failed to write authentication request to SOCKS5 proxy at " + s.addr + ": " + err.Error()) - } - - if _, err := io.ReadFull(conn, buf[:2]); err != nil { - return errors.New("proxy: failed to read authentication reply from SOCKS5 proxy at " + s.addr + ": " + err.Error()) - } - - if buf[1] != 0 { - return errors.New("proxy: SOCKS5 proxy at " + s.addr + " rejected username/password") - } - } - - buf = buf[:0] - buf = append(buf, proxy_socks5Version, proxy_socks5Connect, 0 /* reserved */) - - if ip := net.ParseIP(host); ip != nil { - if ip4 := ip.To4(); ip4 != nil { - buf = append(buf, proxy_socks5IP4) - ip = ip4 - } else { - buf = append(buf, proxy_socks5IP6) - } - buf = append(buf, ip...) - } else { - if len(host) > 255 { - return errors.New("proxy: destination host name too long: " + host) - } - buf = append(buf, proxy_socks5Domain) - buf = append(buf, byte(len(host))) - buf = append(buf, host...) - } - buf = append(buf, byte(port>>8), byte(port)) - - if _, err := conn.Write(buf); err != nil { - return errors.New("proxy: failed to write connect request to SOCKS5 proxy at " + s.addr + ": " + err.Error()) - } - - if _, err := io.ReadFull(conn, buf[:4]); err != nil { - return errors.New("proxy: failed to read connect reply from SOCKS5 proxy at " + s.addr + ": " + err.Error()) - } - - failure := "unknown error" - if int(buf[1]) < len(proxy_socks5Errors) { - failure = proxy_socks5Errors[buf[1]] - } - - if len(failure) > 0 { - return errors.New("proxy: SOCKS5 proxy at " + s.addr + " failed to connect: " + failure) - } - - bytesToDiscard := 0 - switch buf[3] { - case proxy_socks5IP4: - bytesToDiscard = net.IPv4len - case proxy_socks5IP6: - bytesToDiscard = net.IPv6len - case proxy_socks5Domain: - _, err := io.ReadFull(conn, buf[:1]) - if err != nil { - return errors.New("proxy: failed to read domain length from SOCKS5 proxy at " + s.addr + ": " + err.Error()) - } - bytesToDiscard = int(buf[0]) - default: - return errors.New("proxy: got unknown address type " + strconv.Itoa(int(buf[3])) + " from SOCKS5 proxy at " + s.addr) - } - - if cap(buf) < bytesToDiscard { - buf = make([]byte, bytesToDiscard) - } else { - buf = buf[:bytesToDiscard] - } - if _, err := io.ReadFull(conn, buf); err != nil { - return errors.New("proxy: failed to read address from SOCKS5 proxy at " + s.addr + ": " + err.Error()) - } - - // Also need to discard the port number - if _, err := io.ReadFull(conn, buf[:2]); err != nil { - return errors.New("proxy: failed to read port from SOCKS5 proxy at " + s.addr + ": " + err.Error()) - } - - return nil -} diff --git a/backend/vendor/github.com/refraction-networking/utls/auth.go b/backend/vendor/github.com/refraction-networking/utls/auth.go index 680192f..998deb9 100644 --- a/backend/vendor/github.com/refraction-networking/utls/auth.go +++ b/backend/vendor/github.com/refraction-networking/utls/auth.go @@ -15,9 +15,6 @@ import ( "fmt" "hash" "io" - - circlPki "github.com/cloudflare/circl/pki" - circlSign "github.com/cloudflare/circl/sign" ) // verifyHandshakeSignature verifies a signature against pre-hashed @@ -58,20 +55,7 @@ func verifyHandshakeSignature(sigType uint8, pubkey crypto.PublicKey, hashFunc c return err } default: - // [UTLS SECTION BEGINS] - // Ported from cloudflare/go - scheme := circlSchemeBySigType(sigType) - if scheme == nil { - return errors.New("internal error: unknown signature type") - } - pubKey, ok := pubkey.(circlSign.PublicKey) - if !ok { - return fmt.Errorf("expected a %s public key, got %T", scheme.Name(), pubkey) - } - if !scheme.Verify(pubKey, signed, sig, nil) { - return fmt.Errorf("%s verification failure", scheme.Name()) - } - // [UTLS SECTION ENDS] + return errors.New("internal error: unknown signature type") } return nil } @@ -122,18 +106,7 @@ func typeAndHashFromSignatureScheme(signatureAlgorithm SignatureScheme) (sigType case Ed25519: sigType = signatureEd25519 default: - // [UTLS SECTION BEGINS] - // Ported from cloudflare/go - scheme := circlPki.SchemeByTLSID(uint(signatureAlgorithm)) - if scheme == nil { - return 0, 0, fmt.Errorf("unsupported signature algorithm: %v", signatureAlgorithm) - } - sigType = sigTypeByCirclScheme(scheme) - if sigType == 0 { - return 0, 0, fmt.Errorf("circl scheme %s not supported", - scheme.Name()) - } - // [UTLS SECTION ENDS] + return 0, 0, fmt.Errorf("unsupported signature algorithm: %v", signatureAlgorithm) } switch signatureAlgorithm { case PKCS1WithSHA1, ECDSAWithSHA1: @@ -147,14 +120,7 @@ func typeAndHashFromSignatureScheme(signatureAlgorithm SignatureScheme) (sigType case Ed25519: hash = directSigning default: - // [UTLS SECTION BEGINS] - // Ported from cloudflare/go - scheme := circlPki.SchemeByTLSID(uint(signatureAlgorithm)) - if scheme == nil { - return 0, 0, fmt.Errorf("unsupported signature algorithm: %v", signatureAlgorithm) - } - hash = directSigning - // [UTLS SECTION ENDS] + return 0, 0, fmt.Errorf("unsupported signature algorithm: %v", signatureAlgorithm) } return sigType, hash, nil } @@ -174,11 +140,6 @@ func legacyTypeAndHashFromPublicKey(pub crypto.PublicKey) (sigType uint8, hash c // full signature, and not even OpenSSL bothers with the // complexity, so we can't even test it properly. return 0, 0, fmt.Errorf("tls: Ed25519 public keys are not supported before TLS 1.2") - // [UTLS SECTION BEGINS] - // Ported from cloudflare/go - case circlSign.PublicKey: - return 0, 0, fmt.Errorf("tls: circl public keys are not supported before TLS 1.2") - // [UTLS SECTION ENDS] default: return 0, 0, fmt.Errorf("tls: unsupported public key: %T", pub) } @@ -249,16 +210,6 @@ func signatureSchemesForCertificate(version uint16, cert *Certificate) []Signatu } case ed25519.PublicKey: sigAlgs = []SignatureScheme{Ed25519} - // [UTLS SECTION BEGINS] - // Ported from cloudflare/go - case circlSign.PublicKey: - scheme := pub.Scheme() - tlsScheme, ok := scheme.(circlPki.TLSScheme) - if !ok { - return nil - } - sigAlgs = []SignatureScheme{SignatureScheme(tlsScheme.TLSIdentifier())} - // [UTLS SECTION ENDS] default: return nil } diff --git a/backend/vendor/github.com/refraction-networking/utls/common.go b/backend/vendor/github.com/refraction-networking/utls/common.go index fea76bd..73b6dad 100644 --- a/backend/vendor/github.com/refraction-networking/utls/common.go +++ b/backend/vendor/github.com/refraction-networking/utls/common.go @@ -316,11 +316,6 @@ type ConnectionState struct { // testingOnlyCurveID is the selected CurveID, or zero if an RSA exchanges // is performed. testingOnlyCurveID CurveID - - // ECHRetryConfigs contains the ECH retry configurations sent by the server in - // EncryptedExtensions message. It is only populated if the server sent the - // ech extension in EncryptedExtensions message. - ECHRetryConfigs []ECHConfig // [uTLS] } // ExportKeyingMaterial returns length bytes of exported key material in a new @@ -919,17 +914,6 @@ type Config struct { // autoSessionTicketKeys is like sessionTicketKeys but is owned by the // auto-rotation logic. See Config.ticketKeys. autoSessionTicketKeys []ticketKey - - // ECHConfigs contains the ECH configurations to be used by the ECH - // extension if any. - // It could either be distributed by the server in EncryptedExtensions - // message or out-of-band. - // - // If ECHConfigs is nil and an ECH extension is present, GREASEd ECH - // extension will be sent. - // - // If GREASE ECH extension is present, this field will be ignored. - ECHConfigs []ECHConfig // [uTLS] } // EncryptedClientHelloKey holds a private key that is associated @@ -1036,7 +1020,6 @@ func (c *Config) Clone() *Config { autoSessionTicketKeys: c.autoSessionTicketKeys, PreferSkipResumptionOnNilExtension: c.PreferSkipResumptionOnNilExtension, // [UTLS] - ECHConfigs: c.ECHConfigs, // [uTLS] } } diff --git a/backend/vendor/github.com/refraction-networking/utls/dicttls/exttype_values.go b/backend/vendor/github.com/refraction-networking/utls/dicttls/exttype_values.go index 103e880..cb0ef40 100644 --- a/backend/vendor/github.com/refraction-networking/utls/dicttls/exttype_values.go +++ b/backend/vendor/github.com/refraction-networking/utls/dicttls/exttype_values.go @@ -69,6 +69,7 @@ const ( const ( ExtType_next_protocol_negotiation uint16 = 13172 // https://datatracker.ietf.org/doc/html/draft-agl-tls-nextprotoneg-04 ExtType_application_settings uint16 = 17513 // https://www.ietf.org/archive/id/draft-vvv-tls-alps-01.html + ExtType_application_settings_new uint16 = 17613 // https://www.ietf.org/archive/id/draft-vvv-tls-alps-01.html ExtType_channel_id_old uint16 = 30031 // https://datatracker.ietf.org/doc/html/draft-balfanz-tls-channelid-01 ExtType_channel_id uint16 = 30032 // https://datatracker.ietf.org/doc/html/draft-balfanz-tls-channelid-01 ) @@ -136,6 +137,7 @@ var DictExtTypeValueIndexed = map[uint16]string{ 13172: "next_protocol_negotiation", 17513: "application_settings", + 17613: "application_settings_new", 30031: "channel_id_old", 30032: "channel_id", } @@ -204,6 +206,7 @@ var DictExtTypeNameIndexed = map[string]uint16{ "next_protocol_negotiation": 13172, "application_settings": 17513, + "application_settings_new": 17613, "channel_id_old": 30031, "channel_id": 30032, } diff --git a/backend/vendor/github.com/refraction-networking/utls/handshake_client.go b/backend/vendor/github.com/refraction-networking/utls/handshake_client.go index 91cf41b..bba58a5 100644 --- a/backend/vendor/github.com/refraction-networking/utls/handshake_client.go +++ b/backend/vendor/github.com/refraction-networking/utls/handshake_client.go @@ -27,8 +27,6 @@ import ( "github.com/refraction-networking/utls/internal/fips140tls" "github.com/refraction-networking/utls/internal/hpke" "github.com/refraction-networking/utls/internal/tls13" - - circlSign "github.com/cloudflare/circl/sign" ) type clientHandshakeState struct { @@ -1220,7 +1218,7 @@ func (c *Conn) verifyServerCertificate(certificates [][]byte) error { } switch certs[0].PublicKey.(type) { - case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey, circlSign.PublicKey: // [UTLS] ported from cloudflare/go + case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey: break default: c.sendAlert(alertUnsupportedCertificate) diff --git a/backend/vendor/github.com/refraction-networking/utls/handshake_client_tls13.go b/backend/vendor/github.com/refraction-networking/utls/handshake_client_tls13.go index 07a1e21..01c2756 100644 --- a/backend/vendor/github.com/refraction-networking/utls/handshake_client_tls13.go +++ b/backend/vendor/github.com/refraction-networking/utls/handshake_client_tls13.go @@ -8,6 +8,7 @@ import ( "bytes" "context" "crypto" + "crypto/ecdh" "crypto/hmac" "crypto/mlkem" "crypto/rsa" @@ -562,6 +563,22 @@ func (hs *clientHandshakeStateTLS13) processServerHello() error { return nil } +// [uTLS] SECTION BEGIN +func getSharedKey(peerData []byte, key *ecdh.PrivateKey) ([]byte, error) { + peerKey, err := key.Curve().NewPublicKey(peerData) + if err != nil { + return nil, errors.New("tls: invalid server key share") + } + sharedKey, err := key.ECDH(peerKey) + if err != nil { + return nil, errors.New("tls: invalid server key share") + } + + return sharedKey, nil +} + +// [uTLS] SECTION END + func (hs *clientHandshakeStateTLS13) establishHandshakeKeys() error { c := hs.c @@ -581,13 +598,8 @@ func (hs *clientHandshakeStateTLS13) establishHandshakeKeys() error { } ecdhePeerData = hs.serverHello.serverShare.data[:x25519PublicKeySize] } + sharedKey, err := getSharedKey(ecdhePeerData, hs.keyShareKeys.ecdhe) // [uTLS] SECTION END - peerKey, err := hs.keyShareKeys.ecdhe.Curve().NewPublicKey(ecdhePeerData) - if err != nil { - c.sendAlert(alertIllegalParameter) - return errors.New("tls: invalid server key share") - } - sharedKey, err := hs.keyShareKeys.ecdhe.ECDH(peerKey) if err != nil { c.sendAlert(alertIllegalParameter) return errors.New("tls: invalid server key share") @@ -596,6 +608,14 @@ func (hs *clientHandshakeStateTLS13) establishHandshakeKeys() error { if hs.keyShareKeys.mlkem == nil { return c.sendAlert(alertInternalError) } + // [uTLS] SECTION BEGIN + if hs.uconn != nil && hs.uconn.clientHelloBuildStatus == BuildByUtls { + if sharedKey, err = getSharedKey(ecdhePeerData, hs.keyShareKeys.mlkemEcdhe); err != nil { + c.sendAlert(alertIllegalParameter) + return errors.New("tls: invalid server key share") + } + } + // [uTLS] SECTION END ciphertext := hs.serverHello.serverShare.data[:mlkem.CiphertextSize768] mlkemShared, err := hs.keyShareKeys.mlkem.Decapsulate(ciphertext) if err != nil { @@ -609,6 +629,12 @@ func (hs *clientHandshakeStateTLS13) establishHandshakeKeys() error { if hs.keyShareKeys.mlkem == nil { return c.sendAlert(alertInternalError) } + if hs.uconn != nil && hs.uconn.clientHelloBuildStatus == BuildByUtls { + if sharedKey, err = getSharedKey(ecdhePeerData, hs.keyShareKeys.mlkemEcdhe); err != nil { + c.sendAlert(alertIllegalParameter) + return errors.New("tls: invalid server key share") + } + } ciphertext := hs.serverHello.serverShare.data[x25519PublicKeySize:] kyberShared, err := kyberDecapsulate(hs.keyShareKeys.mlkem, ciphertext) if err != nil { @@ -824,7 +850,7 @@ func (hs *clientHandshakeStateTLS13) readServerCertificate() error { } // See RFC 8446, Section 4.4.3. - if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, c.config.supportedSignatureAlgorithms()) { // [UTLS] ported from cloudflare/go + if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, supportedSignatureAlgorithms()) { c.sendAlert(alertIllegalParameter) return errors.New("tls: certificate used with invalid signature algorithm") } diff --git a/backend/vendor/github.com/refraction-networking/utls/handshake_messages.go b/backend/vendor/github.com/refraction-networking/utls/handshake_messages.go index 3b1d341..3304283 100644 --- a/backend/vendor/github.com/refraction-networking/utls/handshake_messages.go +++ b/backend/vendor/github.com/refraction-networking/utls/handshake_messages.go @@ -1276,6 +1276,7 @@ func (m *newSessionTicketMsgTLS13) unmarshal(data []byte) bool { } type certificateRequestMsgTLS13 struct { + original []byte // [uTLS] ocspStapling bool scts bool supportedSignatureAlgorithms []SignatureScheme @@ -1344,7 +1345,7 @@ func (m *certificateRequestMsgTLS13) marshal() ([]byte, error) { } func (m *certificateRequestMsgTLS13) unmarshal(data []byte) bool { - *m = certificateRequestMsgTLS13{} + *m = certificateRequestMsgTLS13{original: data} // [uTLS] s := cryptobyte.String(data) var context, extensions cryptobyte.String @@ -1419,6 +1420,13 @@ func (m *certificateRequestMsgTLS13) unmarshal(data []byte) bool { return true } +// [UTLS SECTION BEGINS] +func (m *certificateRequestMsgTLS13) originalBytes() []byte { + return m.original +} + +// [UTLS SECTION ENDS] + type certificateMsg struct { certificates [][]byte } diff --git a/backend/vendor/github.com/refraction-networking/utls/handshake_server.go b/backend/vendor/github.com/refraction-networking/utls/handshake_server.go index 70ba714..e38ebae 100644 --- a/backend/vendor/github.com/refraction-networking/utls/handshake_server.go +++ b/backend/vendor/github.com/refraction-networking/utls/handshake_server.go @@ -19,8 +19,6 @@ import ( "time" "github.com/refraction-networking/utls/internal/byteorder" - - circlSign "github.com/cloudflare/circl/sign" ) // serverHandshakeState contains details of a server handshake in progress. @@ -643,7 +641,7 @@ func (hs *serverHandshakeState) doFullHandshake() error { } if c.vers >= VersionTLS12 { certReq.hasSignatureAlgorithm = true - certReq.supportedSignatureAlgorithms = c.config.supportedSignatureAlgorithms() // [UTLS] ported from cloudflare/go + certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithms() } // An empty list of certificateAuthorities signals to @@ -972,7 +970,7 @@ func (c *Conn) processCertsFromClient(certificate Certificate) error { if len(certs) > 0 { switch certs[0].PublicKey.(type) { - case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey, circlSign.PublicKey: // [UTLS] ported from cloudflare/go + case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey: default: c.sendAlert(alertUnsupportedCertificate) return fmt.Errorf("tls: client certificate contains an unsupported public key of type %T", certs[0].PublicKey) diff --git a/backend/vendor/github.com/refraction-networking/utls/handshake_server_tls13.go b/backend/vendor/github.com/refraction-networking/utls/handshake_server_tls13.go index b05f142..510db6f 100644 --- a/backend/vendor/github.com/refraction-networking/utls/handshake_server_tls13.go +++ b/backend/vendor/github.com/refraction-networking/utls/handshake_server_tls13.go @@ -833,7 +833,7 @@ func (hs *serverHandshakeStateTLS13) sendServerCertificate() error { certReq := new(certificateRequestMsgTLS13) certReq.ocspStapling = true certReq.scts = true - certReq.supportedSignatureAlgorithms = c.config.supportedSignatureAlgorithms() // [UTLS] ported from cloudflare/go + certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithms() if c.config.ClientCAs != nil { certReq.certificateAuthorities = c.config.ClientCAs.Subjects() } @@ -1089,7 +1089,7 @@ func (hs *serverHandshakeStateTLS13) readClientCertificate() error { } // See RFC 8446, Section 4.4.3. - if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, c.config.supportedSignatureAlgorithms()) { // [UTLS] ported from cloudflare/go + if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, supportedSignatureAlgorithms()) { c.sendAlert(alertIllegalParameter) return errors.New("tls: client certificate used with invalid signature algorithm") } diff --git a/backend/vendor/github.com/refraction-networking/utls/key_agreement.go b/backend/vendor/github.com/refraction-networking/utls/key_agreement.go index 671c782..3e96242 100644 --- a/backend/vendor/github.com/refraction-networking/utls/key_agreement.go +++ b/backend/vendor/github.com/refraction-networking/utls/key_agreement.go @@ -130,7 +130,7 @@ func md5SHA1Hash(slices [][]byte) []byte { // the sigType (for earlier TLS versions). For Ed25519 signatures, which don't // do pre-hashing, it returns the concatenation of the slices. func hashForServerKeyExchange(sigType uint8, hashFunc crypto.Hash, version uint16, slices ...[]byte) []byte { - if sigType == signatureEd25519 || circlSchemeBySigType(sigType) != nil { // [UTLS] ported from cloudflare/go + if sigType == signatureEd25519 { var signed []byte for _, slice := range slices { signed = append(signed, slice...) diff --git a/backend/vendor/github.com/refraction-networking/utls/key_schedule.go b/backend/vendor/github.com/refraction-networking/utls/key_schedule.go index 27e11b6..0afa04b 100644 --- a/backend/vendor/github.com/refraction-networking/utls/key_schedule.go +++ b/backend/vendor/github.com/refraction-networking/utls/key_schedule.go @@ -51,9 +51,10 @@ func (c *cipherSuiteTLS13) exportKeyingMaterial(s *tls13.MasterSecret, transcrip } type keySharePrivateKeys struct { - curveID CurveID - ecdhe *ecdh.PrivateKey - mlkem *mlkem.DecapsulationKey768 + curveID CurveID + ecdhe *ecdh.PrivateKey + mlkem *mlkem.DecapsulationKey768 + mlkemEcdhe *ecdh.PrivateKey // [uTLS] seperate ecdhe key for pq keyshare in line with Chrome, instead of reusing ecdhe key like stdlib } const x25519PublicKeySize = 32 diff --git a/backend/vendor/github.com/refraction-networking/utls/prf.go b/backend/vendor/github.com/refraction-networking/utls/prf.go index f99411f..2c638ba 100644 --- a/backend/vendor/github.com/refraction-networking/utls/prf.go +++ b/backend/vendor/github.com/refraction-networking/utls/prf.go @@ -225,11 +225,11 @@ func (h finishedHash) serverSum(masterSecret []byte) []byte { // hashForClientCertificate returns the handshake messages so far, pre-hashed if // necessary, suitable for signing by a TLS client certificate. func (h finishedHash) hashForClientCertificate(sigType uint8, hashAlg crypto.Hash) []byte { - if (h.version >= VersionTLS12 || sigType == signatureEd25519 || circlSchemeBySigType(sigType) != nil) && h.buffer == nil { // [UTLS] ported from cloudflare/go + if (h.version >= VersionTLS12 || sigType == signatureEd25519) && h.buffer == nil { panic("tls: handshake hash for a client certificate requested after discarding the handshake buffer") } - if sigType == signatureEd25519 || circlSchemeBySigType(sigType) != nil { // [UTLS] ported from cloudflare/go + if sigType == signatureEd25519 { return h.buffer } diff --git a/backend/vendor/github.com/refraction-networking/utls/tls.go b/backend/vendor/github.com/refraction-networking/utls/tls.go index 051108f..d76e000 100644 --- a/backend/vendor/github.com/refraction-networking/utls/tls.go +++ b/backend/vendor/github.com/refraction-networking/utls/tls.go @@ -25,8 +25,6 @@ import ( "net" "os" "strings" - - circlSign "github.com/cloudflare/circl/sign" ) // Server returns a new TLS server side connection @@ -345,20 +343,6 @@ func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (Certificate, error) { if !bytes.Equal(priv.Public().(ed25519.PublicKey), pub) { return fail(errors.New("tls: private key does not match public key")) } - // [UTLS SECTION BEGINS] - // Ported from cloudflare/go - case circlSign.PublicKey: - priv, ok := cert.PrivateKey.(circlSign.PrivateKey) - if !ok { - return fail(errors.New("tls: private key type does not match public key type")) - } - pkBytes, err := priv.Public().(circlSign.PublicKey).MarshalBinary() - pkBytes2, err2 := pub.MarshalBinary() - - if err != nil || err2 != nil || !bytes.Equal(pkBytes, pkBytes2) { - return fail(errors.New("tls: private key does not match public key")) - } - // [UTLS SECTION ENDS] default: return fail(errors.New("tls: unknown public key algorithm")) } @@ -375,7 +359,7 @@ func parsePrivateKey(der []byte) (crypto.PrivateKey, error) { } if key, err := x509.ParsePKCS8PrivateKey(der); err == nil { switch key := key.(type) { - case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey, circlSign.PrivateKey: // [uTLS] ported from cloudflare/go + case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey: return key, nil default: return nil, errors.New("tls: found unknown private key type in PKCS#8 wrapping") diff --git a/backend/vendor/github.com/refraction-networking/utls/tls_cf.go b/backend/vendor/github.com/refraction-networking/utls/tls_cf.go deleted file mode 100644 index 5b74cb4..0000000 --- a/backend/vendor/github.com/refraction-networking/utls/tls_cf.go +++ /dev/null @@ -1,62 +0,0 @@ -// Copyright 2021 Cloudflare, Inc. All rights reserved. Use of this source code -// is governed by a BSD-style license that can be found in the LICENSE file. - -package tls - -import ( - circlPki "github.com/cloudflare/circl/pki" - circlSign "github.com/cloudflare/circl/sign" - "github.com/cloudflare/circl/sign/eddilithium3" -) - -// To add a signature scheme from Circl -// -// 1. make sure it implements TLSScheme and CertificateScheme, -// 2. follow the instructions in crypto/x509/x509_cf.go -// 3. add a signature to the iota in common.go -// 4. add row in the circlSchemes lists below - -var circlSchemes = [...]struct { - sigType uint8 - scheme circlSign.Scheme -}{ - {signatureEdDilithium3, eddilithium3.Scheme()}, -} - -func circlSchemeBySigType(sigType uint8) circlSign.Scheme { - for _, cs := range circlSchemes { - if cs.sigType == sigType { - return cs.scheme - } - } - return nil -} - -func sigTypeByCirclScheme(scheme circlSign.Scheme) uint8 { - for _, cs := range circlSchemes { - if cs.scheme == scheme { - return cs.sigType - } - } - return 0 -} - -var supportedSignatureAlgorithmsWithCircl []SignatureScheme - -// supportedSignatureAlgorithms returns enabled signature schemes. PQ signature -// schemes are only included when tls.Config#PQSignatureSchemesEnabled is set -// and FIPS-only mode is not enabled. -func (c *Config) supportedSignatureAlgorithms() []SignatureScheme { - if c != nil && c.PQSignatureSchemesEnabled { - return supportedSignatureAlgorithmsWithCircl - } - return defaultSupportedSignatureAlgorithms -} - -func init() { - supportedSignatureAlgorithmsWithCircl = append([]SignatureScheme{}, defaultSupportedSignatureAlgorithms...) - for _, cs := range circlSchemes { - supportedSignatureAlgorithmsWithCircl = append(supportedSignatureAlgorithmsWithCircl, - SignatureScheme(cs.scheme.(circlPki.TLSScheme).TLSIdentifier())) - } -} diff --git a/backend/vendor/github.com/refraction-networking/utls/u_alias.go b/backend/vendor/github.com/refraction-networking/utls/u_alias.go index 7cf5d16..a1360c5 100644 --- a/backend/vendor/github.com/refraction-networking/utls/u_alias.go +++ b/backend/vendor/github.com/refraction-networking/utls/u_alias.go @@ -2,8 +2,6 @@ package tls import ( "crypto/ecdh" - - "github.com/cloudflare/circl/kem" ) // This file contains all the alias functions, symbols, names, etc. that @@ -32,10 +30,10 @@ func (*KeySharesParameters) GetEcdheKey(curveID CurveID) (ecdheKey *ecdh.Private func (*KeySharesParameters) GetEcdhePubkey(curveID CurveID) (params *ecdh.PublicKey, ok bool) { return } -func (*KeySharesParameters) AddKemKeypair(curveID CurveID, kemKey kem.PrivateKey, kemPubKey kem.PublicKey) { +func (*KeySharesParameters) AddKemKeypair(curveID CurveID, kemKey any, kemPubKey any) { return } -func (ksp *KeySharesParameters) GetKemKey(curveID CurveID) (kemKey kem.PrivateKey, ok bool) { return } +func (ksp *KeySharesParameters) GetKemKey(curveID CurveID) (kemKey any, ok bool) { return } -func (ksp *KeySharesParameters) GetKemPubkey(curveID CurveID) (params kem.PublicKey, ok bool) { return } +func (ksp *KeySharesParameters) GetKemPubkey(curveID CurveID) (params any, ok bool) { return } diff --git a/backend/vendor/github.com/refraction-networking/utls/u_common.go b/backend/vendor/github.com/refraction-networking/utls/u_common.go index a0616e8..e98c7ce 100644 --- a/backend/vendor/github.com/refraction-networking/utls/u_common.go +++ b/backend/vendor/github.com/refraction-networking/utls/u_common.go @@ -34,12 +34,13 @@ const ( const ( extensionNextProtoNeg uint16 = 13172 // not IANA assigned. Removed by crypto/tls since Nov 2019 - utlsExtensionPadding uint16 = 21 - utlsExtensionCompressCertificate uint16 = 27 // https://datatracker.ietf.org/doc/html/rfc8879#section-7.1 - utlsExtensionApplicationSettings uint16 = 17513 // not IANA assigned - utlsFakeExtensionCustom uint16 = 1234 // not IANA assigned, for ALPS - utlsExtensionECH uint16 = 0xfe0d // draft-ietf-tls-esni-17 - utlsExtensionECHOuterExtensions uint16 = 0xfd00 // draft-ietf-tls-esni-17 + utlsExtensionPadding uint16 = 21 + utlsExtensionCompressCertificate uint16 = 27 // https://datatracker.ietf.org/doc/html/rfc8879#section-7.1 + utlsExtensionApplicationSettings uint16 = 17513 // not IANA assigned + utlsExtensionApplicationSettingsNew uint16 = 17613 // not IANA assigned + utlsFakeExtensionCustom uint16 = 1234 // not IANA assigned, for ALPS + utlsExtensionECH uint16 = 0xfe0d // draft-ietf-tls-esni-17 + utlsExtensionECHOuterExtensions uint16 = 0xfd00 // draft-ietf-tls-esni-17 // extensions with 'fake' prefix break connection, if server echoes them back fakeExtensionEncryptThenMAC uint16 = 22 @@ -447,6 +448,8 @@ func (chs *ClientHelloSpec) ImportTLSClientHello(data map[string][]byte) error { case utlsExtensionApplicationSettings: // TODO: tlsfingerprint.io should record/provide application settings data extWriter.(*ApplicationSettingsExtension).SupportedProtocols = []string{"h2"} + case utlsExtensionApplicationSettingsNew: + extWriter.(*ApplicationSettingsExtensionNew).SupportedProtocols = []string{"h2"} case extensionPreSharedKey: log.Printf("[Warning] PSK extension added without data") default: @@ -609,7 +612,7 @@ var ( HelloFirefox_105 = ClientHelloID{helloFirefox, "105", nil, nil} HelloFirefox_120 = ClientHelloID{helloFirefox, "120", nil, nil} - HelloChrome_Auto = HelloChrome_131 + HelloChrome_Auto = HelloChrome_133 HelloChrome_58 = ClientHelloID{helloChrome, "58", nil, nil} HelloChrome_62 = ClientHelloID{helloChrome, "62", nil, nil} HelloChrome_70 = ClientHelloID{helloChrome, "70", nil, nil} @@ -639,6 +642,8 @@ var ( HelloChrome_120_PQ = ClientHelloID{helloChrome, "120_PQ", nil, nil} // Chrome w/ ML-KEM curve HelloChrome_131 = ClientHelloID{helloChrome, "131", nil, nil} + // Chrome w/ New ALPS codepoint + HelloChrome_133 = ClientHelloID{helloChrome, "133", nil, nil} HelloIOS_Auto = HelloIOS_14 HelloIOS_11_1 = ClientHelloID{helloIOS, "111", nil, nil} // legacy "111" means 11.1 @@ -679,6 +684,7 @@ type Weights struct { Extensions_Append_Reneg float64 Extensions_Append_EMS float64 FirstKeyShare_Set_CurveP256 float64 + KeyShare_Append_RandomGroups float64 Extensions_Append_ALPS float64 } @@ -699,7 +705,8 @@ var DefaultWeights = Weights{ Extensions_Append_SCT: 0.46, Extensions_Append_Reneg: 0.75, Extensions_Append_EMS: 0.77, - FirstKeyShare_Set_CurveP256: 0.25, + FirstKeyShare_Set_CurveP256: 0.00, // legacy setting + KeyShare_Append_RandomGroups: 0.50, Extensions_Append_ALPS: 0.33, } diff --git a/backend/vendor/github.com/refraction-networking/utls/u_conn.go b/backend/vendor/github.com/refraction-networking/utls/u_conn.go index cc1f12d..074b4f3 100644 --- a/backend/vendor/github.com/refraction-networking/utls/u_conn.go +++ b/backend/vendor/github.com/refraction-networking/utls/u_conn.go @@ -579,18 +579,6 @@ func (uconn *UConn) MarshalClientHello() error { ech.innerHello = inner - sniExtIdex := slices.IndexFunc(uconn.Extensions, func(ext TLSExtension) bool { - _, ok := ext.(*SNIExtension) - return ok - }) - if sniExtIdex < 0 { - return fmt.Errorf("sni extension missing while attempting ECH") - } - - uconn.Extensions[sniExtIdex] = &SNIExtension{ - ServerName: string(ech.config.PublicName), - } - uconn.computeAndUpdateOuterECHExtension(inner, ech, true) uconn.echCtx = ech @@ -853,17 +841,13 @@ func (c *Conn) utlsHandshakeMessageType(msgType byte) (handshakeMessage, error) // Extending (*Conn).connectionStateLocked() func (c *Conn) utlsConnectionStateLocked(state *ConnectionState) { state.PeerApplicationSettings = c.utls.peerApplicationSettings - state.ECHRetryConfigs = c.utls.echRetryConfigs } type utlsConnExtraFields struct { // Application Settings (ALPS) - hasApplicationSettings bool - peerApplicationSettings []byte - localApplicationSettings []byte - - // Encrypted Client Hello (ECH) - echRetryConfigs []ECHConfig + peerApplicationSettings []byte + localApplicationSettings []byte + applicationSettingsCodepoint uint16 sessionController *sessionController } diff --git a/backend/vendor/github.com/refraction-networking/utls/u_ech.go b/backend/vendor/github.com/refraction-networking/utls/u_ech.go index fad8dd0..27392a2 100644 --- a/backend/vendor/github.com/refraction-networking/utls/u_ech.go +++ b/backend/vendor/github.com/refraction-networking/utls/u_ech.go @@ -8,8 +8,8 @@ import ( "math/big" "sync" - "github.com/cloudflare/circl/hpke" "github.com/refraction-networking/utls/dicttls" + "github.com/refraction-networking/utls/internal/hpke" "golang.org/x/crypto/cryptobyte" ) @@ -26,9 +26,6 @@ type EncryptedClientHelloExtension interface { // TLSExtension must be implemented by all EncryptedClientHelloExtension implementations. TLSExtension - // Configure configures the EncryptedClientHelloExtension with the given slice of ECHConfig. - Configure([]ECHConfig) error - // MarshalClientHello is called by (*UConn).MarshalClientHello() when an ECH extension // is present to allow the ECH extension to take control of the generation of the // entire ClientHello message. @@ -96,8 +93,7 @@ func (g *GREASEEncryptedClientHelloExtension) init() error { // but MAY be held constant for successive connections to the same server // in the same session. if len(g.CandidateCipherSuites) == 0 { - _, kdf, aead := defaultHPKESuite.Params() - g.cipherSuite = HPKESymmetricCipherSuite{uint16(kdf), uint16(aead)} + g.cipherSuite = HPKESymmetricCipherSuite{uint16(defaultHpkeKdf), uint16(defaultHpkeAead)} } else { // randomly pick one from the list rndIndex, err := rand.Int(rand.Reader, big.NewInt(int64(len(g.CandidateCipherSuites)))) @@ -113,21 +109,18 @@ func (g *GREASEEncryptedClientHelloExtension) init() error { } if len(g.EncapsulatedKey) == 0 { - // use default random key from cloudflare/go - kem := hpke.KEM_X25519_HKDF_SHA256 + kem := uint16(defaultHpkeKem) - pk, err := kem.Scheme().UnmarshalBinaryPublicKey(dummyX25519PublicKey) + echPK, err := hpke.ParseHPKEPublicKey(uint16(kem), dummyX25519PublicKey) if err != nil { initErr = fmt.Errorf("tls: grease ech: failed to parse dummy public key: %w", err) return } - sender, err := defaultHPKESuite.NewSender(pk, nil) - if err != nil { - initErr = fmt.Errorf("tls: grease ech: failed to create sender: %w", err) - return + suite := echCipher{ + KDFID: defaultHpkeKdf, + AEADID: defaultHpkeAead, } - - g.EncapsulatedKey, _, err = sender.Setup(rand.Reader) + g.EncapsulatedKey, _, err = hpke.SetupSender(kem, suite.KDFID, suite.AEADID, echPK, []byte{}) if err != nil { initErr = fmt.Errorf("tls: grease ech: failed to setup encapsulated key: %w", err) return @@ -158,8 +151,7 @@ func (g *GREASEEncryptedClientHelloExtension) randomizePayload(encodedHelloInner return errors.New("tls: grease ech: regenerating payload is forbidden") } - aead := hpke.AEAD(g.cipherSuite.AeadId) - g.payload = make([]byte, int(aead.CipherLen(uint(encodedHelloInnerLen)))) + g.payload = make([]byte, cipherLen(g.cipherSuite.AeadId, int(encodedHelloInnerLen))) _, err := rand.Read(g.payload) if err != nil { return fmt.Errorf("tls: generating grease ech payload: %w", err) @@ -207,11 +199,6 @@ func (g *GREASEEncryptedClientHelloExtension) Read(b []byte) (int, error) { return g.Len(), io.EOF } -// Configure implements EncryptedClientHelloExtension. -func (*GREASEEncryptedClientHelloExtension) Configure([]ECHConfig) error { - return nil // no-op, it is not possible to configure a GREASE extension for now -} - // MarshalClientHello implements EncryptedClientHelloExtension. func (*GREASEEncryptedClientHelloExtension) MarshalClientHello(*UConn) error { return errors.New("tls: grease ech: MarshalClientHello() is not implemented, use (*UConn).MarshalClientHello() instead") @@ -269,8 +256,7 @@ func (g *GREASEEncryptedClientHelloExtension) Write(b []byte) (int, error) { if !extData.ReadUint16LengthPrefixed(&ignored) { return fullLen, errors.New("bad payload") } - aead := hpke.AEAD(g.cipherSuite.AeadId) - g.CandidatePayloadLens = []uint16{uint16(len(ignored) - int(aead.CipherLen(0)))} + g.CandidatePayloadLens = []uint16{uint16(len(ignored) - cipherLen(g.cipherSuite.AeadId, 0))} return fullLen, nil } @@ -295,11 +281,6 @@ func (*UnimplementedECHExtension) Read(_ []byte) (int, error) { return 0, errors.New("tls: unimplemented ECHExtension") } -// Configure implements EncryptedClientHelloExtension. -func (*UnimplementedECHExtension) Configure([]ECHConfig) error { - return errors.New("tls: unimplemented ECHExtension") -} - // MarshalClientHello implements EncryptedClientHelloExtension. func (*UnimplementedECHExtension) MarshalClientHello(*UConn) error { return errors.New("tls: unimplemented ECHExtension") @@ -319,10 +300,6 @@ func BoringGREASEECH() *GREASEEncryptedClientHelloExtension { KdfId: dicttls.HKDF_SHA256, AeadId: dicttls.AEAD_AES_128_GCM, }, - { - KdfId: dicttls.HKDF_SHA256, - AeadId: dicttls.AEAD_CHACHA20_POLY1305, - }, }, CandidatePayloadLens: []uint16{128, 160, 192, 224}, // +16: 144, 176, 208, 240 } diff --git a/backend/vendor/github.com/refraction-networking/utls/u_ech_config.go b/backend/vendor/github.com/refraction-networking/utls/u_ech_config.go deleted file mode 100644 index 633c7b1..0000000 --- a/backend/vendor/github.com/refraction-networking/utls/u_ech_config.go +++ /dev/null @@ -1,135 +0,0 @@ -package tls - -import ( - "errors" - "fmt" - - "github.com/cloudflare/circl/hpke" - "golang.org/x/crypto/cryptobyte" -) - -type ECHConfigContents struct { - KeyConfig HPKEKeyConfig - MaximumNameLength uint8 - PublicName []byte - // Extensions []TLSExtension // ignored for now - rawExtensions []byte -} - -func UnmarshalECHConfigContents(contents []byte) (ECHConfigContents, error) { - var ( - contentCryptobyte = cryptobyte.String(contents) - config ECHConfigContents - ) - - // Parse KeyConfig - var t cryptobyte.String - if !contentCryptobyte.ReadUint8(&config.KeyConfig.ConfigId) || - !contentCryptobyte.ReadUint16(&config.KeyConfig.KemId) || - !contentCryptobyte.ReadUint16LengthPrefixed(&t) || - !t.ReadBytes(&config.KeyConfig.rawPublicKey, len(t)) || - !contentCryptobyte.ReadUint16LengthPrefixed(&t) || - len(t)%4 != 0 { - return config, errors.New("error parsing KeyConfig") - } - - // Parse all CipherSuites in KeyConfig - config.KeyConfig.CipherSuites = nil - for !t.Empty() { - var kdfId, aeadId uint16 - if !t.ReadUint16(&kdfId) || !t.ReadUint16(&aeadId) { - // This indicates an internal bug. - panic("internal error while parsing contents.cipher_suites") - } - config.KeyConfig.CipherSuites = append(config.KeyConfig.CipherSuites, HPKESymmetricCipherSuite{kdfId, aeadId}) - } - - if !contentCryptobyte.ReadUint8(&config.MaximumNameLength) || - !contentCryptobyte.ReadUint8LengthPrefixed(&t) || - !t.ReadBytes(&config.PublicName, len(t)) || - !contentCryptobyte.ReadUint16LengthPrefixed(&t) || - !t.ReadBytes(&config.rawExtensions, len(t)) || - !contentCryptobyte.Empty() { - return config, errors.New("error parsing ECHConfigContents") - } - return config, nil -} - -func (echcc *ECHConfigContents) ParsePublicKey() error { - var err error - kem := hpke.KEM(echcc.KeyConfig.KemId) - if !kem.IsValid() { - return errors.New("invalid KEM") - } - echcc.KeyConfig.PublicKey, err = kem.Scheme().UnmarshalBinaryPublicKey(echcc.KeyConfig.rawPublicKey) - if err != nil { - return fmt.Errorf("error parsing public key: %s", err) - } - return nil -} - -type ECHConfig struct { - Version uint16 - Length uint16 - Contents ECHConfigContents - - raw []byte -} - -// UnmarshalECHConfigs parses a sequence of ECH configurations. -// -// Ported from cloudflare/go -func UnmarshalECHConfigs(raw []byte) ([]ECHConfig, error) { - var ( - err error - config ECHConfig - t, contents cryptobyte.String - ) - configs := make([]ECHConfig, 0) - s := cryptobyte.String(raw) - if !s.ReadUint16LengthPrefixed(&t) || !s.Empty() { - return configs, errors.New("error parsing configs") - } - raw = raw[2:] -ConfigsLoop: - for !t.Empty() { - l := len(t) - if !t.ReadUint16(&config.Version) || - !t.ReadUint16LengthPrefixed(&contents) { - return nil, errors.New("error parsing config") - } - config.Length = uint16(len(contents)) - n := l - len(t) - config.raw = raw[:n] - raw = raw[n:] - - if config.Version != utlsExtensionECH { - continue ConfigsLoop - } - - /**** cloudflare/go original ****/ - // if !readConfigContents(&contents, &config) { - // return nil, errors.New("error parsing config contents") - // } - - config.Contents, err = UnmarshalECHConfigContents(contents) - if err != nil { - return nil, fmt.Errorf("error parsing config contents: %s", err) - } - - /**** cloudflare/go original ****/ - // kem := hpke.KEM(config.kemId) - // if !kem.IsValid() { - // continue ConfigsLoop - // } - // config.pk, err = kem.Scheme().UnmarshalBinaryPublicKey(config.rawPublicKey) - // if err != nil { - // return nil, fmt.Errorf("error parsing public key: %s", err) - // } - - config.Contents.ParsePublicKey() // parse the bytes into a public key - - configs = append(configs, config) - } - return configs, nil -} diff --git a/backend/vendor/github.com/refraction-networking/utls/u_handshake_client.go b/backend/vendor/github.com/refraction-networking/utls/u_handshake_client.go index 0e2decc..9928f0c 100644 --- a/backend/vendor/github.com/refraction-networking/utls/u_handshake_client.go +++ b/backend/vendor/github.com/refraction-networking/utls/u_handshake_client.go @@ -131,8 +131,8 @@ func (hs *clientHandshakeStateTLS13) serverFinishedReceived() error { func (hs *clientHandshakeStateTLS13) sendClientEncryptedExtensions() error { c := hs.c clientEncryptedExtensions := new(utlsClientEncryptedExtensionsMsg) - if c.utls.hasApplicationSettings { - clientEncryptedExtensions.hasApplicationSettings = true + if c.utls.applicationSettingsCodepoint != 0 { + clientEncryptedExtensions.applicationSettingsCodepoint = c.utls.applicationSettingsCodepoint clientEncryptedExtensions.applicationSettings = c.utls.localApplicationSettings if _, err := c.writeHandshakeRecord(clientEncryptedExtensions, hs.transcript); err != nil { return err @@ -143,11 +143,10 @@ func (hs *clientHandshakeStateTLS13) sendClientEncryptedExtensions() error { } func (hs *clientHandshakeStateTLS13) utlsReadServerParameters(encryptedExtensions *encryptedExtensionsMsg) error { - hs.c.utls.hasApplicationSettings = encryptedExtensions.utls.hasApplicationSettings hs.c.utls.peerApplicationSettings = encryptedExtensions.utls.applicationSettings - hs.c.utls.echRetryConfigs = encryptedExtensions.utls.echRetryConfigs + hs.c.utls.applicationSettingsCodepoint = encryptedExtensions.utls.applicationSettingsCodepoint - if hs.c.utls.hasApplicationSettings { + if hs.c.utls.applicationSettingsCodepoint != 0 { if hs.uconn.vers < VersionTLS13 { return errors.New("tls: server sent application settings at invalid version") } @@ -165,23 +164,6 @@ func (hs *clientHandshakeStateTLS13) utlsReadServerParameters(encryptedExtension } } - if len(hs.c.utls.echRetryConfigs) > 0 { - if hs.uconn.vers < VersionTLS13 { - return errors.New("tls: server sent ECH retry configs at invalid version") - } - - // find ECH extension in ClientHello - var echIncluded bool - for _, ext := range hs.uconn.Extensions { - if _, ok := ext.(ECHExtension); ok { - echIncluded = true - } - } - if !echIncluded { - return errors.New("tls: server sent ECH retry configs without client sending ECH extension") - } - } - return nil } @@ -551,6 +533,7 @@ func (c *UConn) clientHandshake(ctx context.Context) (err error) { } // uTLS: do not create new handshakeState, use existing one + c.HandshakeState.ServerHello = serverHello.getPublicPtr() if c.vers == VersionTLS13 { hs13 := c.HandshakeState.toPrivate13() hs13.serverHello = serverHello diff --git a/backend/vendor/github.com/refraction-networking/utls/u_handshake_messages.go b/backend/vendor/github.com/refraction-networking/utls/u_handshake_messages.go index 1c9f460..dd8a1d9 100644 --- a/backend/vendor/github.com/refraction-networking/utls/u_handshake_messages.go +++ b/backend/vendor/github.com/refraction-networking/utls/u_handshake_messages.go @@ -54,32 +54,27 @@ func (m *utlsCompressedCertificateMsg) unmarshal(data []byte) bool { } type utlsEncryptedExtensionsMsgExtraFields struct { - hasApplicationSettings bool - applicationSettings []byte - echRetryConfigs []ECHConfig - customExtension []byte + applicationSettings []byte + applicationSettingsCodepoint uint16 + customExtension []byte } func (m *encryptedExtensionsMsg) utlsUnmarshal(extension uint16, extData cryptobyte.String) bool { switch extension { case utlsExtensionApplicationSettings: - m.utls.hasApplicationSettings = true + fallthrough + case utlsExtensionApplicationSettingsNew: + m.utls.applicationSettingsCodepoint = extension m.utls.applicationSettings = []byte(extData) - case utlsExtensionECH: - var err error - m.utls.echRetryConfigs, err = UnmarshalECHConfigs([]byte(extData)) - if err != nil { - return false - } } return true // success/unknown extension } type utlsClientEncryptedExtensionsMsg struct { - raw []byte - applicationSettings []byte - hasApplicationSettings bool - customExtension []byte + raw []byte + applicationSettings []byte + applicationSettingsCodepoint uint16 + customExtension []byte } func (m *utlsClientEncryptedExtensionsMsg) marshal() (x []byte, err error) { @@ -91,8 +86,8 @@ func (m *utlsClientEncryptedExtensionsMsg) marshal() (x []byte, err error) { builder.AddUint8(typeEncryptedExtensions) builder.AddUint24LengthPrefixed(func(body *cryptobyte.Builder) { body.AddUint16LengthPrefixed(func(extensions *cryptobyte.Builder) { - if m.hasApplicationSettings { - extensions.AddUint16(utlsExtensionApplicationSettings) + if m.applicationSettingsCodepoint != 0 { + extensions.AddUint16(m.applicationSettingsCodepoint) extensions.AddUint16LengthPrefixed(func(msg *cryptobyte.Builder) { msg.AddBytes(m.applicationSettings) }) @@ -130,7 +125,9 @@ func (m *utlsClientEncryptedExtensionsMsg) unmarshal(data []byte) bool { switch extension { case utlsExtensionApplicationSettings: - m.hasApplicationSettings = true + fallthrough + case utlsExtensionApplicationSettingsNew: + m.applicationSettingsCodepoint = extension m.applicationSettings = []byte(extData) default: // Unknown extensions are illegal in EncryptedExtensions. diff --git a/backend/vendor/github.com/refraction-networking/utls/u_hpke.go b/backend/vendor/github.com/refraction-networking/utls/u_hpke.go index 08d5eb4..e07ada2 100644 --- a/backend/vendor/github.com/refraction-networking/utls/u_hpke.go +++ b/backend/vendor/github.com/refraction-networking/utls/u_hpke.go @@ -1,11 +1,7 @@ package tls import ( - "errors" - "fmt" - - "github.com/cloudflare/circl/hpke" - "github.com/cloudflare/circl/kem" + "github.com/refraction-networking/utls/internal/hpke" ) type HPKERawPublicKey = []byte @@ -18,45 +14,22 @@ type HPKESymmetricCipherSuite struct { AeadId HPKE_AEAD_ID } -type HPKEKeyConfig struct { - ConfigId uint8 - KemId HPKE_KEM_ID - PublicKey kem.PublicKey - rawPublicKey HPKERawPublicKey - CipherSuites []HPKESymmetricCipherSuite -} - -var defaultHPKESuite hpke.Suite - -func init() { - var err error - defaultHPKESuite, err = hpkeAssembleSuite( - uint16(hpke.KEM_X25519_HKDF_SHA256), - uint16(hpke.KDF_HKDF_SHA256), - uint16(hpke.AEAD_AES128GCM), - ) - if err != nil { - panic(fmt.Sprintf("hpke: mandatory-to-implement cipher suite not supported: %s", err)) - } -} - -func hpkeAssembleSuite(kemId, kdfId, aeadId uint16) (hpke.Suite, error) { - kem := hpke.KEM(kemId) - if !kem.IsValid() { - return hpke.Suite{}, errors.New("KEM is not supported") - } - kdf := hpke.KDF(kdfId) - if !kdf.IsValid() { - return hpke.Suite{}, errors.New("KDF is not supported") - } - aead := hpke.AEAD(aeadId) - if !aead.IsValid() { - return hpke.Suite{}, errors.New("AEAD is not supported") - } - return hpke.NewSuite(kem, kdf, aead), nil -} +const defaultHpkeKdf = hpke.KDF_HKDF_SHA256 +const defaultHpkeKem = hpke.DHKEM_X25519_HKDF_SHA256 +const defaultHpkeAead = hpke.AEAD_AES_128_GCM var dummyX25519PublicKey = []byte{ 143, 38, 37, 36, 12, 6, 229, 30, 140, 27, 167, 73, 26, 100, 203, 107, 216, 81, 163, 222, 52, 211, 54, 210, 46, 37, 78, 216, 157, 97, 241, 244, } + +// cipherLen returns the length of a ciphertext corresponding to a message of +// length mLen. +func cipherLen(a uint16, mLen int) int { + switch a { + case hpke.AEAD_AES_128_GCM, hpke.AEAD_AES_256_GCM, hpke.AEAD_ChaCha20Poly1305: + return mLen + 16 + default: + panic("hpke: invalid AEAD identifier") + } +} diff --git a/backend/vendor/github.com/refraction-networking/utls/u_parrots.go b/backend/vendor/github.com/refraction-networking/utls/u_parrots.go index a155539..3dc72c3 100644 --- a/backend/vendor/github.com/refraction-networking/utls/u_parrots.go +++ b/backend/vendor/github.com/refraction-networking/utls/u_parrots.go @@ -731,6 +731,7 @@ func utlsIdToSpec(id ClientHelloID) (ClientHelloSpec, error) { &ApplicationSettingsExtension{SupportedProtocols: []string{"h2"}}, BoringGREASEECH(), &UtlsGREASEExtension{}, + &UtlsPaddingExtension{GetPaddingLen: BoringPaddingStyle}, }), }, nil // Chrome w/ Post-Quantum Key Agreement and ECH @@ -880,6 +881,79 @@ func utlsIdToSpec(id ClientHelloID) (ClientHelloSpec, error) { &UtlsGREASEExtension{}, }), }, nil + case HelloChrome_133: + return ClientHelloSpec{ + CipherSuites: []uint16{ + GREASE_PLACEHOLDER, + TLS_AES_128_GCM_SHA256, + TLS_AES_256_GCM_SHA384, + TLS_CHACHA20_POLY1305_SHA256, + TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + TLS_RSA_WITH_AES_128_GCM_SHA256, + TLS_RSA_WITH_AES_256_GCM_SHA384, + TLS_RSA_WITH_AES_128_CBC_SHA, + TLS_RSA_WITH_AES_256_CBC_SHA, + }, + CompressionMethods: []byte{ + 0x00, // compressionNone + }, + Extensions: ShuffleChromeTLSExtensions([]TLSExtension{ + &UtlsGREASEExtension{}, + &SNIExtension{}, + &ExtendedMasterSecretExtension{}, + &RenegotiationInfoExtension{Renegotiation: RenegotiateOnceAsClient}, + &SupportedCurvesExtension{[]CurveID{ + GREASE_PLACEHOLDER, + X25519MLKEM768, + X25519, + CurveP256, + CurveP384, + }}, + &SupportedPointsExtension{SupportedPoints: []byte{ + 0x00, // pointFormatUncompressed + }}, + &SessionTicketExtension{}, + &ALPNExtension{AlpnProtocols: []string{"h2", "http/1.1"}}, + &StatusRequestExtension{}, + &SignatureAlgorithmsExtension{SupportedSignatureAlgorithms: []SignatureScheme{ + ECDSAWithP256AndSHA256, + PSSWithSHA256, + PKCS1WithSHA256, + ECDSAWithP384AndSHA384, + PSSWithSHA384, + PKCS1WithSHA384, + PSSWithSHA512, + PKCS1WithSHA512, + }}, + &SCTExtension{}, + &KeyShareExtension{[]KeyShare{ + {Group: CurveID(GREASE_PLACEHOLDER), Data: []byte{0}}, + {Group: X25519MLKEM768}, + {Group: X25519}, + }}, + &PSKKeyExchangeModesExtension{[]uint8{ + PskModeDHE, + }}, + &SupportedVersionsExtension{[]uint16{ + GREASE_PLACEHOLDER, + VersionTLS13, + VersionTLS12, + }}, + &UtlsCompressCertExtension{[]CertCompressionAlgo{ + CertCompressionBrotli, + }}, + &ApplicationSettingsExtensionNew{SupportedProtocols: []string{"h2"}}, + BoringGREASEECH(), + &UtlsGREASEExtension{}, + }), + }, nil case HelloFirefox_55, HelloFirefox_56: return ClientHelloSpec{ TLSVersMax: VersionTLS12, @@ -1821,7 +1895,6 @@ func utlsIdToSpec(id ClientHelloID) (ClientHelloSpec, error) { GREASE_PLACEHOLDER, TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, - TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, @@ -2779,6 +2852,9 @@ func (uconn *UConn) ApplyPreset(p *ClientHelloSpec) error { if ext.ServerName == "" { ext.ServerName = uconn.config.ServerName } + if uconn.config.EncryptedClientHelloConfigList != nil { + ext.ServerName = string(ech.config.PublicName) + } case *UtlsGREASEExtension: switch grease_extensions_seen { case 0: @@ -2827,17 +2903,8 @@ func (uconn *UConn) ApplyPreset(p *ClientHelloSpec) error { } else { ext.KeyShares[i].Data = append(mlkemKey.EncapsulationKey().Bytes(), ecdheKey.PublicKey().Bytes()...) } - if !preferredCurveIsSet { - // only do this once for the first non-grease curve - uconn.HandshakeState.State13.KeyShareKeys.mlkem = mlkemKey - preferredCurveIsSet = true - } - - if len(ext.KeyShares) > i+1 && ext.KeyShares[i+1].Group == X25519 { - // Reuse the same X25519 ephemeral key for both keyshares, as allowed by draft-ietf-tls-hybrid-design-09, Section 3.2. - uconn.HandshakeState.State13.KeyShareKeys.Ecdhe = ecdheKey - ext.KeyShares[i+1].Data = ecdheKey.PublicKey().Bytes() - } + uconn.HandshakeState.State13.KeyShareKeys.Mlkem = mlkemKey + uconn.HandshakeState.State13.KeyShareKeys.MlkemEcdhe = ecdheKey } else { ecdheKey, err := generateECDHEKey(uconn.config.rand(), curveID) if err != nil { @@ -2927,7 +2994,9 @@ func generateRandomizedSpec( } if r.FlipWeightedCoin(id.Weights.TLSVersMax_Set_VersionTLS13) { - p.TLSVersMin = VersionTLS10 + // randomize min TLS version + minTLSVersCandidates := []uint16{VersionTLS10, VersionTLS12} + p.TLSVersMin = minTLSVersCandidates[r.Intn(len(minTLSVersCandidates))] p.TLSVersMax = VersionTLS13 tls13ciphers := make([]uint16, len(defaultCipherSuitesTLS13)) copy(tls13ciphers, defaultCipherSuitesTLS13) @@ -2985,6 +3054,9 @@ func generateRandomizedSpec( points := SupportedPointsExtension{SupportedPoints: []byte{pointFormatUncompressed}} curveIDs := []CurveID{} + if r.FlipWeightedCoin(id.Weights.CurveIDs_Append_X25519) && p.TLSVersMax == VersionTLS13 { + curveIDs = append(curveIDs, X25519MLKEM768) + } if r.FlipWeightedCoin(id.Weights.CurveIDs_Append_X25519) || p.TLSVersMax == VersionTLS13 { curveIDs = append(curveIDs, X25519) } @@ -3036,11 +3108,15 @@ func generateRandomizedSpec( ks := KeyShareExtension{[]KeyShare{ {Group: X25519}, // the key for the group will be generated later }} - if r.FlipWeightedCoin(id.Weights.FirstKeyShare_Set_CurveP256) { - // do not ADD second keyShare because crypto/tls does not support multiple ecdheParams - // TODO: add it back when they implement multiple keyShares, or implement it oursevles - // ks.KeyShares = append(ks.KeyShares, KeyShare{Group: CurveP256}) + if r.FlipWeightedCoin(id.Weights.FirstKeyShare_Set_CurveP256) { // legacy setting, not used by default ks.KeyShares[0].Group = CurveP256 + } else { + if r.FlipWeightedCoin(id.Weights.KeyShare_Append_RandomGroups) { + ks.KeyShares = append(ks.KeyShares, KeyShare{Group: CurveP256}) + } + if r.FlipWeightedCoin(id.Weights.KeyShare_Append_RandomGroups) { + ks.KeyShares = append([]KeyShare{{Group: X25519MLKEM768}}, ks.KeyShares...) + } } pskExchangeModes := PSKKeyExchangeModesExtension{[]uint8{pskModeDHE}} supportedVersionsExt := SupportedVersionsExtension{ diff --git a/backend/vendor/github.com/refraction-networking/utls/u_public.go b/backend/vendor/github.com/refraction-networking/utls/u_public.go index 087b41d..7b2461c 100644 --- a/backend/vendor/github.com/refraction-networking/utls/u_public.go +++ b/backend/vendor/github.com/refraction-networking/utls/u_public.go @@ -11,8 +11,6 @@ import ( "crypto/x509" "hash" "time" - - "github.com/cloudflare/circl/kem" ) // ClientHandshakeState includes both TLS 1.3-only and TLS 1.2-only states, @@ -286,7 +284,7 @@ type PubServerHelloMsg struct { // 1.3 SupportedVersion uint16 - ServerShare keyShare + ServerShare KeyShare SelectedIdentityPresent bool SelectedIdentity uint16 Cookie []byte // HelloRetryRequest extension @@ -315,7 +313,7 @@ func (shm *PubServerHelloMsg) getPrivatePtr() *serverHelloMsg { secureRenegotiationSupported: shm.SecureRenegotiationSupported, alpnProtocol: shm.AlpnProtocol, supportedVersion: shm.SupportedVersion, - serverShare: shm.ServerShare, + serverShare: shm.ServerShare.ToPrivate(), selectedIdentityPresent: shm.SelectedIdentityPresent, selectedIdentity: shm.SelectedIdentity, cookie: shm.Cookie, @@ -345,7 +343,7 @@ func (shm *serverHelloMsg) getPublicPtr() *PubServerHelloMsg { SecureRenegotiationSupported: shm.secureRenegotiationSupported, AlpnProtocol: shm.alpnProtocol, SupportedVersion: shm.supportedVersion, - ServerShare: shm.serverShare, + ServerShare: shm.serverShare.ToPublic(), SelectedIdentityPresent: shm.selectedIdentityPresent, SelectedIdentity: shm.selectedIdentity, Cookie: shm.cookie, @@ -633,20 +631,28 @@ type KeyShare struct { Data []byte `json:"key_exchange,omitempty"` // optional } +func (ks KeyShare) ToPrivate() keyShare { + return keyShare{group: ks.Group, data: ks.Data} +} + +func (ks keyShare) ToPublic() KeyShare { + return KeyShare{Group: ks.group, Data: ks.data} +} + type KeyShares []KeyShare type keyShares []keyShare func (kss keyShares) ToPublic() []KeyShare { var KSS []KeyShare for _, ks := range kss { - KSS = append(KSS, KeyShare{Data: ks.data, Group: ks.group}) + KSS = append(KSS, ks.ToPublic()) } return KSS } func (KSS KeyShares) ToPrivate() []keyShare { var kss []keyShare for _, KS := range KSS { - kss = append(kss, keyShare{data: KS.Data, group: KS.Group}) + kss = append(kss, KS.ToPrivate()) } return kss } @@ -854,14 +860,14 @@ func (TKS TicketKeys) ToPrivate() []ticketKey { } type kemPrivateKey struct { - secretKey kem.PrivateKey + secretKey any curveID CurveID } // Deprecated: Use KeySharePrivateKeys instead. This type is no longer used. // Will be removed in the future. type KemPrivateKey struct { - SecretKey kem.PrivateKey + SecretKey any CurveID CurveID } @@ -888,9 +894,10 @@ func (kpk *kemPrivateKey) ToPublic() *KemPrivateKey { } type KeySharePrivateKeys struct { - CurveID CurveID - Ecdhe *ecdh.PrivateKey - mlkem *mlkem.DecapsulationKey768 + CurveID CurveID + Ecdhe *ecdh.PrivateKey + Mlkem *mlkem.DecapsulationKey768 + MlkemEcdhe *ecdh.PrivateKey } func (ksp *KeySharePrivateKeys) ToPrivate() *keySharePrivateKeys { @@ -898,9 +905,10 @@ func (ksp *KeySharePrivateKeys) ToPrivate() *keySharePrivateKeys { return nil } return &keySharePrivateKeys{ - curveID: ksp.CurveID, - ecdhe: ksp.Ecdhe, - mlkem: ksp.mlkem, + curveID: ksp.CurveID, + ecdhe: ksp.Ecdhe, + mlkem: ksp.Mlkem, + mlkemEcdhe: ksp.MlkemEcdhe, } } @@ -909,8 +917,9 @@ func (ksp *keySharePrivateKeys) ToPublic() *KeySharePrivateKeys { return nil } return &KeySharePrivateKeys{ - CurveID: ksp.curveID, - Ecdhe: ksp.ecdhe, - mlkem: ksp.mlkem, + CurveID: ksp.curveID, + Ecdhe: ksp.ecdhe, + Mlkem: ksp.mlkem, + MlkemEcdhe: ksp.mlkemEcdhe, } } diff --git a/backend/vendor/github.com/refraction-networking/utls/u_tls_extensions.go b/backend/vendor/github.com/refraction-networking/utls/u_tls_extensions.go index 5b3a5b4..c03fdb6 100644 --- a/backend/vendor/github.com/refraction-networking/utls/u_tls_extensions.go +++ b/backend/vendor/github.com/refraction-networking/utls/u_tls_extensions.go @@ -71,6 +71,8 @@ func ExtensionFromID(id uint16) TLSExtension { return &NPNExtension{} case utlsExtensionApplicationSettings: return &ApplicationSettingsExtension{} + case utlsExtensionApplicationSettingsNew: + return &ApplicationSettingsExtensionNew{} case fakeOldExtensionChannelID: return &FakeChannelIDExtension{true} case fakeExtensionChannelID: @@ -197,7 +199,9 @@ func (e *SNIExtension) Write(b []byte) (int, error) { } func (e *SNIExtension) writeToUConn(uc *UConn) error { - uc.config.ServerName = e.ServerName + if uc.config.EncryptedClientHelloConfigList == nil { // with ech, e.ServerName is the outer public name and should not be copied + uc.config.ServerName = e.ServerName + } hostName := hostnameInSNI(e.ServerName) uc.HandshakeState.Hello.ServerName = hostName @@ -682,39 +686,39 @@ func (e *ALPNExtension) Write(b []byte) (int, error) { return fullLen, nil } -// ApplicationSettingsExtension represents the TLS ALPS extension. +// applicationSettingsExtension represents the TLS ALPS extension. // At the time of this writing, this extension is currently a draft: // https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01 -type ApplicationSettingsExtension struct { - SupportedProtocols []string +type applicationSettingsExtension struct { + codePoint uint16 } -func (e *ApplicationSettingsExtension) writeToUConn(uc *UConn) error { +func (e *applicationSettingsExtension) writeToUConn(uc *UConn) error { return nil } -func (e *ApplicationSettingsExtension) Len() int { +func (e *applicationSettingsExtension) Len(supportedProtocols []string) int { bLen := 2 + 2 + 2 // Type + Length + ALPS Extension length - for _, s := range e.SupportedProtocols { + for _, s := range supportedProtocols { bLen += 1 + len(s) // Supported ALPN Length + actual length of protocol } return bLen } -func (e *ApplicationSettingsExtension) Read(b []byte) (int, error) { - if len(b) < e.Len() { +func (e *applicationSettingsExtension) Read(b []byte, supportedProtocols []string) (int, error) { + if len(b) < e.Len(supportedProtocols) { return 0, io.ErrShortBuffer } // Read Type. - b[0] = byte(utlsExtensionApplicationSettings >> 8) // hex: 44 dec: 68 - b[1] = byte(utlsExtensionApplicationSettings & 0xff) // hex: 69 dec: 105 + b[0] = byte(e.codePoint >> 8) // hex: 44 dec: 68 + b[1] = byte(e.codePoint & 0xff) // hex: 69 dec: 105 lengths := b[2:] // get the remaining buffer without Type b = b[6:] // set the buffer to the buffer without Type, Length and ALPS Extension Length (so only the Supported ALPN list remains) stringsLength := 0 - for _, s := range e.SupportedProtocols { + for _, s := range supportedProtocols { l := len(s) // Supported ALPN Length b[0] = byte(l) // Supported ALPN Length in bytes hex: 02 dec: 2 copy(b[1:], s) // copy the Supported ALPN as bytes to the buffer @@ -728,7 +732,43 @@ func (e *ApplicationSettingsExtension) Read(b []byte) (int, error) { lengths[0] = byte(stringsLength >> 8) // Length hex:00 dec: 0 lengths[1] = byte(stringsLength) // Length hex: 05 dec: 5 - return e.Len(), io.EOF + return e.Len(supportedProtocols), io.EOF +} + +// Write implementation copied from ALPNExtension.Write +func (e *applicationSettingsExtension) Write(b []byte) ([]string, int, error) { + fullLen := len(b) + extData := cryptobyte.String(b) + // https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01 + var protoList cryptobyte.String + if !extData.ReadUint16LengthPrefixed(&protoList) || protoList.Empty() { + return nil, 0, errors.New("unable to read ALPN extension data") + } + alpnProtocols := []string{} + for !protoList.Empty() { + var proto cryptobyte.String + if !protoList.ReadUint8LengthPrefixed(&proto) || proto.Empty() { + return nil, 0, errors.New("unable to read ALPN extension data") + } + alpnProtocols = append(alpnProtocols, string(proto)) + + } + return alpnProtocols, fullLen, nil +} + +// ApplicationSettingsExtension embeds applicationSettingsExtension to implement the TLS ALPS extension on codepoint 17513 +type ApplicationSettingsExtension struct { + applicationSettingsExtension + SupportedProtocols []string +} + +func (e *ApplicationSettingsExtension) Len() int { + return e.applicationSettingsExtension.Len(e.SupportedProtocols) +} + +func (e *ApplicationSettingsExtension) Read(b []byte) (int, error) { + e.applicationSettingsExtension.codePoint = utlsExtensionApplicationSettings + return e.applicationSettingsExtension.Read(b, e.SupportedProtocols) } func (e *ApplicationSettingsExtension) UnmarshalJSON(b []byte) error { @@ -746,24 +786,51 @@ func (e *ApplicationSettingsExtension) UnmarshalJSON(b []byte) error { // Write implementation copied from ALPNExtension.Write func (e *ApplicationSettingsExtension) Write(b []byte) (int, error) { - fullLen := len(b) - extData := cryptobyte.String(b) - // https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps-01 - var protoList cryptobyte.String - if !extData.ReadUint16LengthPrefixed(&protoList) || protoList.Empty() { - return 0, errors.New("unable to read ALPN extension data") - } - alpnProtocols := []string{} - for !protoList.Empty() { - var proto cryptobyte.String - if !protoList.ReadUint8LengthPrefixed(&proto) || proto.Empty() { - return 0, errors.New("unable to read ALPN extension data") - } - alpnProtocols = append(alpnProtocols, string(proto)) + var ( + fullLen int + err error + ) + e.SupportedProtocols, fullLen, err = e.applicationSettingsExtension.Write(b) + return fullLen, err +} +// ApplicationSettingsExtensionNew embeds applicationSettingsExtension to implement the TLS ALPS extension on codepoint 17613 +// More information can be found here: https://chromestatus.com/feature/5149147365900288 +type ApplicationSettingsExtensionNew struct { + applicationSettingsExtension + SupportedProtocols []string +} + +func (e *ApplicationSettingsExtensionNew) Len() int { + return e.applicationSettingsExtension.Len(e.SupportedProtocols) +} + +func (e *ApplicationSettingsExtensionNew) Read(b []byte) (int, error) { + e.applicationSettingsExtension.codePoint = utlsExtensionApplicationSettingsNew + return e.applicationSettingsExtension.Read(b, e.SupportedProtocols) +} + +func (e *ApplicationSettingsExtensionNew) UnmarshalJSON(b []byte) error { + var applicationSettingsSupport struct { + SupportedProtocols []string `json:"supported_protocols"` } - e.SupportedProtocols = alpnProtocols - return fullLen, nil + + if err := json.Unmarshal(b, &applicationSettingsSupport); err != nil { + return err + } + + e.SupportedProtocols = applicationSettingsSupport.SupportedProtocols + return nil +} + +// Write implementation copied from ALPNExtension.Write +func (e *ApplicationSettingsExtensionNew) Write(b []byte) (int, error) { + var ( + fullLen int + err error + ) + e.SupportedProtocols, fullLen, err = e.applicationSettingsExtension.Write(b) + return fullLen, err } // SCTExtension implements signed_certificate_timestamp (18) @@ -1474,21 +1541,39 @@ func (e *CookieExtension) writeToUConn(uc *UConn) error { } func (e *CookieExtension) Len() int { - return 4 + len(e.Cookie) + // The total length of the Cookie extension is: + // 2 bytes for ExtensionType (extensionCookie) + // 2 bytes for OuterExtensionDataLength + // 2 bytes for InnerCookieLength (len(e.Cookie)) + // N bytes for the Cookie data itself (e.Cookie) + // So, total = 6 + len(e.Cookie) + return 6 + len(e.Cookie) } func (e *CookieExtension) Read(b []byte) (int, error) { + cookieLen := len(e.Cookie) + if len(b) < e.Len() { return 0, io.ErrShortBuffer } + // Extension type b[0] = byte(extensionCookie >> 8) b[1] = byte(extensionCookie) - b[2] = byte(len(e.Cookie) >> 8) - b[3] = byte(len(e.Cookie)) - if len(e.Cookie) > 0 { - copy(b[4:], e.Cookie) - } + + // Copied from BoringSSL https://boringssl.googlesource.com/boringssl.git/%2B/chromium-stable/ssl/extensions.cc#2465 + // Total extension_data length + extDataLen := 2 + cookieLen // 2 bytes for cookie length + cookie + b[2] = byte(extDataLen >> 8) + b[3] = byte(extDataLen) + + // Cookie length + b[4] = byte(cookieLen >> 8) + b[5] = byte(cookieLen) + + // Cookie value + copy(b[6:], e.Cookie) + return e.Len(), io.EOF } diff --git a/backend/vendor/modules.txt b/backend/vendor/modules.txt index c981b4b..a03a15a 100644 --- a/backend/vendor/modules.txt +++ b/backend/vendor/modules.txt @@ -115,48 +115,6 @@ github.com/charmbracelet/x/cellbuf # github.com/charmbracelet/x/term v0.2.1 ## explicit; go 1.18 github.com/charmbracelet/x/term -# github.com/cloudflare/circl v1.6.1 -## explicit; go 1.22.0 -github.com/cloudflare/circl/dh/x25519 -github.com/cloudflare/circl/dh/x448 -github.com/cloudflare/circl/ecc/goldilocks -github.com/cloudflare/circl/hpke -github.com/cloudflare/circl/internal/conv -github.com/cloudflare/circl/internal/sha3 -github.com/cloudflare/circl/kem -github.com/cloudflare/circl/kem/kyber/kyber768 -github.com/cloudflare/circl/kem/mlkem/mlkem768 -github.com/cloudflare/circl/kem/xwing -github.com/cloudflare/circl/math -github.com/cloudflare/circl/math/fp25519 -github.com/cloudflare/circl/math/fp448 -github.com/cloudflare/circl/math/mlsbset -github.com/cloudflare/circl/pke/kyber/internal/common -github.com/cloudflare/circl/pke/kyber/internal/common/params -github.com/cloudflare/circl/pke/kyber/kyber768 -github.com/cloudflare/circl/pke/kyber/kyber768/internal -github.com/cloudflare/circl/pki -github.com/cloudflare/circl/sign -github.com/cloudflare/circl/sign/dilithium/mode2 -github.com/cloudflare/circl/sign/dilithium/mode2/internal -github.com/cloudflare/circl/sign/dilithium/mode3 -github.com/cloudflare/circl/sign/dilithium/mode3/internal -github.com/cloudflare/circl/sign/dilithium/mode5 -github.com/cloudflare/circl/sign/dilithium/mode5/internal -github.com/cloudflare/circl/sign/ed25519 -github.com/cloudflare/circl/sign/ed448 -github.com/cloudflare/circl/sign/eddilithium2 -github.com/cloudflare/circl/sign/eddilithium3 -github.com/cloudflare/circl/sign/internal/dilithium -github.com/cloudflare/circl/sign/internal/dilithium/params -github.com/cloudflare/circl/sign/mldsa/mldsa44 -github.com/cloudflare/circl/sign/mldsa/mldsa44/internal -github.com/cloudflare/circl/sign/mldsa/mldsa65 -github.com/cloudflare/circl/sign/mldsa/mldsa65/internal -github.com/cloudflare/circl/sign/mldsa/mldsa87 -github.com/cloudflare/circl/sign/mldsa/mldsa87/internal -github.com/cloudflare/circl/sign/schemes -github.com/cloudflare/circl/simd/keccakf1600 # github.com/cloudwego/base64x v0.1.4 ## explicit; go 1.16 github.com/cloudwego/base64x @@ -430,8 +388,8 @@ github.com/pquerna/otp/totp # github.com/quic-go/qpack v0.5.1 ## explicit; go 1.22 github.com/quic-go/qpack -# github.com/refraction-networking/utls v1.7.0 -## explicit; go 1.24.0 +# github.com/refraction-networking/utls v1.8.2 +## explicit; go 1.24 github.com/refraction-networking/utls github.com/refraction-networking/utls/dicttls github.com/refraction-networking/utls/internal/boring