crypto_bigint/uint/boxed/
mul_mod.rs

1//! [`BoxedUint`] modular multiplication operations.
2
3use crate::{
4    div_limb::mul_rem,
5    modular::{BoxedMontyForm, BoxedMontyParams},
6    BoxedUint, Limb, MulMod, NonZero, Odd, WideWord, Word,
7};
8
9impl BoxedUint {
10    /// Computes `self * rhs mod p` for odd `p`.
11    ///
12    /// Panics if `p` is even.
13    // TODO(tarcieri): support for even `p`?
14    pub fn mul_mod(&self, rhs: &BoxedUint, p: &BoxedUint) -> BoxedUint {
15        // NOTE: the overhead of converting to Montgomery form to perform this operation and then
16        // immediately converting out of Montgomery form after just a single operation is likely to
17        // be higher than other possible implementations of this function, such as using a
18        // Barrett reduction instead.
19        //
20        // It's worth potentially exploring other approaches to improve efficiency.
21        match Odd::new(p.clone()).into() {
22            Some(p) => {
23                let params = BoxedMontyParams::new(p);
24                let lhs = BoxedMontyForm::new(self.clone(), params.clone());
25                let rhs = BoxedMontyForm::new(rhs.clone(), params);
26                let ret = lhs * rhs;
27                ret.retrieve()
28            }
29            None => todo!("even moduli are currently unsupported"),
30        }
31    }
32
33    /// Computes `self * rhs mod p` for the special modulus
34    /// `p = MAX+1-c` where `c` is small enough to fit in a single [`Limb`].
35    ///
36    /// For the modulus reduction, this function implements Algorithm 14.47 from
37    /// the "Handbook of Applied Cryptography", by A. Menezes, P. van Oorschot,
38    /// and S. Vanstone, CRC Press, 1996.
39    pub fn mul_mod_special(&self, rhs: &Self, c: Limb) -> Self {
40        debug_assert_eq!(self.bits_precision(), rhs.bits_precision());
41
42        // We implicitly assume `LIMBS > 0`, because `Uint<0>` doesn't compile.
43        // Still the case `LIMBS == 1` needs special handling.
44        if self.nlimbs() == 1 {
45            let reduced = mul_rem(
46                self.limbs[0],
47                rhs.limbs[0],
48                NonZero::<Limb>::new_unwrap(Limb(Word::MIN.wrapping_sub(c.0))),
49            );
50            return Self::from(reduced);
51        }
52
53        let product = self.mul(rhs);
54        let (lo_words, hi_words) = product.limbs.split_at(self.nlimbs());
55        let lo = BoxedUint::from(lo_words);
56        let hi = BoxedUint::from(hi_words);
57
58        // Now use Algorithm 14.47 for the reduction
59        let (lo, carry) = mac_by_limb(&lo, &hi, c, Limb::ZERO);
60
61        let (lo, carry) = {
62            let rhs = (carry.0 + 1) as WideWord * c.0 as WideWord;
63            lo.adc(&Self::from(rhs), Limb::ZERO)
64        };
65
66        let (lo, _) = {
67            let rhs = carry.0.wrapping_sub(1) & c.0;
68            lo.sbb(&Self::from(rhs), Limb::ZERO)
69        };
70
71        lo
72    }
73}
74
75impl MulMod for BoxedUint {
76    type Output = Self;
77
78    fn mul_mod(&self, rhs: &Self, p: &Self) -> Self {
79        self.mul_mod(rhs, p)
80    }
81}
82
83/// Computes `a + (b * c) + carry`, returning the result along with the new carry.
84fn mac_by_limb(a: &BoxedUint, b: &BoxedUint, c: Limb, carry: Limb) -> (BoxedUint, Limb) {
85    let mut a = a.clone();
86    let mut carry = carry;
87
88    for i in 0..a.nlimbs() {
89        let (n, c) = a.limbs[i].mac(b.limbs[i], c, carry);
90        a.limbs[i] = n;
91        carry = c;
92    }
93
94    (a, carry)
95}
96
97#[cfg(all(test, feature = "rand"))]
98mod tests {
99    use crate::{Limb, NonZero, Random, RandomMod, Uint};
100    use rand_core::SeedableRng;
101
102    macro_rules! test_mul_mod_special {
103        ($size:expr, $test_name:ident) => {
104            #[test]
105            fn $test_name() {
106                let mut rng = rand_chacha::ChaCha8Rng::seed_from_u64(1);
107                let moduli = [
108                    NonZero::<Limb>::random(&mut rng),
109                    NonZero::<Limb>::random(&mut rng),
110                ];
111
112                for special in &moduli {
113                    let p =
114                        &NonZero::new(Uint::ZERO.wrapping_sub(&Uint::from(special.get()))).unwrap();
115
116                    let minus_one = p.wrapping_sub(&Uint::ONE);
117
118                    let base_cases = [
119                        (Uint::ZERO, Uint::ZERO, Uint::ZERO),
120                        (Uint::ONE, Uint::ZERO, Uint::ZERO),
121                        (Uint::ZERO, Uint::ONE, Uint::ZERO),
122                        (Uint::ONE, Uint::ONE, Uint::ONE),
123                        (minus_one, minus_one, Uint::ONE),
124                        (minus_one, Uint::ONE, minus_one),
125                        (Uint::ONE, minus_one, minus_one),
126                    ];
127                    for (a, b, c) in &base_cases {
128                        let x = a.mul_mod_special(&b, *special.as_ref());
129                        assert_eq!(*c, x, "{} * {} mod {} = {} != {}", a, b, p, x, c);
130                    }
131
132                    for _i in 0..100 {
133                        let a = Uint::<$size>::random_mod(&mut rng, p);
134                        let b = Uint::<$size>::random_mod(&mut rng, p);
135
136                        let c = a.mul_mod_special(&b, *special.as_ref());
137                        assert!(c < **p, "not reduced: {} >= {} ", c, p);
138
139                        let expected = {
140                            let (lo, hi) = a.split_mul(&b);
141                            let mut prod = Uint::<{ 2 * $size }>::ZERO;
142                            prod.limbs[..$size].clone_from_slice(&lo.limbs);
143                            prod.limbs[$size..].clone_from_slice(&hi.limbs);
144                            let mut modulus = Uint::ZERO;
145                            modulus.limbs[..$size].clone_from_slice(&p.as_ref().limbs);
146                            let reduced = prod.rem_vartime(&NonZero::new(modulus).unwrap());
147                            let mut expected = Uint::ZERO;
148                            expected.limbs[..].clone_from_slice(&reduced.limbs[..$size]);
149                            expected
150                        };
151                        assert_eq!(c, expected, "incorrect result");
152                    }
153                }
154            }
155        };
156    }
157
158    test_mul_mod_special!(1, mul_mod_special_1);
159    test_mul_mod_special!(2, mul_mod_special_2);
160    test_mul_mod_special!(3, mul_mod_special_3);
161    test_mul_mod_special!(4, mul_mod_special_4);
162    test_mul_mod_special!(5, mul_mod_special_5);
163    test_mul_mod_special!(6, mul_mod_special_6);
164    test_mul_mod_special!(7, mul_mod_special_7);
165    test_mul_mod_special!(8, mul_mod_special_8);
166    test_mul_mod_special!(9, mul_mod_special_9);
167    test_mul_mod_special!(10, mul_mod_special_10);
168    test_mul_mod_special!(11, mul_mod_special_11);
169    test_mul_mod_special!(12, mul_mod_special_12);
170}
crypto_bigint/uint/boxed/mul_mod.rs

crypto_bigint/uint/boxed/
mul_mod.rs
