/*

* Copyright (c) 2014 - 2020 The GmSSL Project. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

*

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

*

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in

* the documentation and/or other materials provided with the

* distribution.

*

* 3. All advertising materials mentioning features or use of this

* software must display the following acknowledgment:

* "This product includes software developed by the GmSSL Project.

* (http://gmssl.org/)"

*

* 4. The name "GmSSL Project" must not be used to endorse or promote

* products derived from this software without prior written

* permission. For written permission, please contact

* guanzhi1980@gmail.com.

*

* 5. Products derived from this software may not be called "GmSSL"

* nor may "GmSSL" appear in their names without prior written

* permission of the GmSSL Project.

*

* 6. Redistributions of any form whatsoever must retain the following

* acknowledgment:

* "This product includes software developed by the GmSSL Project

* (http://gmssl.org/)"

*

* THIS SOFTWARE IS PROVIDED BY THE GmSSL PROJECT ``AS IS'' AND ANY

* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE GmSSL PROJECT OR

* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

* OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include <stdio.h>

#include <string.h>

#include <stdint.h>

#include <stdlib.h>

#include <assert.h>

#include <gmssl/hex.h>

#include "endian.h"

typedef uint64_t sm9_bn_t[8];

typedef sm9_bn_t sm9_fp_t;

typedef sm9_bn_t sm9_fn_t;

typedef uint64_t sm9_barrett_bn_t[9];

typedef sm9_fp_t sm9_fp2_t[2];

typedef sm9_fp2_t sm9_fp4_t[2];

typedef sm9_fp4_t sm9_fp12_t[3];

static const sm9_bn_t ZERO = {0,0,0,0,0,0,0,0};

static const sm9_bn_t ONE = {1,0,0,0,0,0,0,0};

static const sm9_bn_t TWO = {2,0,0,0,0,0,0,0};

static const sm9_bn_t FIVE = {5,0,0,0,0,0,0,0};

// p = b640000002a3a6f1d603ab4ff58ec74521f2934b1a7aeedbe56f9b27e351457d

// n = b640000002a3a6f1d603ab4ff58ec74449f2934b18ea8beee56ee19cd69ecf25

// mu = 2^512 // p = 167980e0beb5759a655f73aebdcd1312af2665f6d1e36081c71188f90d5c22146

static const sm9_bn_t SM9_P = {0xe351457d, 0xe56f9b27, 0x1a7aeedb, 0x21f2934b, 0xf58ec745, 0xd603ab4f, 0x02a3a6f1, 0xb6400000};

static const sm9_bn_t SM9_P_MINUS_ONE = {0xe351457c, 0xe56f9b27, 0x1a7aeedb, 0x21f2934b, 0xf58ec745, 0xd603ab4f, 0x02a3a6f1, 0xb6400000};

static const sm9_bn_t SM9_N = {0xd69ecf25, 0xe56ee19c, 0x18ea8bee, 0x49f2934b, 0xf58ec744, 0xd603ab4f, 0x02a3a6f1, 0xb6400000};

static const sm9_bn_t SM9_MU = {0xd5c22146, 0x71188f90, 0x1e36081c, 0xf2665f6d, 0xdcd1312a, 0x55f73aeb, 0xeb5759a6, 0x167980e0b};

typedef struct {

sm9_fp_t X;

sm9_fp_t Y;

sm9_fp_t Z;

} sm9_point_t;

// P1.X 0x93DE051D62BF718FF5ED0704487D01D6E1E4086909DC3280E8C4E4817C66DDDD

// P1.Y 0x21FE8DDA4F21E607631065125C395BBC1C1C00CBFA6024350C464CD70A3EA616

static const sm9_point_t _SM9_P1 = {

{0x7c66dddd, 0xe8c4e481, 0x09dc3280, 0xe1e40869, 0x487d01d6, 0xf5ed0704, 0x62bf718f, 0x93de051d},

{0x0a3ea616, 0x0c464cd7, 0xfa602435, 0x1c1c00cb, 0x5c395bbc, 0x63106512, 0x4f21e607, 0x21fe8dda},

{1,0,0,0,0,0,0,0}

};

static const sm9_point_t *SM9_P1 = &_SM9_P1;

typedef struct {

sm9_fp2_t X;

sm9_fp2_t Y;

sm9_fp2_t Z;

} sm9_twist_point_t;

/*

X : [0x3722755292130b08d2aab97fd34ec120ee265948d19c17abf9b7213baf82d65bn,

0x85aef3d078640c98597b6027b441a01ff1dd2c190f5e93c454806c11d8806141n],

Y : [0xa7cf28d519be3da65f3170153d278ff247efba98a71a08116215bba5c999a7c7n,

0x17509b092e845c1266ba0d262cbee6ed0736a96fa347c8bd856dc76b84ebeb96n],

Z : [1n, 0n],

*/

static const sm9_twist_point_t _SM9_P2 = {

{{0xAF82D65B, 0xF9B7213B, 0xD19C17AB, 0xEE265948, 0xD34EC120, 0xD2AAB97F, 0x92130B08, 0x37227552},

{0xD8806141, 0x54806C11, 0x0F5E93C4, 0xF1DD2C19, 0xB441A01F, 0x597B6027, 0x78640C98, 0x85AEF3D0}},

{{0xC999A7C7, 0x6215BBA5, 0xA71A0811, 0x47EFBA98, 0x3D278FF2, 0x5F317015, 0x19BE3DA6, 0xA7CF28D5},

{0x84EBEB96, 0x856DC76B, 0xA347C8BD, 0x0736A96F, 0x2CBEE6ED, 0x66BA0D26, 0x2E845C12, 0x17509B09}},

{{1,0,0,0,0,0,0,0}, {0,0,0,0,0,0,0,0}},

};

static const sm9_twist_point_t *SM9_P2 = &_SM9_P2;

static const sm9_twist_point_t _SM9_Ppubs = {

{{0x96EA5E32, 0x8F14D656, 0x386A92DD, 0x414D2177, 0x24A3B573, 0x6CE843ED, 0x152D1F78, 0x29DBA116},

{0x1B94C408, 0x0AB1B679, 0x5E392CFB, 0x1CE0711C, 0x41B56501, 0xE48AFF4B, 0x3084F733, 0x9F64080B}},

{{0xB4E3216D, 0x0E75C05F, 0x5CDFF073, 0x1006E85F, 0xB7A46F74, 0x1A7CE027, 0xDDA532DA, 0x41E00A53},

{0xD0EF1C25, 0xE89E1408, 0x1A77F335, 0xAD3E2FDB, 0x47E3A0CB, 0xB57329F4, 0xABEA0112, 0x69850938}},

{{1,0,0,0,0,0,0,0}, {0,0,0,0,0,0,0,0}},

};

static const sm9_twist_point_t *SM9_Ppubs = &_SM9_Ppubs;

#define sm9_bn_init(r) memset((r),0,sizeof(sm9_bn_t))

#define sm9_bn_clean(r) memset((r),0,sizeof(sm9_bn_t))

#define sm9_bn_set_zero(r) memset((r),0,sizeof(sm9_bn_t))

#define sm9_bn_set_one(r) memcpy((r),&ONE,sizeof(sm9_bn_t))

#define sm9_bn_copy(r,a) memcpy((r),(a),sizeof(sm9_bn_t))

#define sm9_bn_is_zero(a) (memcmp((a),&ZERO, sizeof(sm9_bn_t)) == 0)

#define sm9_bn_is_one(a) (memcmp((a),&ONE, sizeof(sm9_bn_t)) == 0)

static void sm9_bn_to_bytes(const sm9_bn_t a, uint8_t out[32])

{

int i;

for (i = 7; i >= 0; i--) {

PUTU32(out, (uint32_t)a[i]);

out += sizeof(uint32_t);

}

}

static void sm9_bn_from_bytes(sm9_bn_t r, const uint8_t in[32])

{

int i;

for (i = 7; i >= 0; i--) {

r[i] = GETU32(in);

in += sizeof(uint32_t);

}

}

static int sm9_bn_from_hex(sm9_bn_t r, const char hex[65])

{

uint8_t buf[32];

size_t len;

if (hex_to_bytes(hex, 64, buf, &len) < 0) {

return -1;

}

sm9_bn_from_bytes(r, buf);

return 0;

}

static void sm9_bn_to_hex(const sm9_bn_t a, char hex[65])

{

int i;

for (i = 7; i >= 0; i--) {

(void)sprintf(hex, "%08x", (uint32_t)a[i]);

hex += 8;

}

hex[64] = '0';

}

static void sm9_print_bn(const char *prefix, const sm9_bn_t a)

{

char hex[65];

sm9_bn_to_hex(a, hex);

printf("%s\n%s\n", prefix, hex);

}

static void sm9_bn_to_bits(const sm9_bn_t a, char bits[256])

{

int i, j;

for (i = 7; i >= 0; i--) {

uint32_t w = a[i];

for (j = 0; j < 32; j++) {

*bits++ = (w & 0x80000000) ? '1' : '0';

w <<= 1;

}

}

}

static int sm9_bn_cmp(const sm9_bn_t a, const sm9_bn_t b)

{

int i;

for (i = 7; i >= 0; i--) {

if (a[i] > b[i])

return 1;

if (a[i] < b[i])

return -1;

}

return 0;

}

static int sm9_bn_equ_hex(const sm9_bn_t a, const char *hex)

{

sm9_bn_t b;

sm9_bn_from_hex(b, hex);

return (sm9_bn_cmp(a, b) == 0);

}

static void sm9_bn_set_word(sm9_bn_t r, uint32_t a)

{

sm9_bn_set_zero(r);

r[0] = a;

}

static void sm9_bn_add(sm9_bn_t r, const sm9_bn_t a, const sm9_bn_t b)

{

int i;

r[0] = a[0] + b[0];

for (i = 1; i < 8; i++) {

r[i] = a[i] + b[i] + (r[i-1] >> 32);

}

for (i = 0; i < 7; i++) {

r[i] &= 0xffffffff;

}

}

static void sm9_bn_sub(sm9_bn_t ret, const sm9_bn_t a, const sm9_bn_t b)

{

int i;

sm9_bn_t r;

r[0] = ((uint64_t)1 << 32) + a[0] - b[0];

for (i = 1; i < 7; i++) {

r[i] = 0xffffffff + a[i] - b[i] + (r[i - 1] >> 32);

r[i - 1] &= 0xffffffff;

}

r[i] = a[i] - b[i] + (r[i - 1] >> 32) - 1;

r[i - 1] &= 0xffffffff;

sm9_bn_copy(ret, r);

}

static void sm9_bn_rand_range(sm9_bn_t r, const sm9_bn_t range)

{

FILE *fp;

uint8_t buf[256];

fp = fopen("/dev/urandom", "rb");

do {

fread(buf, 1, 256, fp);

sm9_bn_from_bytes(r, buf);

} while (sm9_bn_cmp(r, range) >= 0);

fclose(fp);

}

#define sm9_fp_init(a) sm9_bn_init(a)

#define sm9_fp_clean(a) sm9_bn_clean(a)

#define sm9_fp_is_zero(a) sm9_bn_is_zero(a)

#define sm9_fp_is_one(a) sm9_bn_is_one(a)

#define sm9_fp_set_zero(a) sm9_bn_set_zero(a)

#define sm9_fp_set_one(a) sm9_bn_set_one(a)

#define sm9_fp_from_hex(a,s) sm9_bn_from_hex((a),(s))

#define sm9_fp_to_hex(a,s) sm9_bn_to_hex((a),(s))

#define sm9_fp_copy(r,a) sm9_bn_copy((r),(a))

static int sm9_fp_equ(const sm9_fp_t a, const sm9_fp_t b)

{

int i;

for (i = 0; i < 8; i++) {

if (a[i] != b[i])

return 0;

}

return 1;

}

static void sm9_fp_add(sm9_fp_t r, const sm9_fp_t a, const sm9_fp_t b)

{

sm9_bn_add(r, a, b);

if (sm9_bn_cmp(r, SM9_P) >= 0)

return sm9_bn_sub(r, r, SM9_P);

}

static void sm9_fp_sub(sm9_fp_t r, const sm9_fp_t a, const sm9_fp_t b)

{

if (sm9_bn_cmp(a, b) >= 0) {

sm9_bn_sub(r, a, b);

} else {

sm9_bn_t t;

sm9_bn_sub(t, SM9_P, b);

sm9_bn_add(r, t, a);

}

}

static void sm9_fp_dbl(sm9_fp_t r, const sm9_fp_t a)

{

sm9_fp_add(r, a, a);

}

static void sm9_fp_tri(sm9_fp_t r, const sm9_fp_t a)

{

sm9_fp_t t;

sm9_fp_dbl(t, a);

sm9_fp_add(r, t, a);

}

static void fp_div2(sm9_fp_t r, const sm9_fp_t a)

{

int i;

sm9_bn_copy(r, a);

if (r[0] & 0x01) {

sm9_bn_add(r, r, SM9_P);

}

for (i = 0; i < 7; i++) {

r[i] = (r[i] >> 1) | ((r[i + 1] & 0x01) << 31);

}

r[i] >>= 1;

}

static void sm9_fp_neg(sm9_fp_t r, const sm9_fp_t a)

{

if (sm9_bn_is_zero(a)) {

sm9_bn_copy(r, a);

} else {

sm9_bn_sub(r, SM9_P, a);

}

}

static int sm9_barrett_bn_cmp(const sm9_barrett_bn_t a, const sm9_barrett_bn_t b)

{

int i;

for (i = 8; i >= 0; i--) {

if (a[i] > b[i])

return 1;

if (a[i] < b[i])

return -1;

}

return 0;

}

static void sm9_barrett_bn_add(sm9_barrett_bn_t r, const sm9_barrett_bn_t a, const sm9_barrett_bn_t b)

{

int i;

r[0] = a[0] + b[0];

for (i = 1; i < 9; i++) {

r[i] = a[i] + b[i] + (r[i-1] >> 32);

}

for (i = 0; i < 8; i++) {

r[i] &= 0xffffffff;

}

}

static void sm9_barrett_bn_sub(sm9_barrett_bn_t ret, const sm9_barrett_bn_t a, const sm9_barrett_bn_t b)

{

sm9_barrett_bn_t r;

int i;

r[0] = ((uint64_t)1 << 32) + a[0] - b[0];

for (i = 1; i < 8; i++) {

r[i] = 0xffffffff + a[i] - b[i] + (r[i - 1] >> 32);

r[i - 1] &= 0xffffffff;

}

r[i] = a[i] - b[i] + (r[i - 1] >> 32) - 1;

r[i - 1] &= 0xffffffff;

for (i = 0; i < 9; i++) {

ret[i] = r[i];

}

}

static void sm9_fp_mul(sm9_fp_t r, const sm9_fp_t a, const sm9_fp_t b)

{

uint64_t s[17];

sm9_barrett_bn_t zh, zl, q;

uint64_t w;

int i, j;

/* z = a * b */

for (i = 0; i < 8; i++) {

s[i] = 0;

}

for (i = 0; i < 8; i++) {

w = 0;

for (j = 0; j < 8; j++) {

w += s[i + j] + a[i] * b[j];

s[i + j] = w & 0xffffffff;

w >>= 32;

}

s[i + 8] = w;

}

/* zl = z mod (2^32)^9 = z[0..8]

* zh = z // (2^32)^7 = z[7..15] */

for (i = 0; i < 9; i++) {

zl[i] = s[i];

zh[i] = s[7 + i];

}

/* q = zh * mu // (2^32)^9 */

for (i = 0; i < 9; i++) {

s[i] = 0;

}

for (i = 0; i < 9; i++) {

w = 0;

for (j = 0; j < 8; j++) {

w += s[i + j] + zh[i] * SM9_MU[j];

s[i + j] = w & 0xffffffff;

w >>= 32;

}

s[i + 8] = w;

}

for (i = 0; i < 8; i++) {

q[i] = s[9 + i];

}

/* q = q * n mod (2^32)^9 */

for (i = 0; i < 8; i++) {

s[i] = 0;

}

for (i = 0; i < 8; i++) {

w = 0;

for (j = 0; j < 8; j++) {

w += s[i + j] + q[i] * SM9_N[j];

s[i + j] = w & 0xffffffff;

w >>= 32;

}

s[i + 8] = w;

}

for (i = 0; i < 9; i++) {

q[i] = s[i];

}

/* r = zl - q (mod (2^32)^9) */

if (sm9_barrett_bn_cmp(zl, q)) {

sm9_barrett_bn_sub(zl, zl, q);

} else {

sm9_barrett_bn_t c = {0,0,0,0,0,0,0,0,0x100000000};

sm9_barrett_bn_sub(q, c, q);

sm9_barrett_bn_add(zl, q, zl);

}

for (i = 0; i < 8; i++) {

r[i] = zl[i];

}

r[7] += zl[8] << 32;

/* while r >= p do: r = r - n */

while (sm9_bn_cmp(r, SM9_N) >= 0) {

sm9_bn_sub(r, r, SM9_N);

}

}

static void sm9_fp_sqr(sm9_fp_t r, const sm9_fp_t a)

{

sm9_fp_mul(r, a, a);

}

static void sm9_fp_pow(sm9_fp_t r, const sm9_fp_t a, const sm9_bn_t e)

{

sm9_fp_t t;

uint32_t w;

int i, j;

assert(sm9_bn_cmp(e, SM9_P_MINUS_ONE) < 0);

sm9_bn_set_one(t);

for (i = 7; i >= 0; i--) {

w = (uint32_t)e[i];

for (j = 0; j < 32; j++) {

fp_sqr(t, t);

if (w & 0x80000000)

fp_mul(t, t, a);

w <<= 1;

}

}

sm9_bn_copy(r, t);

}

static void fp_inv(sm9_fp_t r, const sm9_fp_t a)

{

sm9_fp_t e;

sm9_bn_sub(e, SM9_P, TWO);

sm9_fp_pow(r, a, e);

}

static void fn_add(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)

{

}

static void fn_sub(sm9_fn_t r, const sm9_fn_t a, const sm9_fn_t b)

{

}

static void fn_neg(sm9_fn_t r, const sm9_fn_t a)

{

}

static void fn_inv(sm9_fn_t r, const sm9_fn_t a)

{

}

static const sm9_fp2_t FP2_ZERO = {{0,0,0,0,0,0,0,0},{0,0,0,0,0,0,0,0}};

static const sm9_fp2_t FP2_ONE = {{1,0,0,0,0,0,0,0},{0,0,0,0,0,0,0,0}};

static const sm9_fp2_t FP2_U = {{0,0,0,0,0,0,0,0},{1,0,0,0,0,0,0,0}};

static const sm9_fp2_t FP2_5U = {{0,0,0,0,0,0,0,0},{5,0,0,0,0,0,0,0}};

#define sm9_fp2_init(a) memset((a), 0, sizeof(sm9_fp2_t))

#define sm9_fp2_clean(a) memset((a), 0, sizeof(sm9_fp2_t))

#define sm9_fp2_is_zero(a) (memcmp((a), &FP2_ZERO, sizeof(sm9_fp2_t)) == 0)

#define sm9_fp2_is_one(a) (memcmp((a), &FP2_ONE, sizeof(sm9_fp2_t)) == 0)

#define sm9_fp2_copy(r,a) memcpy((r), (a), sizeof(sm9_fp2_t))

#define sm9_fp2_equ(a,b) (memcmp((a),(b),sizeof(sm9_fp2_t)) == 0)

static void sm9_fp2_from_hex(sm9_fp2_t r, const char hex[65 * 2])

{

sm9_fp_from_hex(r[1], hex);

sm9_fp_from_hex(r[0], hex + 65);

}

static void sm9_fp2_to_hex(const sm9_fp2_t a, char hex[65 * 2])

{

sm9_fp_to_hex(a[1], hex);

hex[64] = '\n';

sm9_fp_to_hex(a[0], hex + 65);

}

static void sm9_fp2_print(const char *prefix, const sm9_fp2_t a)

{

char hex[65 * 2];

sm9_fp2_to_hex(a, hex);

printf("%s\n%s\n", prefix, hex);

}

#define sm9_fp2_set_zero(a) memset((a), 0, sizeof(sm9_fp2_t))

#define sm9_fp2_set_one(a) memcpy((a), &FP2_ONE, sizeof(sm9_fp2_t))

static void sm9_fp2_set_fp(sm9_fp2_t r, const sm9_fp_t a)

{

sm9_fp_copy(r[0], a);

sm9_fp_set_zero(r[1]);

}

#define sm9_fp2_set_u(a) memcpy((a), &FP2_U, sizeof(sm9_fp2_t))

static void sm9_fp2_set(sm9_fp2_t r, const sm9_fp_t a0, const sm9_fp_t a1)

{

sm9_fp_copy(r[0], a0);

sm9_fp_copy(r[1], a1);

}

static void sm9_fp2_add(sm9_fp2_t r, const sm9_fp2_t a, const sm9_fp2_t b)

{

sm9_fp_add(r[0], a[0], b[0]);

sm9_fp_add(r[1], a[1], b[1]);

}

static void sm9_fp2_dbl(sm9_fp2_t r, const sm9_fp2_t a)

{

sm9_fp_dbl(r[0], a[0]);

sm9_fp_dbl(r[1], a[1]);

}

static void sm9_fp2_tri(sm9_fp2_t r, const sm9_fp2_t a)

{

sm9_fp_tri(r[0], a[0]);

sm9_fp_tri(r[1], a[1]);

}

static void sm9_fp2_sub(sm9_fp2_t r, const sm9_fp2_t a, const sm9_fp2_t b)

{

sm9_fp_sub(r[0], a[0], b[0]);

sm9_fp_sub(r[1], a[1], b[1]);

}

static void sm9_fp2_neg(sm9_fp2_t r, const sm9_fp2_t a)

{

sm9_fp_neg(r[0], a[0]);

sm9_fp_neg(r[1], a[1]);

}

static void sm9_fp2_mul(sm9_fp2_t r, const sm9_fp2_t a, const sm9_fp2_t b)

{

sm9_fp_t r0, r1, t;

// r0 = a0 * b0 - 2 * a1 * b1

sm9_fp_mul(r0, a[0], b[0]);

sm9_fp_mul(t, a[1], b[1]);

sm9_fp_dbl(t, t);

sm9_fp_sub(r0, r0, t);

// r1 = a0 * b1 + a1 * b0

sm9_fp_mul(r1, a[0], b[1]);

sm9_fp_mul(t, a[1], b[0]);

sm9_fp_add(r1, r1, t);

sm9_fp_copy(r[0], r0);

sm9_fp_copy(r[1], r1);

}

static void sm9_fp2_mul_u(sm9_fp2_t r, const sm9_fp2_t a, const sm9_fp2_t b)

{

sm9_fp_t r0, r1, t;

// r0 = -2 * (a0 * b1 + a1 * b0)

sm9_fp_mul(r0, a[0], b[1]);

sm9_fp_mul(t, a[1], b[0]);

sm9_fp_add(r0, r0, t);

sm9_fp_dbl(r0, r0);

sm9_fp_neg(r0, r0);

// r1 = a0 * b0 - 2 * a1 * b1

sm9_fp_mul(r1, a[0], b[0]);

sm9_fp_mul(t, a[1], b[1]);

sm9_fp_dbl(t, t);

sm9_fp_sub(r1, r1, t);

sm9_fp_copy(r[0], r0);

sm9_fp_copy(r[1], r1);

}

static void sm9_fp2_mul_fp(sm9_fp2_t r, const sm9_fp2_t a, const sm9_fp_t k)

{

sm9_fp_mul(r[0], a[0], k);

sm9_fp_mul(r[1], a[1], k);

}

static void sm9_fp2_sqr(sm9_fp2_t r, const sm9_fp2_t a)

{

sm9_fp_t r0, r1, t;

// a0^2 - 2 * a1^2

sm9_fp_sqr(r0, a[0]);

sm9_fp_sqr(t, a[1]);

sm9_fp_dbl(t, t);

sm9_fp_sub(r0, r0, t);

// r1 = 2 * a0 * a1

sm9_fp_mul(r1, a[0], a[1]);

sm9_fp_dbl(r1, r1);

sm9_bn_copy(r[0], r0);

sm9_bn_copy(r[1], r1);

}

static void sm9_fp2_sqr_u(sm9_fp2_t r, const sm9_fp2_t a)

{

sm9_fp_t r0, r1, t;

// r0 = -4 * a0 * a1

sm9_fp_mul(r0, a[0], a[1]);

sm9_fp_dbl(r0, r0);

sm9_fp_dbl(r0, r0);

sm9_fp_neg(r0, r0);

// r1 = a0^2 - 2 * a1^2

sm9_fp_sqr(r1, a[0]);

sm9_fp_sqr(t, a[1]);

sm9_fp_dbl(t, t);

sm9_fp_sub(r1, r1, t);

sm9_fp_copy(r[0], r0);

sm9_fp_copy(r[1], r1);

}

static void sm9_fp2_inv(sm9_fp2_t r, const sm9_fp2_t a)

{

if (sm9_fp_is_zero(a[0])) {

// r0 = 0

sm9_fp_set_zero(r[0]);

// r1 = -(2 * a1)^-1

sm9_fp_dbl(r[1], a[1]);

sm9_fp_inv(r[1], r[1]);

sm9_fp_neg(r[1], r[1]);

} else if (sm9_fp_is_zero(a[1])) {

/* r1 = 0 */

sm9_fp_set_zero(r[1]);

/* r0 = a0^-1 */

sm9_fp_inv(r[0], a[0]);

} else {

sm9_fp_t k, t;

// k = (a[0]^2 + 2 * a[1]^2)^-1

sm9_fp_sqr(k, a[0]);

sm9_fp_sqr(t, a[1]);

sm9_fp_dbl(t, t);

sm9_fp_add(k, k, t);

sm9_fp_inv(k, k);

// r[0] = a[0] * k

sm9_fp_mul(r[0], a[0], k);

// r[1] = -a[1] * k

sm9_fp_mul(r[1], a[1], k);

sm9_fp_neg(r[1], r[1]);

}

}

static void sm9_fp2_div(sm9_fp2_t r, const sm9_fp2_t a, const sm9_fp2_t b)

{

sm9_fp2_t t;

sm9_fp2_inv(t, b);

sm9_fp2_mul(r, a, t);

}

static void sm9_fp2_div2(sm9_fp2_t r, const sm9_fp2_t a)

{

sm9_fp_div2(r[0], a[0]);

sm9_fp_div2(r[1], a[1]);

}

static const sm9_fp4_t FP4_ZERO = {{{0,0,0,0,0,0,0,0},{0,0,0,0,0,0,0,0}}, {{0,0,0,0,0,0,0,0},{0,0,0,0,0,0,0,0}}};

static const sm9_fp4_t FP4_ONE = {{{1,0,0,0,0,0,0,0},{0,0,0,0,0,0,0,0}}, {{0,0,0,0,0,0,0,0},{0,0,0,0,0,0,0,0}}};

static const sm9_fp4_t FP4_U = {{{0,0,0,0,0,0,0,0},{1,0,0,0,0,0,0,0}}, {{0,0,0,0,0,0,0,0},{0,0,0,0,0,0,0,0}}};

static const sm9_fp4_t FP4_V = {{{0,0,0,0,0,0,0,0},{0,0,0,0,0,0,0,0}}, {{1,0,0,0,0,0,0,0},{0,0,0,0,0,0,0,0}}};

#define sm9_fp4_init(r) memcpy((r), &FP4_ZERO, sizeof(sm9_fp4_t))

#define sm9_fp4_clean(r) memcpy((r), &FP4_ZERO, sizeof(sm9_fp4_t))

#define sm9_fp4_set_zero(r) memcpy((r), &FP4_ZERO, sizeof(sm9_fp4_t))

#define sm9_fp4_set_one(r) memcpy((r), &FP4_ONE, sizeof(sm9_fp4_t))

#define sm9_fp4_is_zero(a) (memcmp((a), &FP4_ZERO, sizeof(sm9_fp4_t)) == 0)

#define sm9_fp4_is_one(a) (memcmp((a), &FP4_ONE, sizeof(sm9_fp4_t)) == 0)

#define sm9_fp4_equ(a,b) (memcmp((a), (b), sizeof(sm9_fp4_t)) == 0)

#define sm9_fp4_copy(r,a) memcpy((r), (a), sizeof(sm9_fp4_t))

static void sm9_fp4_from_hex(sm9_fp4_t r, const char hex[65 * 4])

{

fp2_from_hex(r[1], hex);

fp2_from_hex(r[0], hex + 65 * 2);

}

static void sm9_fp4_to_hex(const sm9_fp4_t a, char hex[65 * 4])

{

sm9_fp2_to_hex(a[1], hex);

hex[65 + 64] = '\n';

sm9_fp2_to_hex(a[0], hex + 65 * 2);

}

static void sm9_fp4_set_fp(sm9_fp4_t r, const sm9_fp_t a)

{

sm9_fp2_set_fp(r[0], a);

sm9_fp2_set_zero(r[1]);

}

static void sm9_fp4_set_fp2(sm9_fp4_t r, const sm9_fp2_t a)

{

sm9_fp2_copy(r[0], a);

sm9_fp2_set_zero(r[1]);

}

static void sm9_fp4_set(sm9_fp4_t r, const sm9_fp2_t a0, const sm9_fp2_t a1)

{

sm9_fp2_copy(r[0], a0);

sm9_fp2_copy(r[1], a1);

}

/*

static void fp4_set_one(sm9_fp4_t r)

{

fp2_set_one(r[0]);

fp2_set_zero(r[1]);

}

*/

static void sm9_fp4_set_u(sm9_fp4_t r)

{

sm9_fp2_set_u(r[0]);

sm9_fp2_set_zero(r[1]);

}

static void sm9_fp4_set_v(sm9_fp4_t r)

{

sm9_fp2_set_zero(r[0]);

sm9_fp2_set_one(r[1]);

}

static void fp4_add(sm9_fp4_t r, const sm9_fp4_t a, const sm9_fp4_t b)

{

sm9_fp2_add(r[0], a[0], b[0]);

sm9_fp2_add(r[1], a[1], b[1]);

}

static void sm9_fp4_dbl(sm9_fp4_t r, const sm9_fp4_t a)

{

sm9_fp2_dbl(r[0], a[0]);

sm9_fp2_dbl(r[1], a[1]);

}

static void fp4_sub(sm9_fp4_t r, const sm9_fp4_t a, const sm9_fp4_t b)

{

sm9_fp2_sub(r[0], a[0], b[0]);

sm9_fp2_sub(r[1], a[1], b[1]);

}

static void fp4_neg(sm9_fp4_t r, const sm9_fp4_t a)

{

sm9_fp2_neg(r[0], a[0]);

sm9_fp2_neg(r[1], a[1]);

}

static void sm9_fp4_mul(sm9_fp4_t r, const sm9_fp4_t a, const sm9_fp4_t b)

{

sm9_fp2_t r0, r1, t;

sm9_fp2_mul(r0, a[0], b[0]);

sm9_fp2_mul_u(t, a[1], b[1]);

sm9_fp2_add(r0, r0, t);

sm9_fp2_mul(r1, a[0], b[1]);

sm9_fp2_mul(t, a[1], b[0]);

sm9_fp2_add(r1, r1, t);

sm9_fp2_copy(r[0], r0);

sm9_fp2_copy(r[1], r1);

}

static void sm9_fp4_mul_fp(sm9_fp4_t r, const sm9_fp4_t a, const sm9_fp_t k)

{

sm9_fp2_mul_fp(r[0], a[0], k);

sm9_fp2_mul_fp(r[1], a[1], k);

}

static void sm9_fp4_mul_fp2(sm9_fp4_t r, const sm9_fp4_t a, const sm9_fp2_t b0)

{

sm9_fp2_mul(r[0], a[0], b0);

sm9_fp2_mul(r[1], a[1], b0);

}

static void sm9_fp4_mul_v(sm9_fp4_t r, const sm9_fp4_t a, const sm9_fp4_t b)

{

sm9_fp2_t r0, r1, t;

sm9_fp2_mul_u(r0, a[0], b[1]);

sm9_fp2_mul_u(t, a[1], b[0]);

sm9_fp2_add(r0, r0, t);

sm9_fp2_mul(r1, a[0], b[0]);

sm9_fp2_mul_u(t, a[1], b[1]);

sm9_fp2_add(r1, r1, t);

sm9_fp2_copy(r[0], r0);

sm9_fp2_copy(r[1], r1);

}

static void sm9_fp4_sqr(sm9_fp4_t r, const sm9_fp4_t a)

{

sm9_fp2_t r0, r1, t;

sm9_fp2_sqr(r0, a[0]);

sm9_fp2_sqr_u(t, a[1]);

sm9_fp2_add(r0, r0, t);

sm9_fp2_mul(r1, a[0], a[1]);

sm9_fp2_dbl(r1, r1);

sm9_fp2_copy(r[0], r0);

sm9_fp2_copy(r[1], r1);

}

static void sm9_fp4_sqr_v(sm9_fp4_t r, const sm9_fp4_t a)

{

sm9_fp2_t r0, r1, t;

sm9_fp2_mul_u(t, a[0], a[1]);

sm9_fp2_dbl(r0, t);

sm9_fp2_sqr(r1, a[0]);

sm9_fp2_sqr_u(t, a[1]);

sm9_fp2_add(r1, r1, t);

sm9_fp2_copy(r[0], r0);

sm9_fp2_copy(r[1], r1);

}

static void sm9_fp4_inv(sm9_fp4_t r, const sm9_fp4_t a)

{

sm9_fp2_t r0, r1, k;

sm9_fp2_sqr_u(k, a[1]);

sm9_fp2_sqr(r0, a[0]);

sm9_fp2_sub(k, k, r0);

sm9_fp2_inv(k, k);

sm9_fp2_mul(r0, a[0], k);

sm9_fp2_neg(r0, r0);

sm9_fp2_mul(r1, a[1], k);

sm9_fp2_copy(r[0], r0);

sm9_fp2_copy(r[1], r1);

}

#define sm9_fp12_init(r) memset((r), 0, sizeof(sm9_fp12_t))

#define sm9_fp12_clean(r) memset((r), 0, sizeof(sm9_fp12_t))

#define sm9_fp12_set_zero(r) memset((r), 0, sizeof(sm9_fp12_t))

#define sm9_fp12_copy(r, a) memcpy((r), (a), sizeof(sm9_fp12_t))

static void fp12_set_one(sm9_fp12_t r)

{

fp4_set_one(r[0]);

fp4_set_zero(r[1]);

fp4_set_zero(r[2]);

}

static int fp12_is_one(const sm9_fp12_t a)

{

return fp4_is_one(a[0])

&& fp4_is_zero(a[1])

&& fp4_is_zero(a[2]);

}

static int fp12_is_zero(const sm9_fp12_t a)

{

return fp4_is_zero(a[0])

&& fp4_is_zero(a[1])

&& fp4_is_zero(a[2]);

}

static void fp12_from_hex(sm9_fp12_t r, const char hex[65 * 12])

{

fp4_from_hex(r[2], hex);

fp4_from_hex(r[1], hex + 65 * 4);

fp4_from_hex(r[0], hex + 65 * 8);

}

static void sm9_fp12_to_hex(const sm9_fp12_t a, char hex[65 * 12])

{

sm9_fp4_to_hex(a[2], hex);

hex[65 * 4 - 1] = '\n';

sm9_fp4_to_hex(a[1], hex + 65 * 4);

hex[65 * 8 - 1] = '\n';

sm9_fp4_to_hex(a[0], hex + 65 * 8);

}

static void fp12_print(const char *prefix, const sm9_fp12_t a)

{

char hex[65 * 12];

sm9_fp12_to_hex(a, hex);

printf("%s\n%s\n", prefix, hex);

}

static void fp12_set(sm9_fp12_t r, const sm9_fp4_t a0, const sm9_fp4_t a1, const sm9_fp4_t a2)

{

fp4_copy(r[0], a0);

fp4_copy(r[1], a1);

fp4_copy(r[2], a2);

}

static void fp12_set_fp(sm9_fp12_t r, const sm9_fp_t a)

{

fp4_set_fp(r[0], a);

fp4_set_zero(r[1]);

fp4_set_zero(r[2]);

}

static void fp12_set_fp2(sm9_fp12_t r, const sm9_fp2_t a)

{

fp4_set_fp2(r[0], a);

fp4_set_zero(r[1]);

fp4_set_zero(r[2]);

}

static void fp12_set_fp4(sm9_fp12_t r, const sm9_fp4_t a)

{

fp4_copy(r[0], a);

fp4_set_zero(r[1]);

fp4_set_zero(r[2]);

}

static void fp12_set_u(sm9_fp12_t r)

{

fp4_set_u(r[0]);

fp4_set_zero(r[1]);

fp4_set_zero(r[2]);

}

static void fp12_set_v(sm9_fp12_t r)

{

fp4_set_v(r[0]);

fp4_set_zero(r[1]);

fp4_set_zero(r[2]);

}

static void fp12_set_w(sm9_fp12_t r)

{

fp4_set_zero(r[0]);