Bignum

Bignum#

HACL’s bignum library comes in multiple variants and specializations.

	32-Bit	64-Bit
Generic	`Hacl_Bignum32.h`	`Hacl_Bignum64.h`
256-Bit Bignum	`Hacl_Bignum256_32.h`	`Hacl_Bignum256.h`
4096-Bit Bignum	`Hacl_Bignum4096_32.h`	`Hacl_Bignum4096.h`

Additional headers: Hacl_Bignum_Base.h, Hacl_Bignum.h, Hacl_Bignum25519_51.h, Hacl_Bignum_K256.h.

API Reference#

#include "Hacl_Bignum32.h"

#include "Hacl_Bignum256_32.h"

#include "Hacl_Bignum4096_32.h"

#include "Hacl_Bignum64.h"

#include "Hacl_Bignum256.h"

#include "Hacl_Bignum4096.h"

Loads and stores#

uint32_t *Hacl_Bignum32_new_bn_from_bytes_be(uint32_t len, uint8_t *b)#

Load a bid-endian bignum from memory.

The argument b points to len bytes of valid memory. The function returns a heap-allocated bignum of size sufficient to hold the result of loading b, or NULL if either the allocation failed, or the amount of required memory would exceed 4GB.

If the return value is non-null, clients must eventually call free(3) on it to avoid memory leaks.

uint32_t *Hacl_Bignum32_new_bn_from_bytes_le(uint32_t len, uint8_t *b)#

Load a little-endian bignum from memory.

If the return value is non-null, clients must eventually call free(3) on it to avoid memory leaks.

uint64_t *Hacl_Bignum64_new_bn_from_bytes_be(uint32_t len, uint8_t *b)#

Load a bid-endian bignum from memory.

If the return value is non-null, clients must eventually call free(3) on it to avoid memory leaks.

uint64_t *Hacl_Bignum64_new_bn_from_bytes_le(uint32_t len, uint8_t *b)#

Load a little-endian bignum from memory.

If the return value is non-null, clients must eventually call free(3) on it to avoid memory leaks.

Arithmetic functions#

void Hacl_Bignum32_bn_to_bytes_be(uint32_t len, uint32_t *b, uint8_t *res)#

Serialize a bignum into big-endian memory.

The argument b points to a bignum of ⌈len / 4⌉ size. The outparam res points to len bytes of valid memory.

void Hacl_Bignum32_bn_to_bytes_le(uint32_t len, uint32_t *b, uint8_t *res)#

Serialize a bignum into little-endian memory.

The argument b points to a bignum of ⌈len / 4⌉ size. The outparam res points to len bytes of valid memory.

uint32_t Hacl_Bignum32_add(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res)#

Write a + b mod 2 ^ (32 * len) in res.

This functions returns the carry.

The arguments a, b and the outparam res are meant to be len limbs in size, i.e. uint32_t[len]

void Hacl_Bignum32_add_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res)#

Write (a + b) mod n in res.

The arguments a, b, n and the outparam res are meant to be len limbs in size, i.e. uint32_t[len].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

uint32_t Hacl_Bignum32_sub(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res)#

Write a - b mod 2 ^ (32 * len) in res.

This functions returns the carry.

The arguments a, b and the outparam res are meant to be len limbs in size, i.e. uint32_t[len]

void Hacl_Bignum32_sub_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res)#

Write (a - b) mod n in res.

The arguments a, b, n and the outparam res are meant to be len limbs in size, i.e. uint32_t[len].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

void Hacl_Bignum32_mul(uint32_t len, uint32_t *a, uint32_t *b, uint32_t *res)#

Write a * b in res.

The arguments a and b are meant to be len limbs in size, i.e. uint32_t[len]. The outparam res is meant to be 2*len limbs in size, i.e. uint32_t[2*len].

void Hacl_Bignum32_sqr(uint32_t len, uint32_t *a, uint32_t *res)#

Write a * a in res.

The argument a is meant to be len limbs in size, i.e. uint32_t[len]. The outparam res is meant to be 2*len limbs in size, i.e. uint32_t[2*len].

bool Hacl_Bignum32_mod(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res)#

Write a mod n in res.

The argument a is meant to be 2*len limbs in size, i.e. uint32_t[2*len]. The argument n and the outparam res are meant to be len limbs in size, i.e. uint32_t[len].

The function returns false if any of the following preconditions are violated, true otherwise. • 1 < n • n % 2 = 1

bool Hacl_Bignum32_mod_exp_consttime(uint32_t len, uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be len limbs in size, i.e. uint32_t[len].

The argument b is a bignum of any size, and bBits is an upper bound on the number of significant bits of b. A tighter bound results in faster execution time. When in doubt, the number of bits for the bignum size is always a safe default, e.g. if b is a 4096-bit bignum, bBits should be 4096.

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum32_mod_exp_vartime(uint32_t len, uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be len limbs in size, i.e. uint32_t[len].

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum32_mod_inv_prime_vartime(uint32_t len, uint32_t *n, uint32_t *a, uint32_t *res)#

Write a ^ (-1) mod n in res.

The arguments a, n and the outparam res are meant to be len limbs in size, i.e. uint32_t[len].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • 0 < a • a < n

Note: There is no mod_inv_prime_consttime version.

void Hacl_Bignum256_32_bn_to_bytes_be(uint32_t *b, uint8_t *res)#

Serialize a bignum into big-endian memory.

The argument b points to a 256-bit bignum. The outparam res points to 32 bytes of valid memory.

void Hacl_Bignum256_32_bn_to_bytes_le(uint32_t *b, uint8_t *res)#

Serialize a bignum into little-endian memory.

The argument b points to a 256-bit bignum. The outparam res points to 32 bytes of valid memory.

uint32_t Hacl_Bignum256_32_add(uint32_t *a, uint32_t *b, uint32_t *res)#

Write a + b mod 2^256 in res.

This functions returns the carry.

The arguments a, b and res are meant to be 256-bit bignums, i.e. uint32_t[8]

void Hacl_Bignum256_32_add_mod(uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res)#

Write (a + b) mod n in res.

The arguments a, b, n and the outparam res are meant to be 256-bit bignums, i.e. uint32_t[8].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

uint32_t Hacl_Bignum256_32_sub(uint32_t *a, uint32_t *b, uint32_t *res)#

Write a - b mod 2^256 in res.

This functions returns the carry.

The arguments a, b and res are meant to be 256-bit bignums, i.e. uint32_t[8]

void Hacl_Bignum256_32_sub_mod(uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res)#

Write (a - b) mod n in res.

The arguments a, b, n and the outparam res are meant to be 256-bit bignums, i.e. uint32_t[8].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

void Hacl_Bignum256_32_mul(uint32_t *a, uint32_t *b, uint32_t *res)#

Write a * b in res.

The arguments a and b are meant to be 256-bit bignums, i.e. uint32_t[8]. The outparam res is meant to be a 512-bit bignum, i.e. uint32_t[16].

void Hacl_Bignum256_32_sqr(uint32_t *a, uint32_t *res)#

Write a * a in res.

The argument a is meant to be a 256-bit bignum, i.e. uint32_t[8]. The outparam res is meant to be a 512-bit bignum, i.e. uint32_t[16].

bool Hacl_Bignum256_32_mod(uint32_t *n, uint32_t *a, uint32_t *res)#

Write a mod n in res.

The argument a is meant to be a 512-bit bignum, i.e. uint32_t[16]. The argument n and the outparam res are meant to be 256-bit bignums, i.e. uint32_t[8].

The function returns false if any of the following preconditions are violated, true otherwise. • 1 < n • n % 2 = 1

bool Hacl_Bignum256_32_mod_exp_consttime(uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be 256-bit bignums, i.e. uint32_t[8].

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum256_32_mod_exp_vartime(uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be 256-bit bignums, i.e. uint32_t[8].

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum256_32_mod_inv_prime_vartime(uint32_t *n, uint32_t *a, uint32_t *res)#

Write a ^ (-1) mod n in res.

The arguments a, n and the outparam res are meant to be 256-bit bignums, i.e. uint32_t[8].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • 0 < a • a < n

Note: There is no mod_inv_prime_consttime version.

void Hacl_Bignum4096_32_bn_to_bytes_be(uint32_t *b, uint8_t *res)#

Serialize a bignum into big-endian memory.

The argument b points to a 4096-bit bignum. The outparam res points to 512 bytes of valid memory.

void Hacl_Bignum4096_32_bn_to_bytes_le(uint32_t *b, uint8_t *res)#

Serialize a bignum into little-endian memory.

The argument b points to a 4096-bit bignum. The outparam res points to 512 bytes of valid memory.

uint32_t Hacl_Bignum4096_32_add(uint32_t *a, uint32_t *b, uint32_t *res)#

Write a + b mod 2^4096 in res.

This functions returns the carry.

The arguments a, b and res are meant to be 4096-bit bignums, i.e. uint32_t[128]

void Hacl_Bignum4096_32_add_mod(uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res)#

Write (a + b) mod n in res.

The arguments a, b, n and the outparam res are meant to be 4096-bit bignums, i.e. uint32_t[128].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

uint32_t Hacl_Bignum4096_32_sub(uint32_t *a, uint32_t *b, uint32_t *res)#

Write a - b mod 2^4096 in res.

This functions returns the carry.

The arguments a, b and res are meant to be 4096-bit bignums, i.e. uint32_t[128]

void Hacl_Bignum4096_32_sub_mod(uint32_t *n, uint32_t *a, uint32_t *b, uint32_t *res)#

Write (a - b) mod n in res.

The arguments a, b, n and the outparam res are meant to be 4096-bit bignums, i.e. uint32_t[128].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

void Hacl_Bignum4096_32_mul(uint32_t *a, uint32_t *b, uint32_t *res)#

Write a * b in res.

The arguments a and b are meant to be 4096-bit bignums, i.e. uint32_t[128]. The outparam res is meant to be a 8192-bit bignum, i.e. uint32_t[256].

void Hacl_Bignum4096_32_sqr(uint32_t *a, uint32_t *res)#

Write a * a in res.

The argument a is meant to be a 4096-bit bignum, i.e. uint32_t[128]. The outparam res is meant to be a 8192-bit bignum, i.e. uint32_t[256].

bool Hacl_Bignum4096_32_mod(uint32_t *n, uint32_t *a, uint32_t *res)#

Write a mod n in res.

The argument a is meant to be a 8192-bit bignum, i.e. uint32_t[256]. The argument n and the outparam res are meant to be 4096-bit bignums, i.e. uint32_t[128].

The function returns false if any of the following preconditions are violated, true otherwise. • 1 < n • n % 2 = 1

bool Hacl_Bignum4096_32_mod_exp_consttime(uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be 4096-bit bignums, i.e. uint32_t[128].

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum4096_32_mod_exp_vartime(uint32_t *n, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be 4096-bit bignums, i.e. uint32_t[128].

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum4096_32_mod_inv_prime_vartime(uint32_t *n, uint32_t *a, uint32_t *res)#

Write a ^ (-1) mod n in res.

The arguments a, n and the outparam res are meant to be 4096-bit bignums, i.e. uint32_t[128].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • 0 < a • a < n

Note: There is no mod_inv_prime_consttime version.

void Hacl_Bignum64_bn_to_bytes_be(uint32_t len, uint64_t *b, uint8_t *res)#

Serialize a bignum into big-endian memory.

The argument b points to a bignum of ⌈len / 8⌉ size. The outparam res points to len bytes of valid memory.

void Hacl_Bignum64_bn_to_bytes_le(uint32_t len, uint64_t *b, uint8_t *res)#

Serialize a bignum into little-endian memory.

The argument b points to a bignum of ⌈len / 8⌉ size. The outparam res points to len bytes of valid memory.

uint64_t Hacl_Bignum64_add(uint32_t len, uint64_t *a, uint64_t *b, uint64_t *res)#

Write a + b mod 2 ^ (64 * len) in res.

This functions returns the carry.

The arguments a, b and the outparam res are meant to be len limbs in size, i.e. uint64_t[len]

void Hacl_Bignum64_add_mod(uint32_t len, uint64_t *n, uint64_t *a, uint64_t *b, uint64_t *res)#

Write (a + b) mod n in res.

The arguments a, b, n and the outparam res are meant to be len limbs in size, i.e. uint64_t[len].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

uint64_t Hacl_Bignum64_sub(uint32_t len, uint64_t *a, uint64_t *b, uint64_t *res)#

Write a - b mod 2 ^ (64 * len) in res.

This functions returns the carry.

The arguments a, b and the outparam res are meant to be len limbs in size, i.e. uint64_t[len]

void Hacl_Bignum64_sub_mod(uint32_t len, uint64_t *n, uint64_t *a, uint64_t *b, uint64_t *res)#

Write (a - b) mod n in res.

The arguments a, b, n and the outparam res are meant to be len limbs in size, i.e. uint64_t[len].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

void Hacl_Bignum64_mul(uint32_t len, uint64_t *a, uint64_t *b, uint64_t *res)#

Write a * b in res.

The arguments a and b are meant to be len limbs in size, i.e. uint64_t[len]. The outparam res is meant to be 2*len limbs in size, i.e. uint64_t[2*len].

void Hacl_Bignum64_sqr(uint32_t len, uint64_t *a, uint64_t *res)#

Write a * a in res.

The argument a is meant to be len limbs in size, i.e. uint64_t[len]. The outparam res is meant to be 2*len limbs in size, i.e. uint64_t[2*len].

bool Hacl_Bignum64_mod(uint32_t len, uint64_t *n, uint64_t *a, uint64_t *res)#

Write a mod n in res.

The argument a is meant to be 2*len limbs in size, i.e. uint64_t[2*len]. The argument n and the outparam res are meant to be len limbs in size, i.e. uint64_t[len].

The function returns false if any of the following preconditions are violated, true otherwise. • 1 < n • n % 2 = 1

bool Hacl_Bignum64_mod_exp_consttime(uint32_t len, uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be len limbs in size, i.e. uint64_t[len].

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum64_mod_exp_vartime(uint32_t len, uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be len limbs in size, i.e. uint64_t[len].

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum64_mod_inv_prime_vartime(uint32_t len, uint64_t *n, uint64_t *a, uint64_t *res)#

Write a ^ (-1) mod n in res.

The arguments a, n and the outparam res are meant to be len limbs in size, i.e. uint64_t[len].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • 0 < a • a < n

Note: There is no mod_inv_prime_consttime version.

void Hacl_Bignum256_bn_to_bytes_be(uint64_t *b, uint8_t *res)#

Serialize a bignum into big-endian memory.

The argument b points to a 256-bit bignum. The outparam res points to 32 bytes of valid memory.

void Hacl_Bignum256_bn_to_bytes_le(uint64_t *b, uint8_t *res)#

Serialize a bignum into little-endian memory.

The argument b points to a 256-bit bignum. The outparam res points to 32 bytes of valid memory.

uint64_t Hacl_Bignum256_add(uint64_t *a, uint64_t *b, uint64_t *res)#

Write a + b mod 2^256 in res.

This functions returns the carry.

The arguments a, b and res are meant to be 256-bit bignums, i.e. uint64_t[4]

void Hacl_Bignum256_add_mod(uint64_t *n, uint64_t *a, uint64_t *b, uint64_t *res)#

Write (a + b) mod n in res.

The arguments a, b, n and the outparam res are meant to be 256-bit bignums, i.e. uint64_t[4].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

uint64_t Hacl_Bignum256_sub(uint64_t *a, uint64_t *b, uint64_t *res)#

Write a - b mod 2^256 in res.

This functions returns the carry.

The arguments a, b and res are meant to be 256-bit bignums, i.e. uint64_t[4]

void Hacl_Bignum256_sub_mod(uint64_t *n, uint64_t *a, uint64_t *b, uint64_t *res)#

Write (a - b) mod n in res.

The arguments a, b, n and the outparam res are meant to be 256-bit bignums, i.e. uint64_t[4].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

void Hacl_Bignum256_mul(uint64_t *a, uint64_t *b, uint64_t *res)#

Write a * b in res.

The arguments a and b are meant to be 256-bit bignums, i.e. uint64_t[4]. The outparam res is meant to be a 512-bit bignum, i.e. uint64_t[8].

void Hacl_Bignum256_sqr(uint64_t *a, uint64_t *res)#

Write a * a in res.

The argument a is meant to be a 256-bit bignum, i.e. uint64_t[4]. The outparam res is meant to be a 512-bit bignum, i.e. uint64_t[8].

bool Hacl_Bignum256_mod(uint64_t *n, uint64_t *a, uint64_t *res)#

Write a mod n in res.

The argument a is meant to be a 512-bit bignum, i.e. uint64_t[8]. The argument n and the outparam res are meant to be 256-bit bignums, i.e. uint64_t[4].

The function returns false if any of the following preconditions are violated, true otherwise. • 1 < n • n % 2 = 1

bool Hacl_Bignum256_mod_exp_consttime(uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be 256-bit bignums, i.e. uint64_t[4].

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum256_mod_exp_vartime(uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be 256-bit bignums, i.e. uint64_t[4].

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum256_mod_inv_prime_vartime(uint64_t *n, uint64_t *a, uint64_t *res)#

Write a ^ (-1) mod n in res.

The arguments a, n and the outparam res are meant to be 256-bit bignums, i.e. uint64_t[4].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • 0 < a • a < n

Note: There is no mod_inv_prime_consttime version.

void Hacl_Bignum4096_bn_to_bytes_be(uint64_t *b, uint8_t *res)#

Serialize a bignum into big-endian memory.

The argument b points to a 4096-bit bignum. The outparam res points to 512 bytes of valid memory.

void Hacl_Bignum4096_bn_to_bytes_le(uint64_t *b, uint8_t *res)#

Serialize a bignum into little-endian memory.

The argument b points to a 4096-bit bignum. The outparam res points to 512 bytes of valid memory.

uint64_t Hacl_Bignum4096_add(uint64_t *a, uint64_t *b, uint64_t *res)#

Write a + b mod 2^4096 in res.

This functions returns the carry.

The arguments a, b and res are meant to be 4096-bit bignums, i.e. uint64_t[64]

void Hacl_Bignum4096_add_mod(uint64_t *n, uint64_t *a, uint64_t *b, uint64_t *res)#

Write (a + b) mod n in res.

The arguments a, b, n and the outparam res are meant to be 4096-bit bignums, i.e. uint64_t[64].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

uint64_t Hacl_Bignum4096_sub(uint64_t *a, uint64_t *b, uint64_t *res)#

Write a - b mod 2^4096 in res.

This functions returns the carry.

The arguments a, b and res are meant to be 4096-bit bignums, i.e. uint64_t[64]

void Hacl_Bignum4096_sub_mod(uint64_t *n, uint64_t *a, uint64_t *b, uint64_t *res)#

Write (a - b) mod n in res.

The arguments a, b, n and the outparam res are meant to be 4096-bit bignums, i.e. uint64_t[64].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • a < n • b < n

void Hacl_Bignum4096_mul(uint64_t *a, uint64_t *b, uint64_t *res)#

Write a * b in res.

The arguments a and b are meant to be 4096-bit bignums, i.e. uint64_t[64]. The outparam res is meant to be a 8192-bit bignum, i.e. uint64_t[128].

void Hacl_Bignum4096_sqr(uint64_t *a, uint64_t *res)#

Write a * a in res.

The argument a is meant to be a 4096-bit bignum, i.e. uint64_t[64]. The outparam res is meant to be a 8192-bit bignum, i.e. uint64_t[128].

bool Hacl_Bignum4096_mod(uint64_t *n, uint64_t *a, uint64_t *res)#

Write a mod n in res.

The argument a is meant to be a 8192-bit bignum, i.e. uint64_t[128]. The argument n and the outparam res are meant to be 4096-bit bignums, i.e. uint64_t[64].

The function returns false if any of the following preconditions are violated, true otherwise. • 1 < n • n % 2 = 1

bool Hacl_Bignum4096_mod_exp_consttime(uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be 4096-bit bignums, i.e. uint64_t[64].

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum4096_mod_exp_vartime(uint64_t *n, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a, n and the outparam res are meant to be 4096-bit bignums, i.e. uint64_t[64].

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • b < pow2 bBits • a < n

bool Hacl_Bignum4096_mod_inv_prime_vartime(uint64_t *n, uint64_t *a, uint64_t *res)#

Write a ^ (-1) mod n in res.

The arguments a, n and the outparam res are meant to be 4096-bit bignums, i.e. uint64_t[64].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime

The function returns false if any of the following preconditions are violated, true otherwise. • n % 2 = 1 • 1 < n • 0 < a • a < n

Note: There is no mod_inv_prime_consttime version.

Comparisons#

uint32_t Hacl_Bignum32_lt_mask(uint32_t len, uint32_t *a, uint32_t *b)#

Returns 2^32 - 1 if a < b, otherwise returns 0.

The arguments a and b are meant to be len limbs in size, i.e. uint32_t[len].

uint32_t Hacl_Bignum32_eq_mask(uint32_t len, uint32_t *a, uint32_t *b)#

Returns 2^32 - 1 if a = b, otherwise returns 0.

The arguments a and b are meant to be len limbs in size, i.e. uint32_t[len].

uint64_t Hacl_Bignum64_lt_mask(uint32_t len, uint64_t *a, uint64_t *b)#

Returns 2^64 - 1 if a < b, otherwise returns 0.

The arguments a and b are meant to be len limbs in size, i.e. uint64_t[len].

uint64_t Hacl_Bignum64_eq_mask(uint32_t len, uint64_t *a, uint64_t *b)#

Returns 2^64 - 1 if a = b, otherwise returns 0.

The arguments a and b are meant to be len limbs in size, i.e. uint64_t[len].

Arithmetic functions with precomputations#

typedef Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *Hacl_Bignum32_pbn_mont_ctx_u32#

Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *Hacl_Bignum32_mont_ctx_init(uint32_t len, uint32_t *n)#

Heap-allocate and initialize a montgomery context.

The argument n is meant to be len limbs in size, i.e. uint32_t[len].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n % 2 = 1 • 1 < n

The caller will need to call Hacl_Bignum32_mont_ctx_free on the return value to avoid memory leaks.

void Hacl_Bignum32_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k)#

Deallocate the memory previously allocated by Hacl_Bignum32_mont_ctx_init.

The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.

void Hacl_Bignum32_mod_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t *res)#

Write a mod n in res.

The argument a is meant to be 2*len limbs in size, i.e. uint32_t[2*len]. The outparam res is meant to be len limbs in size, i.e. uint32_t[len]. The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.

void Hacl_Bignum32_mod_exp_consttime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be len limbs in size, i.e. uint32_t[len]. The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime_*.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum32_mod_exp_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be len limbs in size, i.e. uint32_t[len]. The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum32_mod_inv_prime_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t *res)#

Write a ^ (-1) mod n in res.

The argument a and the outparam res are meant to be len limbs in size, i.e. uint32_t[len]. The argument k is a montgomery context obtained through Hacl_Bignum32_mont_ctx_init.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime • 0 < a • a < n

Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *Hacl_Bignum256_32_mont_ctx_init(uint32_t *n)#

Heap-allocate and initialize a montgomery context.

The argument n is meant to be a 256-bit bignum, i.e. uint32_t[8].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n % 2 = 1 • 1 < n

The caller will need to call Hacl_Bignum256_mont_ctx_free on the return value to avoid memory leaks.

void Hacl_Bignum256_32_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k)#

Deallocate the memory previously allocated by Hacl_Bignum256_mont_ctx_init.

The argument k is a montgomery context obtained through Hacl_Bignum256_mont_ctx_init.

void Hacl_Bignum256_32_mod_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t *res)#

Write a mod n in res.

The argument a is meant to be a 512-bit bignum, i.e. uint32_t[16]. The outparam res is meant to be a 256-bit bignum, i.e. uint32_t[8]. The argument k is a montgomery context obtained through Hacl_Bignum256_mont_ctx_init.

void Hacl_Bignum256_32_mod_exp_consttime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be 256-bit bignums, i.e. uint32_t[8]. The argument k is a montgomery context obtained through Hacl_Bignum256_mont_ctx_init.

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime_*.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum256_32_mod_exp_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be 256-bit bignums, i.e. uint32_t[8]. The argument k is a montgomery context obtained through Hacl_Bignum256_mont_ctx_init.

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum256_32_mod_inv_prime_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t *res)#

Write a ^ (-1) mod n in res.

The argument a and the outparam res are meant to be 256-bit bignums, i.e. uint32_t[8]. The argument k is a montgomery context obtained through Hacl_Bignum256_mont_ctx_init.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime • 0 < a • a < n

Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *Hacl_Bignum4096_32_mont_ctx_init(uint32_t *n)#

Heap-allocate and initialize a montgomery context.

The argument n is meant to be a 4096-bit bignum, i.e. uint32_t[128].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n % 2 = 1 • 1 < n

The caller will need to call Hacl_Bignum4096_mont_ctx_free on the return value to avoid memory leaks.

void Hacl_Bignum4096_32_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k)#

Deallocate the memory previously allocated by Hacl_Bignum4096_mont_ctx_init.

The argument k is a montgomery context obtained through Hacl_Bignum4096_mont_ctx_init.

void Hacl_Bignum4096_32_mod_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t *res)#

Write a mod n in res.

The argument a is meant to be a 8192-bit bignum, i.e. uint32_t[256]. The outparam res is meant to be a 4096-bit bignum, i.e. uint32_t[128]. The argument k is a montgomery context obtained through Hacl_Bignum4096_mont_ctx_init.

void Hacl_Bignum4096_32_mod_exp_consttime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be 4096-bit bignums, i.e. uint32_t[128]. The argument k is a montgomery context obtained through Hacl_Bignum4096_mont_ctx_init.

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime_*.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum4096_32_mod_exp_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t bBits, uint32_t *b, uint32_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be 4096-bit bignums, i.e. uint32_t[128]. The argument k is a montgomery context obtained through Hacl_Bignum4096_mont_ctx_init.

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum4096_32_mod_inv_prime_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u32 *k, uint32_t *a, uint32_t *res)#

Write a ^ (-1) mod n in res.

The argument a and the outparam res are meant to be 4096-bit bignums, i.e. uint32_t[128]. The argument k is a montgomery context obtained through Hacl_Bignum4096_mont_ctx_init.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime • 0 < a • a < n

typedef Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *Hacl_Bignum64_pbn_mont_ctx_u64#

Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *Hacl_Bignum64_mont_ctx_init(uint32_t len, uint64_t *n)#

Heap-allocate and initialize a montgomery context.

The argument n is meant to be len limbs in size, i.e. uint64_t[len].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n % 2 = 1 • 1 < n

The caller will need to call Hacl_Bignum64_mont_ctx_free on the return value to avoid memory leaks.

void Hacl_Bignum64_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k)#

Deallocate the memory previously allocated by Hacl_Bignum64_mont_ctx_init.

The argument k is a montgomery context obtained through Hacl_Bignum64_mont_ctx_init.

void Hacl_Bignum64_mod_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint64_t *res)#

Write a mod n in res.

The argument a is meant to be 2*len limbs in size, i.e. uint64_t[2*len]. The outparam res is meant to be len limbs in size, i.e. uint64_t[len]. The argument k is a montgomery context obtained through Hacl_Bignum64_mont_ctx_init.

void Hacl_Bignum64_mod_exp_consttime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be len limbs in size, i.e. uint64_t[len]. The argument k is a montgomery context obtained through Hacl_Bignum64_mont_ctx_init.

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime_*.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum64_mod_exp_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be len limbs in size, i.e. uint64_t[len]. The argument k is a montgomery context obtained through Hacl_Bignum64_mont_ctx_init.

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum64_mod_inv_prime_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint64_t *res)#

Write a ^ (-1) mod n in res.

The argument a and the outparam res are meant to be len limbs in size, i.e. uint64_t[len]. The argument k is a montgomery context obtained through Hacl_Bignum64_mont_ctx_init.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime • 0 < a • a < n

Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *Hacl_Bignum256_mont_ctx_init(uint64_t *n)#

Heap-allocate and initialize a montgomery context.

The argument n is meant to be a 256-bit bignum, i.e. uint64_t[4].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n % 2 = 1 • 1 < n

The caller will need to call Hacl_Bignum256_mont_ctx_free on the return value to avoid memory leaks.

void Hacl_Bignum256_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k)#

Deallocate the memory previously allocated by Hacl_Bignum256_mont_ctx_init.

The argument k is a montgomery context obtained through Hacl_Bignum256_mont_ctx_init.

void Hacl_Bignum256_mod_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint64_t *res)#

Write a mod n in res.

The argument a is meant to be a 512-bit bignum, i.e. uint64_t[8]. The outparam res is meant to be a 256-bit bignum, i.e. uint64_t[4]. The argument k is a montgomery context obtained through Hacl_Bignum256_mont_ctx_init.

void Hacl_Bignum256_mod_exp_consttime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be 256-bit bignums, i.e. uint64_t[4]. The argument k is a montgomery context obtained through Hacl_Bignum256_mont_ctx_init.

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime_*.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum256_mod_exp_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be 256-bit bignums, i.e. uint64_t[4]. The argument k is a montgomery context obtained through Hacl_Bignum256_mont_ctx_init.

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum256_mod_inv_prime_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint64_t *res)#

Write a ^ (-1) mod n in res.

The argument a and the outparam res are meant to be 256-bit bignums, i.e. uint64_t[4]. The argument k is a montgomery context obtained through Hacl_Bignum256_mont_ctx_init.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime • 0 < a • a < n

Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *Hacl_Bignum4096_mont_ctx_init(uint64_t *n)#

Heap-allocate and initialize a montgomery context.

The argument n is meant to be a 4096-bit bignum, i.e. uint64_t[64].

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n % 2 = 1 • 1 < n

The caller will need to call Hacl_Bignum4096_mont_ctx_free on the return value to avoid memory leaks.

void Hacl_Bignum4096_mont_ctx_free(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k)#

Deallocate the memory previously allocated by Hacl_Bignum4096_mont_ctx_init.

The argument k is a montgomery context obtained through Hacl_Bignum4096_mont_ctx_init.

void Hacl_Bignum4096_mod_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint64_t *res)#

Write a mod n in res.

The argument a is meant to be a 8192-bit bignum, i.e. uint64_t[128]. The outparam res is meant to be a 4096-bit bignum, i.e. uint64_t[64]. The argument k is a montgomery context obtained through Hacl_Bignum4096_mont_ctx_init.

void Hacl_Bignum4096_mod_exp_consttime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be 4096-bit bignums, i.e. uint64_t[64]. The argument k is a montgomery context obtained through Hacl_Bignum4096_mont_ctx_init.

This function is constant-time over its argument b, at the cost of a slower execution time than mod_exp_vartime_*.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum4096_mod_exp_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint32_t bBits, uint64_t *b, uint64_t *res)#

Write a ^ b mod n in res.

The arguments a and the outparam res are meant to be 4096-bit bignums, i.e. uint64_t[64]. The argument k is a montgomery context obtained through Hacl_Bignum4096_mont_ctx_init.

The function is NOT constant-time on the argument b. See the mod_exp_consttime_* functions for constant-time variants.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • b < pow2 bBits • a < n

void Hacl_Bignum4096_mod_inv_prime_vartime_precomp(Hacl_Bignum_MontArithmetic_bn_mont_ctx_u64 *k, uint64_t *a, uint64_t *res)#

Write a ^ (-1) mod n in res.

The argument a and the outparam res are meant to be 4096-bit bignums, i.e. uint64_t[64]. The argument k is a montgomery context obtained through Hacl_Bignum4096_mont_ctx_init.

Before calling this function, the caller will need to ensure that the following preconditions are observed. • n is a prime • 0 < a • a < n

Versions

Bignum

Contents

Bignum#

API Reference#

Loads and stores#

Arithmetic functions#

Comparisons#

Arithmetic functions with precomputations#