code wiki / (root) / nx_x25519_wasm.nx
`nx_x25519_wasm.nx` source

↩ module page · 551 lines · 21127 B
1// nx_x25519_wasm.nx -- Curve25519 ECDH (RFC 7748) for WAT target.
2//
3// Field: GF(2^255 - 19).  Curve: y^2 = x^3 + 486662*x^2 + x.
4// Only the x-coordinate is needed for the ladder.
5//
6// Field representation: 10 limbs alternating 26 / 25 bits = 255 bits.
7//   limb[0] -> bits 0..25   (26-bit slot, but only low 26 used)
8//   limb[1] -> bits 26..50  (25 bits)
9//   limb[2] -> bits 51..76  (26 bits)
10//   ...alternating up to limb[9] which is the high 25 bits.
11//
12// This split (donna 32-bit-style) means each per-limb multiplication
13// result fits comfortably in i64 (max 2^51 ish).  Carry chain
14// distributes the overflow back into 26/25-bit form after each round.
15//
16// Reduction: 2^255 mod (2^255 - 19) = 19.  Any bit at position 255+
17// folds back by multiplying by 19.
18//
19// API for the embedder:
20//
21//   nx_x25519_scalarmult(scalar_ptr, point_ptr, scratch_ptr, out_ptr) -> i64
22//     scalar_ptr -- 32 bytes (LE).  Clamped per RFC 7748 §5 inside.
23//     point_ptr  -- 32 bytes (LE; the u-coord of the input point).
24//     scratch_ptr-- >= 1024 bytes scratch area
25//     out_ptr    -- 32 bytes (the resulting u-coord)
26//
27// Verified against RFC 7748 §5.2 test vectors.
28//
29// license_tier: INDEPENDENT_REDERIVE
30// genealogy_id: international-research-sources/ietf/rfc_7748 +
31//               daniel_j_bernstein/curve25519_donna
32// lineage_id:   nishi_x25519_wasm_q11
33
34const M25: i64 = 0x1ffffff      // 2^25 - 1
35const M26: i64 = 0x3ffffff      // 2^26 - 1
36
37// Limb buffer layout: 10 i64 limbs at offset (idx*8) in u8 buffer.
38func _fe_get(fe: *u8, i: i64) -> i64 {
  let off: i64 = i * 8
  return (fe[off] as i64) |
         ((fe[off + 1] as i64) << 8) |
         ((fe[off + 2] as i64) << 16) |
         ((fe[off + 3] as i64) << 24) |
         ((fe[off + 4] as i64) << 32) |
         ((fe[off + 5] as i64) << 40) |
         ((fe[off + 6] as i64) << 48) |
         ((fe[off + 7] as i64) << 56)
48}
49func _fe_set(fe: *u8, i: i64, v: i64) -> i64 {
  let off: i64 = i * 8
  fe[off]     = v & 0xFF
  fe[off + 1] = (v >> 8) & 0xFF
  fe[off + 2] = (v >> 16) & 0xFF
  fe[off + 3] = (v >> 24) & 0xFF
  fe[off + 4] = (v >> 32) & 0xFF
  fe[off + 5] = (v >> 40) & 0xFF
  fe[off + 6] = (v >> 48) & 0xFF
  fe[off + 7] = (v >> 56) & 0xFF
  return 0
60}
61
62// Unpack 32 bytes (LE) into 10 limbs.
63func _fe_unpack(fe: *u8, bytes: *u8) -> i64 {
  // We use the standard donna trick: read 4-byte chunks then re-slice.
  // Bit positions: 0,26,51,77,102,128,153,179,204,230
  let w0: i64 = (bytes[0] as i64) | ((bytes[1] as i64) << 8) |
                ((bytes[2] as i64) << 16) | ((bytes[3] as i64) << 24)
  let w1: i64 = (bytes[4] as i64) | ((bytes[5] as i64) << 8) |
                ((bytes[6] as i64) << 16) | ((bytes[7] as i64) << 24)
  let w2: i64 = (bytes[8] as i64) | ((bytes[9] as i64) << 8) |
                ((bytes[10] as i64) << 16) | ((bytes[11] as i64) << 24)
  let w3: i64 = (bytes[12] as i64) | ((bytes[13] as i64) << 8) |
                ((bytes[14] as i64) << 16) | ((bytes[15] as i64) << 24)
  let w4: i64 = (bytes[16] as i64) | ((bytes[17] as i64) << 8) |
                ((bytes[18] as i64) << 16) | ((bytes[19] as i64) << 24)
  let w5: i64 = (bytes[20] as i64) | ((bytes[21] as i64) << 8) |
                ((bytes[22] as i64) << 16) | ((bytes[23] as i64) << 24)
  let w6: i64 = (bytes[24] as i64) | ((bytes[25] as i64) << 8) |
                ((bytes[26] as i64) << 16) | ((bytes[27] as i64) << 24)
  let w7: i64 = (bytes[28] as i64) | ((bytes[29] as i64) << 8) |
                ((bytes[30] as i64) << 16) | (((bytes[31] & 0x7F) as i64) << 24)
  // Mask the top bit per RFC 7748 (high bit of byte 31 ignored).
83
  // Slice the 256-bit value (lo to hi: w0..w7) into 26,25,26,25,26,25,26,25,26,25 bit limbs.
  _fe_set(fe, 0,  w0 & M26)
  _fe_set(fe, 1, ((w0 >> 26) | (w1 << 6)) & M25)
  _fe_set(fe, 2, ((w1 >> 19) | (w2 << 13)) & M26)
  _fe_set(fe, 3, ((w2 >> 13) | (w3 << 19)) & M25)
  _fe_set(fe, 4, ((w3 >> 6) ) & M26)
  _fe_set(fe, 5,  w4 & M25)
  _fe_set(fe, 6, ((w4 >> 25) | (w5 << 7)) & M26)
  _fe_set(fe, 7, ((w5 >> 19) | (w6 << 13)) & M25)
  _fe_set(fe, 8, ((w6 >> 12) | (w7 << 20)) & M26)
  _fe_set(fe, 9, (w7 >> 6) & M25)
  return 0
96}
97
98// Pack 10 limbs into 32 bytes (LE), fully reduced.
99func _fe_pack(bytes: *u8, fe: *u8) -> i64 {
  // First do a final carry-reduce sweep so each limb is canonical.
  // Even-index limbs are 26-bit; odd-index limbs are 25-bit.
  var c: i64 = 0
  var i: i64 = 0
  while i < 10 {
      let v: i64 = _fe_get(fe, i) + c
      var bits: i64 = 26
      var mask: i64 = M26
      if (i & 1) == 1 { bits = 25; mask = M25 }
      _fe_set(fe, i, v & mask)
      c = v >> bits
      i = i + 1
  }
  // Final carry wraps via 2^255 -> 19.
  let h0: i64 = _fe_get(fe, 0) + c * 19
  var c2: i64 = h0 >> 26
  _fe_set(fe, 0, h0 & M26)
  let h1: i64 = _fe_get(fe, 1) + c2
  _fe_set(fe, 1, h1)
119
  // Now check if result >= p (= 2^255 - 19).  If so, subtract p.
  // Try adding 19 and seeing if carry propagates all the way.
  // For simplicity we do a conditional subtract.
  var g0: i64 = _fe_get(fe, 0) + 19
  var cc: i64 = g0 >> 26; g0 = g0 & M26
  var g1: i64 = _fe_get(fe, 1) + cc; cc = g1 >> 25; g1 = g1 & M25
  var g2: i64 = _fe_get(fe, 2) + cc; cc = g2 >> 26; g2 = g2 & M26
  var g3: i64 = _fe_get(fe, 3) + cc; cc = g3 >> 25; g3 = g3 & M25
  var g4: i64 = _fe_get(fe, 4) + cc; cc = g4 >> 26; g4 = g4 & M26
  var g5: i64 = _fe_get(fe, 5) + cc; cc = g5 >> 25; g5 = g5 & M25
  var g6: i64 = _fe_get(fe, 6) + cc; cc = g6 >> 26; g6 = g6 & M26
  var g7: i64 = _fe_get(fe, 7) + cc; cc = g7 >> 25; g7 = g7 & M25
  var g8: i64 = _fe_get(fe, 8) + cc; cc = g8 >> 26; g8 = g8 & M26
  var g9: i64 = _fe_get(fe, 9) + cc - (1 << 25)
  // If g9 >= 0, the value was >= p and we should use g; else use original fe.
  var mask: i64 = 0
  if g9 >= 0 { mask = -1 }
  let f0: i64 = (_fe_get(fe, 0) & ~mask) | (g0 & mask)
  let f1: i64 = (_fe_get(fe, 1) & ~mask) | (g1 & mask)
  let f2: i64 = (_fe_get(fe, 2) & ~mask) | (g2 & mask)
  let f3: i64 = (_fe_get(fe, 3) & ~mask) | (g3 & mask)
  let f4: i64 = (_fe_get(fe, 4) & ~mask) | (g4 & mask)
  let f5: i64 = (_fe_get(fe, 5) & ~mask) | (g5 & mask)
  let f6: i64 = (_fe_get(fe, 6) & ~mask) | (g6 & mask)
  let f7: i64 = (_fe_get(fe, 7) & ~mask) | (g7 & mask)
  let f8: i64 = (_fe_get(fe, 8) & ~mask) | (g8 & mask)
  let f9: i64 = (_fe_get(fe, 9) & ~mask) | (g9 & mask)
147
  // Recompose as 32 LE bytes.
  // bit positions for limbs: 0, 26, 51, 77, 102, 128, 153, 179, 204, 230
  let bb0: i64 = f0 | (f1 << 26)
  let bb1: i64 = (f1 >> 6) | (f2 << 19)
  let bb2: i64 = (f2 >> 13) | (f3 << 13)
  let bb3: i64 = (f3 >> 19) | (f4 << 6)
  let bb4: i64 = f5 | (f6 << 25)
  let bb5: i64 = (f6 >> 7) | (f7 << 19)
  let bb6: i64 = (f7 >> 13) | (f8 << 12)
  let bb7: i64 = (f8 >> 20) | (f9 << 6)
  // Write 32 bytes as 8 LE i32s (from bb0..bb7).
  var i2: i64 = 0
  while i2 < 8 {
      var v: i64 = 0
      if i2 == 0 { v = bb0 } else { if i2 == 1 { v = bb1 } else { if i2 == 2 { v = bb2 } else { if i2 == 3 { v = bb3 } else { if i2 == 4 { v = bb4 } else { if i2 == 5 { v = bb5 } else { if i2 == 6 { v = bb6 } else { v = bb7 } } } } } } }
      bytes[i2 * 4]     = v & 0xFF
      bytes[i2 * 4 + 1] = (v >> 8) & 0xFF
      bytes[i2 * 4 + 2] = (v >> 16) & 0xFF
      bytes[i2 * 4 + 3] = (v >> 24) & 0xFF
      i2 = i2 + 1
  }
  return 0
170}
171
172// fe_copy.
173func _fe_copy(dst: *u8, src: *u8) -> i64 {
  var i: i64 = 0
  while i < 10 { _fe_set(dst, i, _fe_get(src, i)); i = i + 1 }
  return 0
177}
178
179// fe_add: out = a + b  (no reduction; caller may need to reduce eventually)
180func _fe_add(out: *u8, a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while i < 10 {
      _fe_set(out, i, _fe_get(a, i) + _fe_get(b, i))
      i = i + 1
  }
  return 0
187}
188
189// fe_sub: out = a - b + (2*p)  to avoid negatives; then carry.
190// 2p in limb form has each limb = 2 * (2^26 - 38)/... -- simpler to
191// add 2p as a pre-computed constant per limb based on canonical form.
192// We use the donna approach: add a multiple of p that's large enough
193// to ensure positivity.  For our limb widths the easy constant is:
194//   limb[0] += 0x7ffffda (= 2*(2^26 - 19))
195//   limb[i>0] += 0x7fffffe (= 2*(2^25 - 1)) for i odd
196//                or 0xffffffe for i even
197// then subtract b limbwise.
198func _fe_sub(out: *u8, a: *u8, b: *u8) -> i64 {
  let off0: i64 = 0x7ffffda
  let off_odd: i64 = 0x3fffffe        // 2 * (2^25 - 1)
  let off_even: i64 = 0x7fffffe       // 2 * (2^26 - 1)
  var i: i64 = 0
  while i < 10 {
      var addv: i64 = 0
      if i == 0 { addv = off0 }
      else { if (i & 1) == 0 { addv = off_even } else { addv = off_odd } }
      _fe_set(out, i, _fe_get(a, i) + addv - _fe_get(b, i))
      i = i + 1
  }
  return 0
211}
212
213// fe_mul: out = a * b mod p  (schoolbook with 10x10 partials + 2*reduce)
214func _fe_mul(out: *u8, a_in: *u8, b_in: *u8) -> i64 {
  // Read all 10 limbs of each into locals.
  let a0: i64 = _fe_get(a_in, 0)
  let a1: i64 = _fe_get(a_in, 1)
  let a2: i64 = _fe_get(a_in, 2)
  let a3: i64 = _fe_get(a_in, 3)
  let a4: i64 = _fe_get(a_in, 4)
  let a5: i64 = _fe_get(a_in, 5)
  let a6: i64 = _fe_get(a_in, 6)
  let a7: i64 = _fe_get(a_in, 7)
  let a8: i64 = _fe_get(a_in, 8)
  let a9: i64 = _fe_get(a_in, 9)
  let b0: i64 = _fe_get(b_in, 0)
  let b1: i64 = _fe_get(b_in, 1)
  let b2: i64 = _fe_get(b_in, 2)
  let b3: i64 = _fe_get(b_in, 3)
  let b4: i64 = _fe_get(b_in, 4)
  let b5: i64 = _fe_get(b_in, 5)
  let b6: i64 = _fe_get(b_in, 6)
  let b7: i64 = _fe_get(b_in, 7)
  let b8: i64 = _fe_get(b_in, 8)
  let b9: i64 = _fe_get(b_in, 9)
236
  // The 19-precomputed b for cross-products (folds high bits back).
  let b1_19: i64 = b1 * 19
  let b2_19: i64 = b2 * 19
  let b3_19: i64 = b3 * 19
  let b4_19: i64 = b4 * 19
  let b5_19: i64 = b5 * 19
  let b6_19: i64 = b6 * 19
  let b7_19: i64 = b7 * 19
  let b8_19: i64 = b8 * 19
  let b9_19: i64 = b9 * 19
  // Also need a_odd * 2 for some cross products (donna pattern):
  let a1_2: i64 = a1 * 2
  let a3_2: i64 = a3 * 2
  let a5_2: i64 = a5 * 2
  let a7_2: i64 = a7 * 2
  let a9_2: i64 = a9 * 2
253
  // Schoolbook with reduce-by-19 for crossings of 2^255.
  // h[i] = sum over j+k=i of a[j]*b[k]; with j+k>=10 we fold by *19.
  // Even-index limbs get double weight on odd*odd cross products
  // because of the 26+25 spacing trick.
  // Single-line expressions because the parser doesn't accept leading-+ continuation.
  let h0: i64 = a0*b0 + a1_2*b9_19 + a2*b8_19 + a3_2*b7_19 + a4*b6_19 + a5_2*b5_19 + a6*b4_19 + a7_2*b3_19 + a8*b2_19 + a9_2*b1_19
  let h1: i64 = a0*b1 + a1*b0 + a2*b9_19 + a3*b8_19 + a4*b7_19 + a5*b6_19 + a6*b5_19 + a7*b4_19 + a8*b3_19 + a9*b2_19
  let h2: i64 = a0*b2 + a1_2*b1 + a2*b0 + a3_2*b9_19 + a4*b8_19 + a5_2*b7_19 + a6*b6_19 + a7_2*b5_19 + a8*b4_19 + a9_2*b3_19
  let h3: i64 = a0*b3 + a1*b2 + a2*b1 + a3*b0 + a4*b9_19 + a5*b8_19 + a6*b7_19 + a7*b6_19 + a8*b5_19 + a9*b4_19
  let h4: i64 = a0*b4 + a1_2*b3 + a2*b2 + a3_2*b1 + a4*b0 + a5_2*b9_19 + a6*b8_19 + a7_2*b7_19 + a8*b6_19 + a9_2*b5_19
  let h5: i64 = a0*b5 + a1*b4 + a2*b3 + a3*b2 + a4*b1 + a5*b0 + a6*b9_19 + a7*b8_19 + a8*b7_19 + a9*b6_19
  let h6: i64 = a0*b6 + a1_2*b5 + a2*b4 + a3_2*b3 + a4*b2 + a5_2*b1 + a6*b0 + a7_2*b9_19 + a8*b8_19 + a9_2*b7_19
  let h7: i64 = a0*b7 + a1*b6 + a2*b5 + a3*b4 + a4*b3 + a5*b2 + a6*b1 + a7*b0 + a8*b9_19 + a9*b8_19
  let h8: i64 = a0*b8 + a1_2*b7 + a2*b6 + a3_2*b5 + a4*b4 + a5_2*b3 + a6*b2 + a7_2*b1 + a8*b0 + a9_2*b9_19
  let h9: i64 = a0*b9 + a1*b8 + a2*b7 + a3*b6 + a4*b5 + a5*b4 + a6*b3 + a7*b2 + a8*b1 + a9*b0
269
  // Carry chain twice (donna does 2 passes for full reduction).
  var c: i64 = 0
  var H0: i64 = h0 + c; c = H0 >> 26; H0 = H0 & M26
  var H1: i64 = h1 + c; c = H1 >> 25; H1 = H1 & M25
  var H2: i64 = h2 + c; c = H2 >> 26; H2 = H2 & M26
  var H3: i64 = h3 + c; c = H3 >> 25; H3 = H3 & M25
  var H4: i64 = h4 + c; c = H4 >> 26; H4 = H4 & M26
  var H5: i64 = h5 + c; c = H5 >> 25; H5 = H5 & M25
  var H6: i64 = h6 + c; c = H6 >> 26; H6 = H6 & M26
  var H7: i64 = h7 + c; c = H7 >> 25; H7 = H7 & M25
  var H8: i64 = h8 + c; c = H8 >> 26; H8 = H8 & M26
  var H9: i64 = h9 + c; c = H9 >> 25; H9 = H9 & M25
  H0 = H0 + c * 19
  c = H0 >> 26; H0 = H0 & M26
  H1 = H1 + c
285
  _fe_set(out, 0, H0); _fe_set(out, 1, H1); _fe_set(out, 2, H2)
  _fe_set(out, 3, H3); _fe_set(out, 4, H4); _fe_set(out, 5, H5)
  _fe_set(out, 6, H6); _fe_set(out, 7, H7); _fe_set(out, 8, H8)
  _fe_set(out, 9, H9)
  return 0
291}
292
293// fe_sqr: out = a * a mod p (could specialize but using fe_mul is fine for size)
294func _fe_sqr(out: *u8, a: *u8) -> i64 {
  return _fe_mul(out, a, a)
296}
297
298// fe_mul_a24: out = a * 121665 mod p  (used in Montgomery ladder)
299func _fe_mul_a24(out: *u8, a: *u8) -> i64 {
  let A24: i64 = 121665
  // Multiply each limb by 121665, then carry.
  let h0: i64 = _fe_get(a, 0) * A24
  let h1: i64 = _fe_get(a, 1) * A24
  let h2: i64 = _fe_get(a, 2) * A24
  let h3: i64 = _fe_get(a, 3) * A24
  let h4: i64 = _fe_get(a, 4) * A24
  let h5: i64 = _fe_get(a, 5) * A24
  let h6: i64 = _fe_get(a, 6) * A24
  let h7: i64 = _fe_get(a, 7) * A24
  let h8: i64 = _fe_get(a, 8) * A24
  let h9: i64 = _fe_get(a, 9) * A24
  var c: i64 = 0
  var H0: i64 = h0 + c; c = H0 >> 26; H0 = H0 & M26
  var H1: i64 = h1 + c; c = H1 >> 25; H1 = H1 & M25
  var H2: i64 = h2 + c; c = H2 >> 26; H2 = H2 & M26
  var H3: i64 = h3 + c; c = H3 >> 25; H3 = H3 & M25
  var H4: i64 = h4 + c; c = H4 >> 26; H4 = H4 & M26
  var H5: i64 = h5 + c; c = H5 >> 25; H5 = H5 & M25
  var H6: i64 = h6 + c; c = H6 >> 26; H6 = H6 & M26
  var H7: i64 = h7 + c; c = H7 >> 25; H7 = H7 & M25
  var H8: i64 = h8 + c; c = H8 >> 26; H8 = H8 & M26
  var H9: i64 = h9 + c; c = H9 >> 25; H9 = H9 & M25
  H0 = H0 + c * 19
  _fe_set(out, 0, H0); _fe_set(out, 1, H1); _fe_set(out, 2, H2)
  _fe_set(out, 3, H3); _fe_set(out, 4, H4); _fe_set(out, 5, H5)
  _fe_set(out, 6, H6); _fe_set(out, 7, H7); _fe_set(out, 8, H8)
  _fe_set(out, 9, H9)
  return 0
329}
330
331// fe_invert: out = 1/a mod p via Fermat's little theorem a^(p-2).
332// p-2 = 2^255 - 21.  Standard addition chain ~ 254 squares + 11 mults.
333// We use the donna addition chain.
334//
335// Layout of working FEs in scratch (each 10 limbs = 80 bytes):
336//   z2 at scratch+0, z9 at +80, z11 at +160, z2_5_0 at +240,
337//   z2_10_0 at +320, z2_20_0 at +400, z2_50_0 at +480,
338//   z2_100_0 at +560, t0 at +640, t1 at +720.
339func _fe_invert(out: *u8, z: *u8, scratch: *u8) -> i64 {
  let z2:       *u8 = scratch
  let z9:       *u8 = (scratch as i64 +  80) as *u8
  let z11:      *u8 = (scratch as i64 + 160) as *u8
  let z2_5_0:   *u8 = (scratch as i64 + 240) as *u8
  let z2_10_0:  *u8 = (scratch as i64 + 320) as *u8
  let z2_20_0:  *u8 = (scratch as i64 + 400) as *u8
  let z2_50_0:  *u8 = (scratch as i64 + 480) as *u8
  let z2_100_0: *u8 = (scratch as i64 + 560) as *u8
  let t0:       *u8 = (scratch as i64 + 640) as *u8
  let t1:       *u8 = (scratch as i64 + 720) as *u8
350
  _fe_sqr(z2, z)                              // 2
  _fe_sqr(t1, z2)                             // 4
  _fe_sqr(t0, t1)                             // 8
  _fe_mul(z9, t0, z)                          // 9
  _fe_mul(z11, z9, z2)                        // 11
  _fe_sqr(t0, z11)                            // 22
  _fe_mul(z2_5_0, t0, z9)                     // 2^5-2^0 = 31
358
  _fe_sqr(t0, z2_5_0)                         // 2^6-2^1
  _fe_sqr(t1, t0)                             // 2^7-2^2
  _fe_sqr(t0, t1)                             // 2^8-2^3
  _fe_sqr(t1, t0)                             // 2^9-2^4
  _fe_sqr(t0, t1)                             // 2^10-2^5
  _fe_mul(z2_10_0, t0, z2_5_0)                // 2^10-2^0
365
  _fe_sqr(t0, z2_10_0)
  _fe_sqr(t1, t0)
  var i: i64 = 1
  while i < 5 {
      _fe_sqr(t0, t1)
      _fe_sqr(t1, t0)
      i = i + 1
  }
  _fe_mul(z2_20_0, t1, z2_10_0)               // 2^20-2^0
375
  _fe_sqr(t0, z2_20_0)
  _fe_sqr(t1, t0)
  i = 1
  while i < 10 {
      _fe_sqr(t0, t1)
      _fe_sqr(t1, t0)
      i = i + 1
  }
  _fe_mul(t0, t1, z2_20_0)                    // 2^40-2^0
385
  _fe_sqr(t1, t0)
  _fe_sqr(t0, t1)
  i = 1
  while i < 5 {
      _fe_sqr(t1, t0)
      _fe_sqr(t0, t1)
      i = i + 1
  }
  _fe_mul(z2_50_0, t0, z2_10_0)               // 2^50-2^0
395
  _fe_sqr(t0, z2_50_0)
  _fe_sqr(t1, t0)
  i = 1
  while i < 25 {
      _fe_sqr(t0, t1)
      _fe_sqr(t1, t0)
      i = i + 1
  }
  _fe_mul(z2_100_0, t1, z2_50_0)              // 2^100-2^0
405
  _fe_sqr(t1, z2_100_0)
  _fe_sqr(t0, t1)
  i = 1
  while i < 50 {
      _fe_sqr(t1, t0)
      _fe_sqr(t0, t1)
      i = i + 1
  }
  _fe_mul(t1, t0, z2_100_0)                   // 2^200-2^0
415
  _fe_sqr(t0, t1)
  _fe_sqr(t1, t0)
  i = 1
  while i < 25 {
      _fe_sqr(t0, t1)
      _fe_sqr(t1, t0)
      i = i + 1
  }
  _fe_mul(t0, t1, z2_50_0)                    // 2^250-2^0
425
  _fe_sqr(t1, t0)
  _fe_sqr(t0, t1)
  _fe_sqr(t1, t0)
  _fe_sqr(t0, t1)
  _fe_sqr(t1, t0)                             // 2^255-2^5
431
  _fe_mul(out, t1, z11)                       // 2^255-21 = p-2
  return 0
434}
435
436// Conditional swap: if c == 1, swap a and b; if c == 0, leave both.
437// We use the standard XOR-mask trick to keep it side-channel friendly.
438func _fe_cswap(a: *u8, b: *u8, c: i64) -> i64 {
  var mask: i64 = 0
  if c == 1 { mask = -1 }
  var i: i64 = 0
  while i < 10 {
      let av: i64 = _fe_get(a, i)
      let bv: i64 = _fe_get(b, i)
      let xv: i64 = (av ^ bv) & mask
      _fe_set(a, i, av ^ xv)
      _fe_set(b, i, bv ^ xv)
      i = i + 1
  }
  return 0
451}
452
453// X25519 scalar multiplication: out = scalar * point on Curve25519.
454// scratch_ptr layout (>= 1024 bytes):
455//   0..79:   x1 (input u)
456//   80..159: x2
457//   160..239: z2
458//   240..319: x3
459//   320..399: z3
460//   400..479: tmp_a
461//   480..559: tmp_b
462//   560..639: tmp_c
463//   640..719: tmp_d
464//   720..799: tmp_e
465//   800+: invert scratch (>=800 more bytes)
466func nx_x25519_scalarmult(scalar_ptr: *u8, point_ptr: *u8,
                          scratch_ptr: *u8, out_ptr: *u8) -> i64 {
  // Clamp the scalar per RFC 7748 §5.
  var clamped: *u8 = (scratch_ptr as i64 + 960) as *u8
  var i: i64 = 0
  while i < 32 { clamped[i] = scalar_ptr[i]; i = i + 1 }
  clamped[0]  = clamped[0]  & 0xF8
  clamped[31] = clamped[31] & 0x7F
  clamped[31] = clamped[31] | 0x40
475
  let x1: *u8 = scratch_ptr
  let x2: *u8 = (scratch_ptr as i64 +  80) as *u8
  let z2: *u8 = (scratch_ptr as i64 + 160) as *u8
  let x3: *u8 = (scratch_ptr as i64 + 240) as *u8
  let z3: *u8 = (scratch_ptr as i64 + 320) as *u8
  let A:  *u8 = (scratch_ptr as i64 + 400) as *u8
  let B:  *u8 = (scratch_ptr as i64 + 480) as *u8
  let AA: *u8 = (scratch_ptr as i64 + 560) as *u8
  let BB: *u8 = (scratch_ptr as i64 + 640) as *u8
  let E:  *u8 = (scratch_ptr as i64 + 720) as *u8
  let CB: *u8 = (scratch_ptr as i64 + 880) as *u8     // 880..959
487
  _fe_unpack(x1, point_ptr)
489
  // x2 = 1, z2 = 0, x3 = x1, z3 = 1
  var k: i64 = 0
  while k < 10 { _fe_set(x2, k, 0); _fe_set(z2, k, 0); _fe_set(z3, k, 0); k = k + 1 }
  _fe_set(x2, 0, 1)
  _fe_copy(x3, x1)
  _fe_set(z3, 0, 1)
496
  // Montgomery ladder: 255 steps, bits 254 down to 0.
  var swap: i64 = 0
  var pos: i64 = 254
  while pos >= 0 {
      let bit: i64 = (clamped[pos / 8] >> (pos & 7)) & 1
      swap = swap ^ bit
      _fe_cswap(x2, x3, swap)
      _fe_cswap(z2, z3, swap)
      swap = bit
506
      // A = x2 + z2
      _fe_add(A, x2, z2)
      // AA = A^2
      _fe_sqr(AA, A)
      // B = x2 - z2
      _fe_sub(B, x2, z2)
      // BB = B^2
      _fe_sqr(BB, B)
      // E = AA - BB
      _fe_sub(E, AA, BB)
      // C = x3 + z3  (stored in z2 temporarily)
      _fe_add(z2, x3, z3)
      // D = x3 - z3  (stored in z3 temporarily)
      _fe_sub(z3, x3, z3)
      // DA = D * A  (stored in z3)
      _fe_mul(z3, z3, A)
      // CB = C * B
      _fe_mul(CB, z2, B)
      // x3 = (DA + CB)^2
      _fe_add(x3, z3, CB)
      _fe_sqr(x3, x3)
      // z3 = x1 * (DA - CB)^2
      _fe_sub(z2, z3, CB)
      _fe_sqr(z2, z2)
      _fe_mul(z3, z2, x1)
      // x2 = AA * BB
      _fe_mul(x2, AA, BB)
      // z2 = E * (AA + 121665*E)
      _fe_mul_a24(z2, E)
      _fe_add(z2, z2, AA)
      _fe_mul(z2, z2, E)
538
      pos = pos - 1
  }
  _fe_cswap(x2, x3, swap)
  _fe_cswap(z2, z3, swap)
543
  // Result = x2 / z2 = x2 * z2^(-1)
  let inv_scratch: *u8 = (scratch_ptr as i64 + 800) as *u8       // share 800..879 + use scratch below 1024
  let invz: *u8 = (scratch_ptr as i64 + 880) as *u8              // reuse CB
  _fe_invert(invz, z2, inv_scratch)
  _fe_mul(x2, x2, invz)
  _fe_pack(out_ptr, x2)
  return 0
551}
nx_x25519_wasm.nx source

`nx_x25519_wasm.nx` source
