public ECPoint twicePlus(ECPoint b) {
if (this.isInfinity()) {
return b;
}
if (b.isInfinity()) {
return twice();
}
ECCurve curve = this.getCurve();
ECFieldElement X1 = this.x;
if (X1.isZero()) {
// A point with X == 0 is it's own additive inverse
return b;
}
// NOTE: twicePlus() only optimized for lambda-affine argument
ECFieldElement X2 = b.getRawXCoord(), Z2 = b.getZCoord(0);
if (X2.isZero() || !Z2.isOne()) {
return twice().add(b);
}
ECFieldElement L1 = this.y, Z1 = this.zs[0];
ECFieldElement L2 = b.getRawYCoord();
ECFieldElement X1Sq = X1.square();
ECFieldElement L1Sq = L1.square();
ECFieldElement Z1Sq = Z1.square();
ECFieldElement L1Z1 = L1.multiply(Z1);
// ECFieldElement T = curve.getA().multiply(Z1Sq).add(L1Sq).add(L1Z1);
ECFieldElement T = L1Sq.add(L1Z1);
ECFieldElement L2plus1 = L2.addOne();
// ECFieldElement A =
// curve.getA().add(L2plus1).multiply(Z1Sq).add(L1Sq).multiplyPlusProduct(T, X1Sq, Z1Sq);
ECFieldElement A = L2plus1.multiply(Z1Sq).add(L1Sq).multiplyPlusProduct(T, X1Sq, Z1Sq);
ECFieldElement X2Z1Sq = X2.multiply(Z1Sq);
ECFieldElement B = X2Z1Sq.add(T).square();
if (B.isZero()) {
if (A.isZero()) {
return b.twice();
}
return curve.getInfinity();
}
if (A.isZero()) {
// return new SecT283K1Point(curve, A, curve.getB().sqrt(), withCompression);
return new SecT283K1Point(curve, A, curve.getB(), withCompression);
}
ECFieldElement X3 = A.square().multiply(X2Z1Sq);
ECFieldElement Z3 = A.multiply(B).multiply(Z1Sq);
ECFieldElement L3 = A.add(B).square().multiplyPlusProduct(T, L2plus1, Z3);
return new SecT283K1Point(curve, X3, L3, new ECFieldElement[] {Z3}, this.withCompression);
}
public ECPoint add(ECPoint b) {
if (this.isInfinity()) {
return b;
}
if (b.isInfinity()) {
return this;
}
if (this == b) {
return twice();
}
ECCurve curve = this.getCurve();
SecP384R1FieldElement X1 = (SecP384R1FieldElement) this.x, Y1 = (SecP384R1FieldElement) this.y;
SecP384R1FieldElement X2 = (SecP384R1FieldElement) b.getXCoord(),
Y2 = (SecP384R1FieldElement) b.getYCoord();
SecP384R1FieldElement Z1 = (SecP384R1FieldElement) this.zs[0];
SecP384R1FieldElement Z2 = (SecP384R1FieldElement) b.getZCoord(0);
int c;
int[] tt1 = Nat.create(24);
int[] tt2 = Nat.create(24);
int[] t3 = Nat.create(12);
int[] t4 = Nat.create(12);
boolean Z1IsOne = Z1.isOne();
int[] U2, S2;
if (Z1IsOne) {
U2 = X2.x;
S2 = Y2.x;
} else {
S2 = t3;
SecP384R1Field.square(Z1.x, S2);
U2 = tt2;
SecP384R1Field.multiply(S2, X2.x, U2);
SecP384R1Field.multiply(S2, Z1.x, S2);
SecP384R1Field.multiply(S2, Y2.x, S2);
}
boolean Z2IsOne = Z2.isOne();
int[] U1, S1;
if (Z2IsOne) {
U1 = X1.x;
S1 = Y1.x;
} else {
S1 = t4;
SecP384R1Field.square(Z2.x, S1);
U1 = tt1;
SecP384R1Field.multiply(S1, X1.x, U1);
SecP384R1Field.multiply(S1, Z2.x, S1);
SecP384R1Field.multiply(S1, Y1.x, S1);
}
int[] H = Nat.create(12);
SecP384R1Field.subtract(U1, U2, H);
int[] R = Nat.create(12);
SecP384R1Field.subtract(S1, S2, R);
// Check if b == this or b == -this
if (Nat.isZero(12, H)) {
if (Nat.isZero(12, R)) {
// this == b, i.e. this must be doubled
return this.twice();
}
// this == -b, i.e. the result is the point at infinity
return curve.getInfinity();
}
int[] HSquared = t3;
SecP384R1Field.square(H, HSquared);
int[] G = Nat.create(12);
SecP384R1Field.multiply(HSquared, H, G);
int[] V = t3;
SecP384R1Field.multiply(HSquared, U1, V);
SecP384R1Field.negate(G, G);
Nat384.mul(S1, G, tt1);
c = Nat.addBothTo(12, V, V, G);
SecP384R1Field.reduce32(c, G);
SecP384R1FieldElement X3 = new SecP384R1FieldElement(t4);
SecP384R1Field.square(R, X3.x);
SecP384R1Field.subtract(X3.x, G, X3.x);
SecP384R1FieldElement Y3 = new SecP384R1FieldElement(G);
SecP384R1Field.subtract(V, X3.x, Y3.x);
Nat384.mul(Y3.x, R, tt2);
SecP384R1Field.addExt(tt1, tt2, tt1);
SecP384R1Field.reduce(tt1, Y3.x);
SecP384R1FieldElement Z3 = new SecP384R1FieldElement(H);
if (!Z1IsOne) {
SecP384R1Field.multiply(Z3.x, Z1.x, Z3.x);
}
if (!Z2IsOne) {
SecP384R1Field.multiply(Z3.x, Z2.x, Z3.x);
}
ECFieldElement[] zs = new ECFieldElement[] {Z3};
return new SecP384R1Point(curve, X3, Y3, zs, this.withCompression);
}
public ECPoint add(ECPoint b) {
if (this.isInfinity()) {
return b;
}
if (b.isInfinity()) {
return this;
}
ECCurve curve = this.getCurve();
ECFieldElement X1 = this.x;
ECFieldElement X2 = b.getRawXCoord();
if (X1.isZero()) {
if (X2.isZero()) {
return curve.getInfinity();
}
return b.add(this);
}
ECFieldElement L1 = this.y, Z1 = this.zs[0];
ECFieldElement L2 = b.getRawYCoord(), Z2 = b.getZCoord(0);
boolean Z1IsOne = Z1.isOne();
ECFieldElement U2 = X2, S2 = L2;
if (!Z1IsOne) {
U2 = U2.multiply(Z1);
S2 = S2.multiply(Z1);
}
boolean Z2IsOne = Z2.isOne();
ECFieldElement U1 = X1, S1 = L1;
if (!Z2IsOne) {
U1 = U1.multiply(Z2);
S1 = S1.multiply(Z2);
}
ECFieldElement A = S1.add(S2);
ECFieldElement B = U1.add(U2);
if (B.isZero()) {
if (A.isZero()) {
return twice();
}
return curve.getInfinity();
}
ECFieldElement X3, L3, Z3;
if (X2.isZero()) {
// TODO This can probably be optimized quite a bit
ECPoint p = this.normalize();
X1 = p.getXCoord();
ECFieldElement Y1 = p.getYCoord();
ECFieldElement Y2 = L2;
ECFieldElement L = Y1.add(Y2).divide(X1);
// X3 = L.square().add(L).add(X1).add(curve.getA());
X3 = L.square().add(L).add(X1);
if (X3.isZero()) {
// return new SecT283K1Point(curve, X3, curve.getB().sqrt(),
// this.withCompression);
return new SecT283K1Point(curve, X3, curve.getB(), this.withCompression);
}
ECFieldElement Y3 = L.multiply(X1.add(X3)).add(X3).add(Y1);
L3 = Y3.divide(X3).add(X3);
Z3 = curve.fromBigInteger(ECConstants.ONE);
} else {
B = B.square();
ECFieldElement AU1 = A.multiply(U1);
ECFieldElement AU2 = A.multiply(U2);
X3 = AU1.multiply(AU2);
if (X3.isZero()) {
// return new SecT283K1Point(curve, X3, curve.getB().sqrt(),
// this.withCompression);
return new SecT283K1Point(curve, X3, curve.getB(), this.withCompression);
}
ECFieldElement ABZ2 = A.multiply(B);
if (!Z2IsOne) {
ABZ2 = ABZ2.multiply(Z2);
}
L3 = AU2.add(B).squarePlusProduct(ABZ2, L1.add(Z1));
Z3 = ABZ2;
if (!Z1IsOne) {
Z3 = Z3.multiply(Z1);
}
}
return new SecT283K1Point(curve, X3, L3, new ECFieldElement[] {Z3}, this.withCompression);
}