From 53014b4a47adcd959640c3934d4e503021f6c21c Mon Sep 17 00:00:00 2001
From: "Pavel V. Shatov (Meister)" <meisterpaul1@yandex.ru>
Date: Sun, 1 Apr 2018 23:38:07 +0300
Subject: Added more test vectors to trigger the virtually never taken path in
 the curve point addition routine.

---
 bench/tb_curve_multiplier_256.v       | 476 ++++++++++++++++++----------------
 stm32_driver/ecdsa256_driver_sample.c |  63 ++++-
 stm32_driver/ecdsa_model.h            | 204 ---------------
 3 files changed, 301 insertions(+), 442 deletions(-)
 delete mode 100644 stm32_driver/ecdsa_model.h

diff --git a/bench/tb_curve_multiplier_256.v b/bench/tb_curve_multiplier_256.v
index 20498a2..c7839e0 100644
--- a/bench/tb_curve_multiplier_256.v
+++ b/bench/tb_curve_multiplier_256.v
@@ -43,236 +43,258 @@
 module tb_curve_multiplier_256;
 
 
-   //
-   // Test Vectors
-   //
-   localparam	[255:0]	K_1	= 256'h70a12c2db16845ed56ff68cfc21a472b3f04d7d6851bf6349f2d7d5b3452b38a;
-   localparam	[255:0]	PX_1	= 256'h8101ece47464a6ead70cf69a6e2bd3d88691a3262d22cba4f7635eaff26680a8;
-   localparam	[255:0]	PY_1	= 256'hd8a12ba61d599235f67d9cb4d58f1783d3ca43e78f0a5abaa624079936c0c3a9;
-
-   localparam	[255:0]	K_2	= 256'h580ec00d856434334cef3f71ecaed4965b12ae37fa47055b1965c7b134ee45d0;
-   localparam	[255:0]	PX_2	= 256'h7214bc9647160bbd39ff2f80533f5dc6ddd70ddf86bb815661e805d5d4e6f27c;
-   localparam	[255:0]	PY_2	= 256'h8b81e3e977597110c7cf2633435b2294b72642987defd3d4007e1cfc5df84541;
-
-   localparam	[255:0]	K_3	= 256'hffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551;
-   localparam	[255:0]	PX_3	= 256'h0000000000000000000000000000000000000000000000000000000000000000;
-   localparam	[255:0]	PY_3	= 256'h0000000000000000000000000000000000000000000000000000000000000000;
-
-
-   //
-   // Core Parameters
-   //
-   localparam	WORD_COUNTER_WIDTH	=  3;
-   localparam	OPERAND_NUM_WORDS	=  8;
-
-
-   //
-   // Clock (100 MHz)
-   //
-   reg clk = 1'b0;
-   always #5 clk = ~clk;
-
-
-   //
-   // Inputs, Outputs
-   //
-   reg rst_n;
-   reg ena;
-   wire rdy;
-
-
-   //
-   // Buffers (K, PX, PY)
-   //
-   wire [WORD_COUNTER_WIDTH-1:0] core_k_addr;
-   wire [WORD_COUNTER_WIDTH-1:0] core_px_addr;
-   wire [WORD_COUNTER_WIDTH-1:0] core_py_addr;
-
-   wire 			 core_px_wren;
-   wire 			 core_py_wren;
-
-   wire [                32-1:0] core_k_data;
-   wire [                32-1:0] core_px_data;
-   wire [                32-1:0] core_py_data;
-
-   reg [WORD_COUNTER_WIDTH-1:0]  tb_k_addr;
-   reg [WORD_COUNTER_WIDTH-1:0]  tb_pxy_addr;
-
-   reg 				 tb_k_wren;
-
-   reg [                  31:0]  tb_k_data;
-   wire [                  31:0] tb_px_data;
-   wire [                  31:0] tb_py_data;
-
-   bram_1rw_1ro_readfirst # (.MEM_WIDTH(32), .MEM_ADDR_BITS(WORD_COUNTER_WIDTH))
-   bram_k
-     (	.clk(clk),
-	.a_addr(tb_k_addr), .a_wr(tb_k_wren), .a_in(tb_k_data), .a_out(),
-	.b_addr(core_k_addr), .b_out(core_k_data)
+		//
+		// Test Vectors
+		//
+		 
+		/* Q = d * G */
+	localparam	[255:0]	K_1	= 256'h70a12c2db16845ed56ff68cfc21a472b3f04d7d6851bf6349f2d7d5b3452b38a;
+	localparam	[255:0]	PX_1	= 256'h8101ece47464a6ead70cf69a6e2bd3d88691a3262d22cba4f7635eaff26680a8;
+	localparam	[255:0]	PY_1	= 256'hd8a12ba61d599235f67d9cb4d58f1783d3ca43e78f0a5abaa624079936c0c3a9;
+
+		/* R = k * G */
+	localparam	[255:0]	K_2	= 256'h580ec00d856434334cef3f71ecaed4965b12ae37fa47055b1965c7b134ee45d0;
+	localparam	[255:0]	PX_2	= 256'h7214bc9647160bbd39ff2f80533f5dc6ddd70ddf86bb815661e805d5d4e6f27c;
+	localparam	[255:0]	PY_2	= 256'h8b81e3e977597110c7cf2633435b2294b72642987defd3d4007e1cfc5df84541;
+
+		/* O = n * G */
+	localparam	[255:0]	K_3	= 256'hffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551;
+	localparam	[255:0]	PX_3	= 256'h0000000000000000000000000000000000000000000000000000000000000000;
+	localparam	[255:0]	PY_3	= 256'h0000000000000000000000000000000000000000000000000000000000000000;
+
+		/* H = 2 * G */
+	localparam	[255:0]	K_4	= 256'h0000000000000000000000000000000000000000000000000000000000000002;
+	localparam	[255:0]	PX_4	= 256'h7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978;
+	localparam	[255:0]	PY_4	= 256'h07775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d1;
+		
+		/* G = (n + 1) * G */
+	localparam	[255:0]	K_5	= 256'hffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 + 'd1;
+	localparam	[255:0]	PX_5	= 256'h6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296;
+	localparam	[255:0]	PY_5	= 256'h4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5;
+
+		/* H = (n + 2) * G */
+	localparam	[255:0]	K_6	= 256'hffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 + 'd2;
+	localparam	[255:0]	PX_6	= 256'h7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978;
+	localparam	[255:0]	PY_6	= 256'h07775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d1;
+				
+		
+		//
+		// Core Parameters
+		//
+	localparam	WORD_COUNTER_WIDTH	=  3;
+	localparam	OPERAND_NUM_WORDS		=  8;
+	
+
+		//
+		// Clock (100 MHz)
+		//
+	reg clk = 1'b0;
+	always #5 clk = ~clk;
+
+	
+		//
+		// Inputs, Outputs
+		//
+	reg	rst_n;
+	reg	ena;
+	wire	rdy;
+
+	
+		//
+		// Buffers (K, PX, PY)
+		//
+	wire	[WORD_COUNTER_WIDTH-1:0]	core_k_addr;
+	wire	[WORD_COUNTER_WIDTH-1:0]	core_px_addr;
+	wire	[WORD_COUNTER_WIDTH-1:0]	core_py_addr;
+	
+	wire										core_px_wren;
+	wire										core_py_wren;
+	
+	wire	[                32-1:0]	core_k_data;
+	wire	[                32-1:0]	core_px_data;
+	wire	[                32-1:0]	core_py_data;
+	
+	reg	[WORD_COUNTER_WIDTH-1:0]	tb_k_addr;
+	reg	[WORD_COUNTER_WIDTH-1:0]	tb_pxy_addr;
+	
+	reg										tb_k_wren;
+	
+	reg	[                  31:0]	tb_k_data;
+	wire	[                  31:0]	tb_px_data;
+	wire	[                  31:0]	tb_py_data;
+	
+	bram_1rw_1ro_readfirst # (.MEM_WIDTH(32), .MEM_ADDR_BITS(WORD_COUNTER_WIDTH))
+	bram_k
+	(	.clk(clk),
+		.a_addr(tb_k_addr), .a_wr(tb_k_wren), .a_in(tb_k_data), .a_out(),
+		.b_addr(core_k_addr), .b_out(core_k_data)
 	);
-
-   bram_1rw_1ro_readfirst # (.MEM_WIDTH(32), .MEM_ADDR_BITS(WORD_COUNTER_WIDTH))
-   bram_px
-     (	.clk(clk),
-	.a_addr(core_px_addr), .a_wr(core_px_wren), .a_in(core_px_data), .a_out(),
-	.b_addr(tb_pxy_addr), .b_out(tb_px_data)
+	
+	bram_1rw_1ro_readfirst # (.MEM_WIDTH(32), .MEM_ADDR_BITS(WORD_COUNTER_WIDTH))
+	bram_px
+	(	.clk(clk),
+		.a_addr(core_px_addr), .a_wr(core_px_wren), .a_in(core_px_data), .a_out(),
+		.b_addr(tb_pxy_addr), .b_out(tb_px_data)
 	);
-
-   bram_1rw_1ro_readfirst # (.MEM_WIDTH(32), .MEM_ADDR_BITS(WORD_COUNTER_WIDTH))
-   bram_py
-     (	.clk(clk),
-	.a_addr(core_py_addr), .a_wr(core_py_wren), .a_in(core_py_data), .a_out(),
-	.b_addr(tb_pxy_addr), .b_out(tb_py_data)
+	
+	bram_1rw_1ro_readfirst # (.MEM_WIDTH(32), .MEM_ADDR_BITS(WORD_COUNTER_WIDTH))
+	bram_py
+	(	.clk(clk),
+		.a_addr(core_py_addr), .a_wr(core_py_wren), .a_in(core_py_data), .a_out(),
+		.b_addr(tb_pxy_addr), .b_out(tb_py_data)
 	);
-
-
-   //
-   // UUT
-   //
-   curve_mul_256 uut
-     (
-      .clk			(clk),
-      .rst_n		(rst_n),
-
-      .ena			(ena),
-      .rdy			(rdy),
-
-      .k_addr		(core_k_addr),
-      .rx_addr		(core_px_addr),
-      .ry_addr		(core_py_addr),
-
-      .rx_wren		(core_px_wren),
-      .ry_wren		(core_py_wren),
-
-      .k_din		(core_k_data),
-
-      .rx_dout		(core_px_data),
-      .ry_dout		(core_py_data)
-      );
-
-
-   //
-   // Testbench Routine
-   //
-   reg 				 ok = 1;
-   initial begin
-
-      /* initialize control inputs */
-      rst_n		= 0;
-      ena		= 0;
-
-      /* wait for some time */
-      #200;
-
-      /* de-assert reset */
-      rst_n		= 1;
-
-      /* wait for some time */
-      #100;
-
-      /* run tests */
-      test_curve_multiplier(K_1, PX_1, PY_1);
-      test_curve_multiplier(K_2, PX_2, PY_2);
-      test_curve_multiplier(K_3, PX_3, PY_3);
-
-      /* print result */
-      if (ok)	$display("tb_curve_multiplier_256: SUCCESS");
-      else	$display("tb_curve_multiplier_256: FAILURE");
-      //
-      //$finish;
-      //
-   end
-
-
-   //
-   // Test Task
-   //
-   reg		p_ok;
-
-   integer	w;
-
-   task test_curve_multiplier;
-
-      input	[255:0]	k;
-      input [255:0] 	px;
-      input [255:0] 	py;
-
-      reg [255:0] 	k_shreg;
-      reg [255:0] 	px_shreg;
-      reg [255:0] 	py_shreg;
-
-      begin
-
-	 /* start filling memories */
-	 tb_k_wren = 1;
-
-	 /* initialize shift registers */
-	 k_shreg = k;
-
-	 /* write all the words */
-	 for (w=0; w<OPERAND_NUM_WORDS; w=w+1) begin
-
-	    /* set addresses */
-	    tb_k_addr = w[WORD_COUNTER_WIDTH-1:0];
-
-	    /* set data words */
-	    tb_k_data	= k_shreg[31:0];
-
-	    /* shift inputs */
-	    k_shreg = {{32{1'bX}}, k_shreg[255:32]};
-
-	    /* wait for 1 clock tick */
-	    #10;
-
-	 end
-
-	 /* wipe addresses */
-	 tb_k_addr = {WORD_COUNTER_WIDTH{1'bX}};
-
-	 /* wipe data words */
-	 tb_k_data = {32{1'bX}};
-
-	 /* stop filling memories */
-	 tb_k_wren = 0;
-
-	 /* start operation */
-	 ena = 1;
-
-	 /* clear flag */
-	 #10 ena = 0;
-
-	 /* wait for operation to complete */
-	 while (!rdy) #10;
-
-	 /* read result */
-	 for (w=0; w<OPERAND_NUM_WORDS; w=w+1) begin
-
-	    /* set address */
-	    tb_pxy_addr = w[WORD_COUNTER_WIDTH-1:0];
-
-	    /* wait for 1 clock tick */
-	    #10;
-
-	    /* store data word */
-	    px_shreg = {tb_px_data, px_shreg[255:32]};
-	    py_shreg = {tb_py_data, py_shreg[255:32]};
-
-	 end
-
-	 /* compare */
-	 p_ok =	(px_shreg == px) &&
-	       (py_shreg == py);
-
-	 /* display results */
-	 $display("test_curve_multiplier(): %s", p_ok ? "OK" : "ERROR");
-
-	 /* update global flag */
-	 ok = ok && p_ok;
-
-      end
-
-   endtask
-
+	
+	
+		//
+		// UUT
+		//
+	curve_mul_256 uut
+	(
+		.clk			(clk),
+		.rst_n		(rst_n),
+		
+		.ena			(ena),
+		.rdy			(rdy),
+		
+		.k_addr		(core_k_addr),
+		.rx_addr		(core_px_addr),
+		.ry_addr		(core_py_addr),
+		
+		.rx_wren		(core_px_wren),
+		.ry_wren		(core_py_wren),
+		
+		.k_din		(core_k_data),
+		
+		.rx_dout		(core_px_data),
+		.ry_dout		(core_py_data)
+	);
+		
+		
+		//
+		// Testbench Routine
+		//
+	reg ok = 1;
+	initial begin
+		
+			/* initialize control inputs */
+		rst_n		= 0;
+		ena		= 0;
+		
+			/* wait for some time */
+		#200;
+		
+			/* de-assert reset */
+		rst_n		= 1;
+		
+			/* wait for some time */
+		#100;		
+		
+			/* run tests */
+		//test_curve_multiplier(K_1, PX_1, PY_1);
+		//test_curve_multiplier(K_2, PX_2, PY_2);
+		//test_curve_multiplier(K_3, PX_3, PY_3);
+		//test_curve_multiplier(K_4, PX_4, PY_4);
+		//test_curve_multiplier(K_5, PX_5, PY_5);
+		test_curve_multiplier(K_6, PX_6, PY_6);
+		
+			/* print result */
+		if (ok)	$display("tb_curve_multiplier_256: SUCCESS");
+		else		$display("tb_curve_multiplier_256: FAILURE");
+		//
+		//$finish;
+		//
+	end
+	
+	
+		//
+		// Test Task
+		//	
+	reg		p_ok;
+	
+	integer	w;
+
+	task test_curve_multiplier;
+	
+		input	[255:0]	k;
+		input	[255:0]	px;
+		input	[255:0]	py;
+		
+		reg	[255:0]	k_shreg;
+		reg	[255:0]	px_shreg;
+		reg	[255:0]	py_shreg;
+		
+		begin
+		
+				/* start filling memories */
+			tb_k_wren = 1;
+			
+				/* initialize shift registers */
+			k_shreg = k;
+			
+				/* write all the words */
+			for (w=0; w<OPERAND_NUM_WORDS; w=w+1) begin
+				
+					/* set addresses */
+				tb_k_addr = w[WORD_COUNTER_WIDTH-1:0];
+				
+					/* set data words */
+				tb_k_data	= k_shreg[31:0];
+				
+					/* shift inputs */
+				k_shreg = {{32{1'bX}}, k_shreg[255:32]};
+				
+					/* wait for 1 clock tick */
+				#10;
+				
+			end
+			
+				/* wipe addresses */
+			tb_k_addr = {WORD_COUNTER_WIDTH{1'bX}};
+			
+				/* wipe data words */
+			tb_k_data = {32{1'bX}};
+			
+				/* stop filling memories */
+			tb_k_wren = 0;
+			
+				/* start operation */
+			ena = 1;
+			
+				/* clear flag */
+			#10 ena = 0;
+			
+				/* wait for operation to complete */
+			while (!rdy) #10;
+			
+				/* read result */
+			for (w=0; w<OPERAND_NUM_WORDS; w=w+1) begin
+				
+					/* set address */
+				tb_pxy_addr = w[WORD_COUNTER_WIDTH-1:0];
+				
+					/* wait for 1 clock tick */
+				#10;
+				
+					/* store data word */
+				px_shreg = {tb_px_data, px_shreg[255:32]};
+				py_shreg = {tb_py_data, py_shreg[255:32]};
+
+			end
+			
+				/* compare */
+			p_ok =	(px_shreg == px) &&
+						(py_shreg == py);
+
+				/* display results */
+			$display("test_curve_multiplier(): %s", p_ok ? "OK" : "ERROR");
+			
+				/* update global flag */
+			ok = ok && p_ok;
+		
+		end
+		
+	endtask
+	
 endmodule
 
 
diff --git a/stm32_driver/ecdsa256_driver_sample.c b/stm32_driver/ecdsa256_driver_sample.c
index 8047e98..fcfd3ae 100644
--- a/stm32_driver/ecdsa256_driver_sample.c
+++ b/stm32_driver/ecdsa256_driver_sample.c
@@ -1,5 +1,5 @@
 //
-// simple driver to test "ecdsa384" core in hardware
+// simple driver to test "ecdsa256" core in hardware
 //
 
 //
@@ -31,7 +31,7 @@
 // curve selection
 #define USE_CURVE			1
 
-#include "ecdsa_model.h"
+#include "../../../user/shatov/ecdsa_fpga_model/ecdsa_model.h"
 
 #define BUF_NUM_WORDS		(OPERAND_WIDTH / (sizeof(uint32_t) << 3))	// 8
 
@@ -50,9 +50,16 @@ static const uint32_t p256_i[BUF_NUM_WORDS]  = ECDSA_ONE;
 static const uint32_t p256_gx[BUF_NUM_WORDS] = ECDSA_G_X;
 static const uint32_t p256_gy[BUF_NUM_WORDS] = ECDSA_G_Y;
 
+static const uint32_t p256_hx[BUF_NUM_WORDS] = ECDSA_H_X;
+static const uint32_t p256_hy[BUF_NUM_WORDS] = ECDSA_H_Y;
+
 static const uint32_t p256_z[BUF_NUM_WORDS]  = ECDSA_ZERO;
 static const uint32_t p256_n[BUF_NUM_WORDS]  = ECDSA_N;
 
+static uint32_t p256_2[BUF_NUM_WORDS];	// 2
+static uint32_t p256_n1[BUF_NUM_WORDS];	// n + 1
+static uint32_t p256_n2[BUF_NUM_WORDS];	// n + 2
+
 //
 // prototypes
 //
@@ -88,20 +95,54 @@ int main()
     while (1);
   }
 
+	// prepare more numbers
+	size_t w;
+	for (w=0; w<BUF_NUM_WORDS; w++)
+	{	p256_2[w]  = p256_z[w];	// p256_2 = p256_z = 0
+		p256_n1[w] = p256_n[w];	// p256_n1 = p256_n = N
+		p256_n2[w] = p256_n[w];	// p256_n2 = p256_n = N
+	}
+	
+	p256_2[BUF_NUM_WORDS-1]  += 2;	// p256_2 = 2
+	p256_n1[BUF_NUM_WORDS-1] += 1;	// p256_n1 = N + 1
+	p256_n2[BUF_NUM_WORDS-1] += 2;	// p256_n2 = N + 2
+	
+	
+	
   // repeat forever
   while (1)
     {
       ok = 1;
-      ok = ok && test_p256_multiplier(p256_d, p256_qx, p256_qy);
-      ok = ok && test_p256_multiplier(p256_k, p256_rx, p256_ry);
-      ok = ok && test_p256_multiplier(p256_z, p256_z,  p256_z);
-      ok = ok && test_p256_multiplier(p256_i, p256_gx, p256_gy);
-      ok = ok && test_p256_multiplier(p256_n, p256_z,  p256_z);
-
+			
+      ok = ok && test_p256_multiplier(p256_d, p256_qx, p256_qy);	/* Q = d * G */
+      ok = ok && test_p256_multiplier(p256_k, p256_rx, p256_ry);	/* R = k * G */
+			
+      ok = ok && test_p256_multiplier(p256_z, p256_z,  p256_z);		/* O = 0 * G */
+      ok = ok && test_p256_multiplier(p256_i, p256_gx, p256_gy);	/* G = 1 * G */
+			
+      ok = ok && test_p256_multiplier(p256_n, p256_z,  p256_z);		/* O = n * G */
+
+			ok = ok && test_p256_multiplier(p256_n1, p256_gx, p256_gy);	/* G = (n + 1) * G */
+			
+			//
+			// The following two vectors test the virtually never taken path in the curve point
+			// addition routine when both input points are the same. During the first test (2 * G)
+			// the double of the base point is computed at the second doubling step of the multiplication
+			// algorithm, which does not require any special handling. During the second test the
+			// precomputed double of the base point (stored in internal read-only memory) is returned,
+			// because after doubling of G * ((n + 1) / 2) we get G * (n + 1) = G. The adder then has to
+			// compute G + G for which the formulae don't work, and special handling is required. The two
+			// test vectors verify that the hardcoded double of the base point matches the one computed
+			// on the fly. Note that in practice one should never be multiplying by anything larger than (n-1),
+			// because both the secret key and the per-message (random) number must be from [1, n-1].
+			//
+			ok = ok && test_p256_multiplier(p256_2, p256_hx, p256_hy);	/* H = 2 * G */
+			ok = ok && test_p256_multiplier(p256_n2, p256_hx, p256_hy);	/* H = (n + 2) * G */			
+			
       if (!ok) {
-	led_off(LED_GREEN);
-	led_on(LED_RED);
-      }
+				led_off(LED_GREEN);
+				led_on(LED_RED);
+			}
 
       toggle_yellow_led();
     }
diff --git a/stm32_driver/ecdsa_model.h b/stm32_driver/ecdsa_model.h
deleted file mode 100644
index 620c56e..0000000
--- a/stm32_driver/ecdsa_model.h
+++ /dev/null
@@ -1,204 +0,0 @@
-//------------------------------------------------------------------------------
-//
-// ecdsa_model.h
-// --------------------------------------------
-// Base point scalar multiplier model for ECDSA
-//
-// Authors: Pavel Shatov
-//
-// Copyright (c) 2015-2016, NORDUnet A/S
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are met:
-//
-// - Redistributions of source code must retain the above copyright notice,
-//   this list of conditions and the following disclaimer.
-//
-// - Redistributions in binary form must reproduce the above copyright notice,
-//   this list of conditions and the following disclaimer in the documentation
-//   and/or other materials provided with the distribution.
-//
-// - Neither the name of the NORDUnet nor the names of its contributors may be
-//   used to endorse or promote products derived from this software without
-//   specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-// ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
-// LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-// SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-// INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-// CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-// ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-// POSSIBILITY OF SUCH DAMAGE.
-//
-//------------------------------------------------------------------------------
-
-
-//------------------------------------------------------------------------------
-//
-// Curve Selection
-//
-// USE_CURVE == 1  -> P-256
-// USE_CURVE == 2  -> P-384
-//
-//------------------------------------------------------------------------------
-
-
-//------------------------------------------------------------------------------
-// Model Parameters
-//------------------------------------------------------------------------------
-#if USE_CURVE == 1
-#define OPERAND_WIDTH	(256)	// largest supported operand width in bits
-#elif USE_CURVE == 2
-#define OPERAND_WIDTH	(384)	// largest supported operand width in bits
-#else
-#error USE_CURVE must be either 1 or 2!
-#endif
-
-
-//------------------------------------------------------------------------------
-// P-256 Parameters and Test Vectors
-//------------------------------------------------------------------------------
-
-/* Field Size */
-#define P_256_Q			{0xffffffff, 0x00000001, 0x00000000, 0x00000000, 0x00000000, 0xffffffff, 0xffffffff, 0xffffffff}
-
-/* Generic Numbers */
-#define P_256_ZERO		{0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000}
-#define P_256_ONE		{0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000001}
-
-/* Division Factor  */
-#define P_256_DELTA		{0x7fffffff, 0x80000000, 0x80000000, 0x00000000, 0x00000000, 0x80000000, 0x00000000, 0x00000000}
-
-/* Base Point */
-#define P_256_G_X		{0x6b17d1f2, 0xe12c4247, 0xf8bce6e5, 0x63a440f2, 0x77037d81, 0x2deb33a0, 0xf4a13945, 0xd898c296}
-#define P_256_G_Y		{0x4fe342e2, 0xfe1a7f9b, 0x8ee7eb4a, 0x7c0f9e16, 0x2bce3357, 0x6b315ece, 0xcbb64068, 0x37bf51f5}
-
-/* Doubled Base Point */
-#define P_256_H_X		{0x29d05c19, 0x3da77b71, 0x0e863235, 0x38b77e1b, 0x11f904fe, 0xa42998be, 0x16bd8d74, 0x4ece7ad0}
-#define P_256_H_Y		{0xb01cbd1c, 0x01e58065, 0x711814b5, 0x83f061e9, 0xd431cca9, 0x94cea131, 0x3449bf97, 0xc840ae07}
-
-/* Base Point Order */
-#define P_256_N			{0xffffffff, 0x00000000, 0xffffffff, 0xffffffff, 0xbce6faad, 0xa7179e84, 0xf3b9cac2, 0xfc632551}
-
-/* Private Key */
-#define P_256_D			{0x70a12c2d, 0xb16845ed, 0x56ff68cf, 0xc21a472b, 0x3f04d7d6, 0x851bf634, 0x9f2d7d5b, 0x3452b38a}
-
-/* Per-message Random Number */
-#define P_256_K			{0x580ec00d, 0x85643433, 0x4cef3f71, 0xecaed496, 0x5b12ae37, 0xfa47055b, 0x1965c7b1, 0x34ee45d0}
-
-/* Public Key */
-#define P_256_Q_X		{0x8101ece4, 0x7464a6ea, 0xd70cf69a, 0x6e2bd3d8, 0x8691a326, 0x2d22cba4, 0xf7635eaf, 0xf26680a8}
-#define P_256_Q_Y		{0xd8a12ba6, 0x1d599235, 0xf67d9cb4, 0xd58f1783, 0xd3ca43e7, 0x8f0a5aba, 0xa6240799, 0x36c0c3a9}
-
-/* Part of Signature */
-#define P_256_R_X		{0x7214bc96, 0x47160bbd, 0x39ff2f80, 0x533f5dc6, 0xddd70ddf, 0x86bb8156, 0x61e805d5, 0xd4e6f27c}
-#define P_256_R_Y		{0x8b81e3e9, 0x77597110, 0xc7cf2633, 0x435b2294, 0xb7264298, 0x7defd3d4, 0x007e1cfc, 0x5df84541}
-
-
-//------------------------------------------------------------------------------
-// P-384 Parameters and Test Vectors
-//------------------------------------------------------------------------------
-
-/* Field Size */
-#define P_384_Q			{0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xfffffffe, 0xffffffff, 0x00000000, 0x00000000, 0xffffffff}
-
-/* Generic Numbers */
-#define P_384_ZERO		{0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000}
-#define P_384_ONE		{0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000001}
-
-/* Division Factor  */
-#define P_384_DELTA		{0x7fffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x7fffffff, 0x80000000, 0x0000000, 0x080000000}
-
-/* Base Point */
-#define P_384_G_X		{0xaa87ca22, 0xbe8b0537, 0x8eb1c71e, 0xf320ad74, 0x6e1d3b62, 0x8ba79b98, 0x59f741e0, 0x82542a38, 0x5502f25d, 0xbf55296c, 0x3a545e38, 0x72760ab7}
-#define P_384_G_Y		{0x3617de4a, 0x96262c6f, 0x5d9e98bf, 0x9292dc29, 0xf8f41dbd, 0x289a147c, 0xe9da3113, 0xb5f0b8c0, 0x0a60b1ce, 0x1d7e819d, 0x7a431d7c, 0x90ea0e5f}
-
-/* Doubled Base Point */
-#define P_384_H_X		{0xaaf06bba, 0x82e9f590, 0xe29c71c2, 0x19bea517, 0x23c5893a, 0xe8b0c8cf, 0x4c117c3e, 0xfb57ab8d, 0x55fa1b42, 0x8155ad27, 0x8b574391, 0x1b13ea8a}
-#define P_384_H_Y		{0xc9e821b5, 0x69d9d390, 0xa2616740, 0x6d6d23d6, 0x070be242, 0xd765eb83, 0x1625ceec, 0x4a0f473e, 0xf59f4e30, 0xe2817e62, 0x85bce284, 0x6f15f19d}
-
-/* Base Point Order */
-#define P_384_N			{0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xc7634d81, 0xf4372ddf, 0x581a0db2, 0x48b0a77a, 0xecec196a, 0xccc52973}
-
-/* Private Key */
-#define P_384_D			{0xc838b852, 0x53ef8dc7, 0x394fa580, 0x8a518398, 0x1c7deef5, 0xa69ba8f4, 0xf2117ffe, 0xa39cfcd9, 0x0e95f6cb, 0xc854abac, 0xab701d50, 0xc1f3cf24}
-
-/* Per-message Random Number */
-#define P_384_K			{0xdc6b4403, 0x6989a196, 0xe39d1cda, 0xc000812f, 0x4bdd8b2d, 0xb41bb33a, 0xf5137258, 0x5ebd1db6, 0x3f0ce827, 0x5aa1fd45, 0xe2d2a735, 0xf8749359}
-
-/* Public Key */
-#define P_384_Q_X		{0x1fbac8ee, 0xbd0cbf35, 0x640b39ef, 0xe0808dd7, 0x74debff2, 0x0a2a329e, 0x91713baf, 0x7d7f3c3e, 0x81546d88, 0x3730bee7, 0xe48678f8, 0x57b02ca0}
-#define P_384_Q_Y		{0xeb213103, 0xbd68ce34, 0x3365a8a4, 0xc3d4555f, 0xa385f533, 0x0203bdd7, 0x6ffad1f3, 0xaffb9575, 0x1c132007, 0xe1b24035, 0x3cb0a4cf, 0x1693bdf9}
-
-/* Part of Signature */
-#define P_384_R_X		{0xa0c27ec8, 0x93092dea, 0x1e1bd2cc, 0xfed3cf94, 0x5c8134ed, 0x0c9f8131, 0x1a0f4a05, 0x942db8db, 0xed8dd59f, 0x267471d5, 0x462aa14f, 0xe72de856}
-#define P_384_R_Y		{0x85564940, 0x9815bb91, 0x424eaca5, 0xfd76c973, 0x75d575d1, 0x422ec53d, 0x343bd33b, 0x847fdf0c, 0x11569685, 0xb528ab25, 0x49301542, 0x8d7cf72b}
-
-
-//------------------------------------------------------------------------------
-// Parameter and Test Vector Selection
-//------------------------------------------------------------------------------
-#if USE_CURVE == 1
-
-#define ECDSA_Q			P_256_Q
-
-#define ECDSA_ZERO		P_256_ZERO
-#define ECDSA_ONE		P_256_ONE
-
-#define ECDSA_DELTA		P_256_DELTA
-
-#define ECDSA_G_X		P_256_G_X
-#define ECDSA_G_Y		P_256_G_Y
-
-#define ECDSA_H_X		P_256_H_X
-#define ECDSA_H_Y		P_256_H_Y
-
-#define ECDSA_N			P_256_N
-#define ECDSA_D			P_256_D
-#define ECDSA_K			P_256_K
-
-#define ECDSA_Q_X		P_256_Q_X
-#define ECDSA_Q_Y		P_256_Q_Y
-
-#define ECDSA_R_X		P_256_R_X
-#define ECDSA_R_Y		P_256_R_Y
-
-#elif USE_CURVE == 2
-
-#define ECDSA_Q			P_384_Q
-
-#define ECDSA_ZERO		P_384_ZERO
-#define ECDSA_ONE		P_384_ONE
-
-#define ECDSA_DELTA		P_384_DELTA
-
-#define ECDSA_G_X		P_384_G_X
-#define ECDSA_G_Y		P_384_G_Y
-
-#define ECDSA_H_X		P_384_H_X
-#define ECDSA_H_Y		P_384_H_Y
-
-#define ECDSA_N			P_384_N
-#define ECDSA_D			P_384_D
-#define ECDSA_K			P_384_K
-
-#define ECDSA_Q_X		P_384_Q_X
-#define ECDSA_Q_Y		P_384_Q_Y
-
-#define ECDSA_R_X		P_384_R_X
-#define ECDSA_R_Y		P_384_R_Y
-
-#else
-
-#error USE_CURVE must be either 1 or 2!
-
-#endif
-
-
-//------------------------------------------------------------------------------
-// End-of-File
-//------------------------------------------------------------------------------
-- 
cgit v1.2.3