1package org.bouncycastle.math.ec.custom.sec;
2
3import java.math.BigInteger;
4
5import org.bouncycastle.math.ec.ECFieldElement;
6import org.bouncycastle.math.raw.Mod;
7import org.bouncycastle.math.raw.Nat224;
8import org.bouncycastle.util.Arrays;
9
10public class SecP224K1FieldElement extends ECFieldElement
11{
12    public static final BigInteger Q = SecP224K1Curve.q;
13
14    // Calculated as ECConstants.TWO.modPow(Q.shiftRight(2), Q)
15    private static final int[] PRECOMP_POW2 = new int[]{ 0x33bfd202, 0xdcfad133, 0x2287624a, 0xc3811ba8,
16        0xa85558fc, 0x1eaef5d7, 0x8edf154c };
17
18    protected int[] x;
19
20    public SecP224K1FieldElement(BigInteger x)
21    {
22        if (x == null || x.signum() < 0 || x.compareTo(Q) >= 0)
23        {
24            throw new IllegalArgumentException("x value invalid for SecP224K1FieldElement");
25        }
26
27        this.x = SecP224K1Field.fromBigInteger(x);
28    }
29
30    public SecP224K1FieldElement()
31    {
32        this.x = Nat224.create();
33    }
34
35    protected SecP224K1FieldElement(int[] x)
36    {
37        this.x = x;
38    }
39
40    public boolean isZero()
41    {
42        return Nat224.isZero(x);
43    }
44
45    public boolean isOne()
46    {
47        return Nat224.isOne(x);
48    }
49
50    public boolean testBitZero()
51    {
52        return Nat224.getBit(x, 0) == 1;
53    }
54
55    public BigInteger toBigInteger()
56    {
57        return Nat224.toBigInteger(x);
58    }
59
60    public String getFieldName()
61    {
62        return "SecP224K1Field";
63    }
64
65    public int getFieldSize()
66    {
67        return Q.bitLength();
68    }
69
70    public ECFieldElement add(ECFieldElement b)
71    {
72        int[] z = Nat224.create();
73        SecP224K1Field.add(x, ((SecP224K1FieldElement)b).x, z);
74        return new SecP224K1FieldElement(z);
75    }
76
77    public ECFieldElement addOne()
78    {
79        int[] z = Nat224.create();
80        SecP224K1Field.addOne(x, z);
81        return new SecP224K1FieldElement(z);
82    }
83
84    public ECFieldElement subtract(ECFieldElement b)
85    {
86        int[] z = Nat224.create();
87        SecP224K1Field.subtract(x, ((SecP224K1FieldElement)b).x, z);
88        return new SecP224K1FieldElement(z);
89    }
90
91    public ECFieldElement multiply(ECFieldElement b)
92    {
93        int[] z = Nat224.create();
94        SecP224K1Field.multiply(x, ((SecP224K1FieldElement)b).x, z);
95        return new SecP224K1FieldElement(z);
96    }
97
98    public ECFieldElement divide(ECFieldElement b)
99    {
100//        return multiply(b.invert());
101        int[] z = Nat224.create();
102        Mod.invert(SecP224K1Field.P, ((SecP224K1FieldElement)b).x, z);
103        SecP224K1Field.multiply(z, x, z);
104        return new SecP224K1FieldElement(z);
105    }
106
107    public ECFieldElement negate()
108    {
109        int[] z = Nat224.create();
110        SecP224K1Field.negate(x, z);
111        return new SecP224K1FieldElement(z);
112    }
113
114    public ECFieldElement square()
115    {
116        int[] z = Nat224.create();
117        SecP224K1Field.square(x, z);
118        return new SecP224K1FieldElement(z);
119    }
120
121    public ECFieldElement invert()
122    {
123//        return new SecP224K1FieldElement(toBigInteger().modInverse(Q));
124        int[] z = Nat224.create();
125        Mod.invert(SecP224K1Field.P, x, z);
126        return new SecP224K1FieldElement(z);
127    }
128
129    // D.1.4 91
130    /**
131     * return a sqrt root - the routine verifies that the calculation returns the right value - if
132     * none exists it returns null.
133     */
134    public ECFieldElement sqrt()
135    {
136        /*
137         * Q == 8m + 5, so we use Pocklington's method for this case.
138         *
139         * First, raise this element to the exponent 2^221 - 2^29 - 2^9 - 2^8 - 2^6 - 2^4 - 2^1 (i.e. m + 1)
140         *
141         * Breaking up the exponent's binary representation into "repunits", we get:
142         * { 191 1s } { 1 0s } { 19 1s } { 2 0s } { 1 1s } { 1 0s} { 1 1s } { 1 0s} { 3 1s } { 1 0s}
143         *
144         * Therefore we need an addition chain containing 1, 3, 19, 191 (the lengths of the repunits)
145         * We use: [1], 2, [3], 4, 8, 11, [19], 23, 42, 84, 107, [191]
146         */
147
148        int[] x1 = this.x;
149        if (Nat224.isZero(x1) || Nat224.isOne(x1))
150        {
151            return this;
152        }
153
154        int[] x2 = Nat224.create();
155        SecP224K1Field.square(x1, x2);
156        SecP224K1Field.multiply(x2, x1, x2);
157        int[] x3 = x2;
158        SecP224K1Field.square(x2, x3);
159        SecP224K1Field.multiply(x3, x1, x3);
160        int[] x4 = Nat224.create();
161        SecP224K1Field.square(x3, x4);
162        SecP224K1Field.multiply(x4, x1, x4);
163        int[] x8 = Nat224.create();
164        SecP224K1Field.squareN(x4, 4, x8);
165        SecP224K1Field.multiply(x8, x4, x8);
166        int[] x11 = Nat224.create();
167        SecP224K1Field.squareN(x8, 3, x11);
168        SecP224K1Field.multiply(x11, x3, x11);
169        int[] x19 = x11;
170        SecP224K1Field.squareN(x11, 8, x19);
171        SecP224K1Field.multiply(x19, x8, x19);
172        int[] x23 = x8;
173        SecP224K1Field.squareN(x19, 4, x23);
174        SecP224K1Field.multiply(x23, x4, x23);
175        int[] x42 = x4;
176        SecP224K1Field.squareN(x23, 19, x42);
177        SecP224K1Field.multiply(x42, x19, x42);
178        int[] x84 = Nat224.create();
179        SecP224K1Field.squareN(x42, 42, x84);
180        SecP224K1Field.multiply(x84, x42, x84);
181        int[] x107 = x42;
182        SecP224K1Field.squareN(x84, 23, x107);
183        SecP224K1Field.multiply(x107, x23, x107);
184        int[] x191 = x23;
185        SecP224K1Field.squareN(x107, 84, x191);
186        SecP224K1Field.multiply(x191, x84, x191);
187
188        int[] t1 = x191;
189        SecP224K1Field.squareN(t1, 20, t1);
190        SecP224K1Field.multiply(t1, x19, t1);
191        SecP224K1Field.squareN(t1, 3, t1);
192        SecP224K1Field.multiply(t1, x1, t1);
193        SecP224K1Field.squareN(t1, 2, t1);
194        SecP224K1Field.multiply(t1, x1, t1);
195        SecP224K1Field.squareN(t1, 4, t1);
196        SecP224K1Field.multiply(t1, x3, t1);
197        SecP224K1Field.square(t1, t1);
198
199        int[] t2 = x84;
200        SecP224K1Field.square(t1, t2);
201
202        if (Nat224.eq(x1, t2))
203        {
204            return new SecP224K1FieldElement(t1);
205        }
206
207        /*
208         * If the first guess is incorrect, we multiply by a precomputed power of 2 to get the second guess,
209         * which is ((4x)^(m + 1))/2 mod Q
210         */
211        SecP224K1Field.multiply(t1, PRECOMP_POW2, t1);
212
213        SecP224K1Field.square(t1, t2);
214
215        if (Nat224.eq(x1, t2))
216        {
217            return new SecP224K1FieldElement(t1);
218        }
219
220        return null;
221    }
222
223    public boolean equals(Object other)
224    {
225        if (other == this)
226        {
227            return true;
228        }
229
230        if (!(other instanceof SecP224K1FieldElement))
231        {
232            return false;
233        }
234
235        SecP224K1FieldElement o = (SecP224K1FieldElement)other;
236        return Nat224.eq(x, o.x);
237    }
238
239    public int hashCode()
240    {
241        return Q.hashCode() ^ Arrays.hashCode(x, 0, 7);
242    }
243}
244