| @@ -1165,7 +1165,7 @@ void API_NS(point_from_hash_nonuniform) ( | |||||
| const unsigned char ser[SER_BYTES] | const unsigned char ser[SER_BYTES] | ||||
| ) { | ) { | ||||
| /* TODO: test pathological case ur0^2 = 1/(1-d) */ | /* TODO: test pathological case ur0^2 = 1/(1-d) */ | ||||
| gf r0,r,a,b,c,D,N,e; | |||||
| gf r0,r,a,b,c,N,e; | |||||
| gf_deserialize(r0,ser); | gf_deserialize(r0,ser); | ||||
| gf_strong_reduce(r0); | gf_strong_reduce(r0); | ||||
| gf_sqr(a,r0); | gf_sqr(a,r0); | ||||
| @@ -1178,19 +1178,19 @@ void API_NS(point_from_hash_nonuniform) ( | |||||
| #error "Only supporting p=3,5,7 mod 8" | #error "Only supporting p=3,5,7 mod 8" | ||||
| #endif | #endif | ||||
| /* Compute D := (dr+a-d)(dr-ar-d) with a=1 */ | |||||
| /* Compute D@c := (dr+a-d)(dr-ar-d) with a=1 */ | |||||
| gf_sub(a,r,ONE); | gf_sub(a,r,ONE); | ||||
| gf_mulw_sgn(b,a,EDWARDS_D); /* dr-d */ | gf_mulw_sgn(b,a,EDWARDS_D); /* dr-d */ | ||||
| gf_add(a,b,ONE); | gf_add(a,b,ONE); | ||||
| gf_sub(b,b,r); | gf_sub(b,b,r); | ||||
| gf_mul(D,a,b); | |||||
| gf_mul(c,a,b); | |||||
| /* compute N := (r+1)(a-2d) */ | /* compute N := (r+1)(a-2d) */ | ||||
| gf_add(a,r,ONE); | gf_add(a,r,ONE); | ||||
| gf_mulw_sgn(N,a,1-2*EDWARDS_D); | gf_mulw_sgn(N,a,1-2*EDWARDS_D); | ||||
| /* e = +-sqrt(1/ND) or +-r0 * sqrt(qnr/ND) */ | /* e = +-sqrt(1/ND) or +-r0 * sqrt(qnr/ND) */ | ||||
| gf_mul(a,D,N); | |||||
| gf_mul(a,c,N); | |||||
| mask_t square = gf_isqrt_chk(b,a,DECAF_FALSE); | mask_t square = gf_isqrt_chk(b,a,DECAF_FALSE); | ||||
| cond_sel(c,r0,ONE,square); /* r? = square ? 1 : r0 */ | cond_sel(c,r0,ONE,square); /* r? = square ? 1 : r0 */ | ||||
| gf_mul(e,b,c); | gf_mul(e,b,c); | ||||