This is largely a save-your-work checkin.
Created p521/arch_ref64 code to make sure E-521 basically works.
Fixed some of the testing code around E-521. It doesn't quite pass
everything yet.
Created p521/arch_x86_64 code with optimized multiply. In this
checkin, the multiply is fast and works, but all the other code in
that directory is the completely unoptimized ref64 build which
reduces after every add and sub. So the whole thing isn't fast yet.
Continuing demagication and factoring of field code.
Removing high-level ops from p448.h and putting them in field.h. That way they
won't need rewriting for new fields and architectures.
Create constant_time.h which contains constant-time lookups, condswaps, etc.
That way the code is the same on all architectures, instead of varying depending
on whether the field size is a multiple of the vector register size. I should
still add a constant_time_select to factor out field_cond_negate.
TODO: I need to test this for correctness and performance on various platforms.
It works on my Mac, but since Yosemite the timing is totally unpredictable
(background tasks? variable boost?).
Create new src/arithmetic.c for field-independent arithmetic (eg batch invert, is_square).
Replace p448_ with field_ where possible.
Create constant EDWARDS_D = -39081.
Create inline function field_mulw_scc for multiplying by compile-time signed curve constants.
Trying to work around an apparent GCC bug on SSE2, thanks Samuel
Neves.
Added an experimental NEON arch. It's fast. It's not yet GCC clean.
It needs some more work on general cleanliness too.
improve GCC-cleanness, etc.
Disable the crandom output buffer so that it won't return duplicate
data across fork(). I should still stir in more entropy into the
buffer at least when RDRAND is available, but this should prevent
disasters for now.
The Elligator code in the current version is incompatible with past
versions due to a minor tweak. It wasn't being called by any of
the API functions, though.
Removing "magic" constants and type names. So for example p448_t
is now field_t (though maybe it should really be felem_t?). This
should enable other curves with the Goldilocks code in the not-too-
distant future.
Added CRANDOM_MIGHT_IS_MUST so that you don't have to -D a bunch of
things on the command line.
You can `make bat` to make an eBAT which probably doesn't work.
I haven't implemented the improved nonce generation from the
curves@moderncrypto.org thread yet.
(you knew this would happen).
Added ARM NEON support.
Added support for precomputation on public keys, which speeds up
later signatures and ECDH calls. See history.txt or the doc for
details.
Reworked internals so that private keys can be derived from any
32-byte secret random value. This also means that secret keys
can be "compressed" for cold storage.
Added more tests. Running the tests now requires GMP, though
Goldilocks itself does not.
Linking now uses visibility instead of exported.sym.
Rework the directory structure into something saner, with src/ test/ include/ and build/
Beginning some tests. Also, now support scan-build.
Now support 32-bit including vectorless ARM. NEON is not yet supported, because I don't
have a test machine.
Many internal changes, improvements, and bug fixes.
Changed the formats of private keys and shared secrets.
Added SHA512 support. It's slow and probably has endian bugs.
Signatures are now supported.
Renamed a bunch of internal functions to be more readable and
consistent.
Began documenting functions with Doxygen.
See HISTORY.txt for more details.
Michael Hamburg