Inverse square root. Returns true if x is a non zero square, false otherwise. After the call: isr = sqrt(1/x) if x is non-zero square. isr = sq

Full reduction modulo L (Barrett reduction)

get count of parameters capable of being converted to load */

get index of parameter counting only those capable of representation as float */

h = (h + c) * r preconditions: ctx->h <= 4_ffffffff_ffffffff_ffffffff_ffffffff ctx->c <= 1_ffffffff_ffffffff_ffffffff_ffffffff ctx->r <= 0ffffffc_0f

(re-)initialises the input counter and input buffer

Montgomery reduction. Divides x by (2^256), and reduces the result modulo L Precondition: x < L * 2^256 Constants: r = 2^256 (makes d

////////// X-25519 /// Taken from SUPERCOP's ref10 implementation. //////////

given an array of code lengths, build a tree */

given a data stream and a tree, decode a symbol */

get one bit from source stream */

s + (x*L) % 8*L Guaranteed to fit in 256 bits iff s fits in 255 bits. L < 2^253 x%8 < 2^3 L * (x%8) < 2^255 s <

increment the input offset

This could be simplified, but it would be slower

h = 2 * (f^2) Precondition ------------- |f0|, |f2|, |f4|, |f6|, |f8| < 1.65 * 2^26 |f1|, |f3|, |f5|, |f7|, |f9| < 1.65 * 2^25 Note: we could im

find by index */

The block in the context will determine array indices. To avoid timing attacks, it only depends on public information. No looking at a previous block

/////////////////////////// Authenticated encryption /// ///////////////////////////

make a signature

r = (a * b) + c

Final reduction modulo L, by conditionally removing L. if x < l , then r = x if l <= x 2*l, then r = x-l otherwise the result will be wrong

build extra bits and base tables */

Unary version of the compression function. The missing argument is implied zero. Does the transformation in place.

inflate next byte of compressed stream */