From 5828ed16b94555ca31926a00e96ac4ac9ae06b6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niels=20M=C3=B6ller?= <nisse@lysator.liu.se>
Date: Sun, 15 Dec 2019 13:39:17 +0100
Subject: [PATCH] Comment fixes and notation for ecc_dup_eh

---
 ecc-dup-eh.c | 102 ++++++++++++++++++++++++++-------------------------
 1 file changed, 53 insertions(+), 49 deletions(-)

diff --git a/ecc-dup-eh.c b/ecc-dup-eh.c
index 1b9a3f69..a850346c 100644
--- a/ecc-dup-eh.c
+++ b/ecc-dup-eh.c
@@ -43,65 +43,69 @@ ecc_dup_eh (const struct ecc_curve *ecc,
 	    mp_limb_t *scratch)
 {
   /* Formulas (from djb,
-     http://www.hyperelliptic.org/EFD/g1p/auto-edwards-projective.html#doubling-dbl-2007-bl):
+     http://www.hyperelliptic.org/EFD/g1p/auto-twisted-projective.html#doubling-dbl-2008-bbjlp):
+
+     B = (X1+Y1)^2
+     C = X1^2
+     D = Y1^2
+     (E = a*C = -C)
+     F = E+D
+     H = Z1^2
+     J = F-2*H
+     X3 = (B-C-D)*J
+     Y3 = F*(E-D)
+     Z3 = F*J         (-C+D)*(-C+D - 2Z1^2)
+
+     In the formula for Y3, we have E - D = -(C+D). To avoid explicit
+     negation, negate all of X3, Y3, Z3, and use
 
      Computation	Operation	Live variables
-     
-     b = (x+y)^2	sqr		b
-     c = x^2		sqr		b, c
-     d = y^2		sqr		b, c, d
-     e = c+d				b, c, d, e
-     h = z^2		sqr		b, c, d, e, h
-     j = e-2*h				b, c, d, e, j
-     x' = (b-e)*j	mul		c, d, e, j
-     y' = e*(c-d)	mul		e, j
-     z' = e*j		mul
-
-     But for the twisted curve, we need some sign changes.
 
-     b = (x+y)^2	sqr		b
-     c = x^2		sqr		b, c
-     d = y^2		sqr		b, c, d
-   ! e = -c+d				b, c, d, e
-     h = z^2		sqr		b, c, d, e, h
-   ! j = -e+2*h				b, c, d, e, j
-   ! x' = (b-c-d)*j	mul		c, d, e, j
-   ! y' = e*(c+d)	mul		e, j
-     z' = e*j		mul
+     B = (X1+Y1)^2	sqr		B
+     C = X1^2		sqr		B, C
+     D = Y1^2		sqr		B, C, D
+     F = -C+D				B, C, D, F
+     H = Z1^2		sqr		B, C, D, F, H
+     J = 2*H - F			B, C, D, F, J
+     X3 = (B-C-D)*J	mul		C, D, F, J
+     Y3 = F*(C+D)	mul		F, J
+     Z3 = F*J		mul
+
+     3M+4S
   */
-#define b scratch 
-#define c (scratch  + ecc->p.size)
-#define d (scratch  + 2*ecc->p.size)
-#define e (scratch  + 3*ecc->p.size)
-#define j (scratch  + 4*ecc->p.size)
-
-  /* b */
-  ecc_modp_add (ecc, e, p, p + ecc->p.size);
-  ecc_modp_sqr (ecc, b, e);
-
-  /* c */
-  ecc_modp_sqr (ecc, c, p);
-  /* d */
-  ecc_modp_sqr (ecc, d, p + ecc->p.size);
-  /* h, can use r as scratch, even for in-place operation. */
+#define B scratch
+#define C (scratch  + ecc->p.size)
+#define D (scratch  + 2*ecc->p.size)
+#define F (scratch  + 3*ecc->p.size)
+#define J (scratch  + 4*ecc->p.size)
+
+  /* B */
+  ecc_modp_add (ecc, F, p, p + ecc->p.size);
+  ecc_modp_sqr (ecc, B, F);
+
+  /* C */
+  ecc_modp_sqr (ecc, C, p);
+  /* D */
+  ecc_modp_sqr (ecc, D, p + ecc->p.size);
+  /* Can use r as scratch, even for in-place operation. */
   ecc_modp_sqr (ecc, r, p + 2*ecc->p.size);
-  /* e, */
-  ecc_modp_sub (ecc, e, d, c);
-  /* b - c - d */
-  ecc_modp_sub (ecc, b, b, c);
-  ecc_modp_sub (ecc, b, b, d);
-  /* j */
+  /* F, */
+  ecc_modp_sub (ecc, F, D, C);
+  /* B - C - D */
+  ecc_modp_sub (ecc, B, B, C);
+  ecc_modp_sub (ecc, B, B, D);
+  /* J */
   ecc_modp_add (ecc, r, r, r);
-  ecc_modp_sub (ecc, j, r, e);
+  ecc_modp_sub (ecc, J, r, F);
 
   /* x' */
-  ecc_modp_mul (ecc, r, b, j);
+  ecc_modp_mul (ecc, r, B, J);
   /* y' */
-  ecc_modp_add (ecc, c, c, d); /* Redundant */
-  ecc_modp_mul (ecc, r + ecc->p.size, e, c);
+  ecc_modp_add (ecc, C, C, D); /* Redundant */
+  ecc_modp_mul (ecc, r + ecc->p.size, F, C);
   /* z' */
-  ecc_modp_mul (ecc, b, e, j);
-  mpn_copyi (r + 2*ecc->p.size, b, ecc->p.size);
+  ecc_modp_mul (ecc, B, F, J);
+  mpn_copyi (r + 2*ecc->p.size, B, ecc->p.size);
 }
 
 void
-- 
2.24.1