def ate(P1, Q1):
if Q1.isinf():
return one()
nb, n3, n = lbits()
P = P1.copy()
Q = Q1.copy()
P.affine()
Q.affine()
A = P.copy()
Qx, Qy = Q.getxy()
r = one()
# miller loop
for i in range(nb - 2, 0, -1):
r.sqr()
lv = g(A, A, Qx, Qy)
if big.bit(n3, i) == 1 and big.bit(n, i) == 0:
lv2 = g(A, P, Qx, Qy)
lv.smul(lv2)
if big.bit(n3, i) == 0 and big.bit(n, i) == 1:
lv2 = g(A, -P, Qx, Qy)
lv.smul(lv2)
r *= lv
# adjustment
if curve.SignOfX == NEGATIVEX:
r.conj()
if curve.PairingFriendly == BN:
KA = P.copy()
KA.frobenius()
if curve.SignOfX == NEGATIVEX:
A = -A
lv = g(A, KA, Qx, Qy)
KA.frobenius()
KA = -KA
lv2 = g(A, KA, Qx, Qy)
lv.smul(lv2)
r *= lv
return r
def miller(r):
nb, n3, n = lbits()
res = one()
for i in range(nb - 1, 0, -1):
res.sqr()
res *= r[i]
if curve.SignOfX == NEGATIVEX:
res.conj()
res *= r[0]
return res
def kangaroo(E, F):
e = Fp12()
e.fromBytes(E)
f = Fp12()
f.fromBytes(F)
# Pollards Kangaroos
t = f.copy()
distance = []
table = []
s = 1
for m in range(0, TS):
distance.append(s)
table.append(t.copy())
s *= 2
t.usqr()
t = one()
# set trap
dn = 0
for j in range(0, TRAP):
i = t.a.a.a.int() % TS
t *= table[i]
dn += distance[i]
# release wild kangaroo
f = t.copy()
f.conj()
steps = 0
dm = 0
while dm - dn < MAXPIN:
steps = steps + 1
if steps > 4 * TRAP:
break
i = e.a.a.a.int() % TS
e *= table[i]
dm += distance[i]
if e == t:
res = dm - dn
break
if e == f:
res = dn - dm
break
if steps > 4 * TRAP or dm - dn >= MAXPIN:
res = 0
return res
def double_ate(P1, Q1, U1, V1):
if Q1.isinf():
return ate(U1, V1)
if V1.isinf():
return ate(P1, Q1)
nb, n3, n = lbits()
P = P1.copy()
Q = Q1.copy()
U = U1.copy()
V = V1.copy()
P.affine()
Q.affine()
U.affine()
V.affine()
A = P.copy()
Qx, Qy = Q.getxy()
B = U.copy()
Wx, Wy = V.getxy()
r = one()
# miller loop
for i in range(nb - 2, 0, -1):
r.sqr()
lv = g(A, A, Qx, Qy)
lv2 = g(B, B, Wx, Wy)
lv.smul(lv2)
r *= lv
if big.bit(n3, i) == 1 and big.bit(n, i) == 0:
lv = g(A, P, Qx, Qy)
lv2 = g(B, U, Wx, Wy)
lv.smul(lv2)
r *= lv
if big.bit(n3, i) == 0 and big.bit(n, i) == 1:
lv = g(A, -P, Qx, Qy)
lv2 = g(B, -U, Wx, Wy)
lv.smul(lv2)
r *= lv
# adjustment
if curve.SignOfX == NEGATIVEX:
r.conj()
if curve.PairingFriendly == BN:
KA = P.copy()
KA.frobenius()
if curve.SignOfX == NEGATIVEX:
A = -A
B = -B
lv = g(A, KA, Qx, Qy)
KA.frobenius()
KA = -KA
lv2 = g(A, KA, Qx, Qy)
lv.smul(lv2)
r *= lv
KB = U.copy()
KB.frobenius()
lv = g(B, KB, Wx, Wy)
KB.frobenius()
KB = -KB
lv2 = g(B, KB, Wx, Wy)
lv.smul(lv2)
r *= lv
return r
def initmp():
nb, n3, n = lbits()
r = []
for i in range(nb - 1, -1, -1):
r.append(one())
return r