commit f8eb1e50541c8a9e55545d7470dbeab96073a632

Author: Vincent Batts <vbatts@hashbangbash.com>

Date:   Thu Jul 16 11:38:45 2015 -0400

    p224

diff --git a/api/go1.txt b/api/go1.txt

index 5e3dea5..1a1ee83 100644

--- a/api/go1.txt

+++ b/api/go1.txt

@@ -412,7 +412,6 @@ pkg crypto/ecdsa, type PublicKey struct, Y *big.Int

 pkg crypto/ecdsa, type PublicKey struct, embedded elliptic.Curve

 pkg crypto/elliptic, func GenerateKey(Curve, io.Reader) ([]uint8, *big.Int, *big.Int, error)

 pkg crypto/elliptic, func Marshal(Curve, *big.Int, *big.Int) []uint8

-pkg crypto/elliptic, func P224() Curve

 pkg crypto/elliptic, func P256() Curve

 pkg crypto/elliptic, func P384() Curve

 pkg crypto/elliptic, func P521() Curve

diff --git a/src/crypto/ecdsa/ecdsa_test.go b/src/crypto/ecdsa/ecdsa_test.go

index 169944d..c653464 100644

--- a/src/crypto/ecdsa/ecdsa_test.go

+++ b/src/crypto/ecdsa/ecdsa_test.go

@@ -33,11 +33,10 @@ func testKeyGeneration(t *testing.T, c elliptic.Curve, tag string) {

 }

 func TestKeyGeneration(t *testing.T) {

-	testKeyGeneration(t, elliptic.P224(), "p224")

+	testKeyGeneration(t, elliptic.P256(), "p256")

 	if testing.Short() {

 		return

 	}

-	testKeyGeneration(t, elliptic.P256(), "p256")

 	testKeyGeneration(t, elliptic.P384(), "p384")

 	testKeyGeneration(t, elliptic.P521(), "p521")

 }

@@ -63,11 +62,10 @@ func testSignAndVerify(t *testing.T, c elliptic.Curve, tag string) {

 }

 func TestSignAndVerify(t *testing.T) {

-	testSignAndVerify(t, elliptic.P224(), "p224")

+	testSignAndVerify(t, elliptic.P256(), "p256")

 	if testing.Short() {

 		return

 	}

-	testSignAndVerify(t, elliptic.P256(), "p256")

 	testSignAndVerify(t, elliptic.P384(), "p384")

 	testSignAndVerify(t, elliptic.P521(), "p521")

 }

@@ -100,11 +98,10 @@ func testNonceSafety(t *testing.T, c elliptic.Curve, tag string) {

 }

 func TestNonceSafety(t *testing.T) {

-	testNonceSafety(t, elliptic.P224(), "p224")

+	testNonceSafety(t, elliptic.P256(), "p256")

 	if testing.Short() {

 		return

 	}

-	testNonceSafety(t, elliptic.P256(), "p256")

 	testNonceSafety(t, elliptic.P384(), "p384")

 	testNonceSafety(t, elliptic.P521(), "p521")

 }

@@ -135,11 +132,10 @@ func testINDCCA(t *testing.T, c elliptic.Curve, tag string) {

 }

 func TestINDCCA(t *testing.T) {

-	testINDCCA(t, elliptic.P224(), "p224")

+	testINDCCA(t, elliptic.P256(), "p256")

 	if testing.Short() {

 		return

 	}

-	testINDCCA(t, elliptic.P256(), "p256")

 	testINDCCA(t, elliptic.P384(), "p384")

 	testINDCCA(t, elliptic.P521(), "p521")

 }

@@ -201,8 +197,6 @@ func TestVectors(t *testing.T) {

 			parts := strings.SplitN(line, ",", 2)

 			switch parts[0] {

-			case "P-224":

-				pub.Curve = elliptic.P224()

 			case "P-256":

 				pub.Curve = elliptic.P256()

 			case "P-384":

diff --git a/src/crypto/elliptic/bottombits.go b/src/crypto/elliptic/bottombits.go

new file mode 100644

index 0000000..4544722

--- /dev/null

+++ b/src/crypto/elliptic/bottombits.go

@@ -0,0 +1,4 @@

+package elliptic

+

+const bottom28Bits = 0xfffffff

+const two31m3 = 1<<31 - 1<<3

diff --git a/src/crypto/elliptic/elliptic.go b/src/crypto/elliptic/elliptic.go

index f3b84e1..ca0b7cf 100644

--- a/src/crypto/elliptic/elliptic.go

+++ b/src/crypto/elliptic/elliptic.go

@@ -331,7 +331,6 @@ var p384 *CurveParams

 var p521 *CurveParams

 func initAll() {

-	initP224()

 	initP256()

 	initP384()

 	initP521()

diff --git a/src/crypto/elliptic/elliptic_test.go b/src/crypto/elliptic/elliptic_test.go

index 7e27913..e0034fc 100644

--- a/src/crypto/elliptic/elliptic_test.go

+++ b/src/crypto/elliptic/elliptic_test.go

@@ -6,27 +6,25 @@ package elliptic

 import (

 	"crypto/rand"

-	"encoding/hex"

-	"fmt"

 	"math/big"

 	"testing"

 )

 func TestOnCurve(t *testing.T) {

-	p224 := P224()

-	if !p224.IsOnCurve(p224.Params().Gx, p224.Params().Gy) {

+	p256 := P256()

+	if !p256.IsOnCurve(p256.Params().Gx, p256.Params().Gy) {

 		t.Errorf("FAIL")

 	}

 }

 func TestOffCurve(t *testing.T) {

-	p224 := P224()

+	p256 := P256()

 	x, y := new(big.Int).SetInt64(1), new(big.Int).SetInt64(1)

-	if p224.IsOnCurve(x, y) {

+	if p256.IsOnCurve(x, y) {

 		t.Errorf("FAIL: point off curve is claimed to be on the curve")

 	}

-	b := Marshal(p224, x, y)

-	x1, y1 := Unmarshal(p224, b)

+	b := Marshal(p256, x, y)

+	x1, y1 := Unmarshal(p256, b)

 	if x1 != nil || y1 != nil {

 		t.Errorf("FAIL: unmarshalling a point not on the curve succeeded")

 	}

@@ -37,7 +35,7 @@ type baseMultTest struct {

 	x, y string

 }

-var p224BaseMultTests = []baseMultTest{

+var p256BaseMultTests = []baseMultTest{

 	{

 		"1",

 		"b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21",

@@ -300,47 +298,12 @@ var p224BaseMultTests = []baseMultTest{

 	},

 }

-func TestBaseMult(t *testing.T) {

-	p224 := P224()

-	for i, e := range p224BaseMultTests {

-		k, ok := new(big.Int).SetString(e.k, 10)

-		if !ok {

-			t.Errorf("%d: bad value for k: %s", i, e.k)

-		}

-		x, y := p224.ScalarBaseMult(k.Bytes())

-		if fmt.Sprintf("%x", x) != e.x || fmt.Sprintf("%x", y) != e.y {

-			t.Errorf("%d: bad output for k=%s: got (%x, %x), want (%s, %s)", i, e.k, x, y, e.x, e.y)

-		}

-		if testing.Short() && i > 5 {

-			break

-		}

-	}

-}

-

-func TestGenericBaseMult(t *testing.T) {

-	// We use the P224 CurveParams directly in order to test the generic implementation.

-	p224 := P224().Params()

-	for i, e := range p224BaseMultTests {

-		k, ok := new(big.Int).SetString(e.k, 10)

-		if !ok {

-			t.Errorf("%d: bad value for k: %s", i, e.k)

-		}

-		x, y := p224.ScalarBaseMult(k.Bytes())

-		if fmt.Sprintf("%x", x) != e.x || fmt.Sprintf("%x", y) != e.y {

-			t.Errorf("%d: bad output for k=%s: got (%x, %x), want (%s, %s)", i, e.k, x, y, e.x, e.y)

-		}

-		if testing.Short() && i > 5 {

-			break

-		}

-	}

-}

-

 func TestP256BaseMult(t *testing.T) {

 	p256 := P256()

 	p256Generic := p256.Params()

-	scalars := make([]*big.Int, 0, len(p224BaseMultTests)+1)

-	for _, e := range p224BaseMultTests {

+	scalars := make([]*big.Int, 0, len(p256BaseMultTests)+1)

+	for _, e := range p256BaseMultTests {

 		k, _ := new(big.Int).SetString(e.k, 10)

 		scalars = append(scalars, k)

 	}

@@ -365,7 +328,7 @@ func TestP256Mult(t *testing.T) {

 	p256 := P256()

 	p256Generic := p256.Params()

-	for i, e := range p224BaseMultTests {

+	for i, e := range p256BaseMultTests {

 		x, _ := new(big.Int).SetString(e.x, 16)

 		y, _ := new(big.Int).SetString(e.y, 16)

 		k, _ := new(big.Int).SetString(e.k, 10)

@@ -386,7 +349,6 @@ func TestInfinity(t *testing.T) {

 		name  string

 		curve Curve

 	}{

-		{"p224", P224()},

 		{"p256", P256()},

 	}

@@ -419,21 +381,10 @@ func TestInfinity(t *testing.T) {

 	}

 }

-func BenchmarkBaseMult(b *testing.B) {

-	b.ResetTimer()

-	p224 := P224()

-	e := p224BaseMultTests[25]

-	k, _ := new(big.Int).SetString(e.k, 10)

-	b.StartTimer()

-	for i := 0; i < b.N; i++ {

-		p224.ScalarBaseMult(k.Bytes())

-	}

-}

-

 func BenchmarkBaseMultP256(b *testing.B) {

 	b.ResetTimer()

 	p256 := P256()

-	e := p224BaseMultTests[25]

+	e := p256BaseMultTests[25]

 	k, _ := new(big.Int).SetString(e.k, 10)

 	b.StartTimer()

 	for i := 0; i < b.N; i++ {

@@ -442,14 +393,14 @@ func BenchmarkBaseMultP256(b *testing.B) {

 }

 func TestMarshal(t *testing.T) {

-	p224 := P224()

-	_, x, y, err := GenerateKey(p224, rand.Reader)

+	p256 := P256()

+	_, x, y, err := GenerateKey(p256, rand.Reader)

 	if err != nil {

 		t.Error(err)

 		return

 	}

-	serialized := Marshal(p224, x, y)

-	xx, yy := Unmarshal(p224, serialized)

+	serialized := Marshal(p256, x, y)

+	xx, yy := Unmarshal(p256, serialized)

 	if xx == nil {

 		t.Error("failed to unmarshal")

 		return

@@ -459,13 +410,3 @@ func TestMarshal(t *testing.T) {

 		return

 	}

 }

-

-func TestP224Overflow(t *testing.T) {

-	// This tests for a specific bug in the P224 implementation.

-	p224 := P224()

-	pointData, _ := hex.DecodeString("049B535B45FB0A2072398A6831834624C7E32CCFD5A4B933BCEAF77F1DD945E08BBE5178F5EDF5E733388F196D2A631D2E075BB16CBFEEA15B")

-	x, y := Unmarshal(p224, pointData)

-	if !p224.IsOnCurve(x, y) {

-		t.Error("P224 failed to validate a correct point")

-	}

-}

diff --git a/src/crypto/elliptic/p224.go b/src/crypto/elliptic/p224.go

deleted file mode 100644

index 2d3fac7..0000000

--- a/src/crypto/elliptic/p224.go

+++ /dev/null

@@ -1,765 +0,0 @@

-// Copyright 2012 The Go Authors.  All rights reserved.

-// Use of this source code is governed by a BSD-style

-// license that can be found in the LICENSE file.

-

-package elliptic

-

-// This is a constant-time, 32-bit implementation of P224. See FIPS 186-3,

-// section D.2.2.

-//

-// See http://www.imperialviolet.org/2010/12/04/ecc.html ([1]) for background.

-

-import (

-	"math/big"

-)

-

-var p224 p224Curve

-

-type p224Curve struct {

-	*CurveParams

-	gx, gy, b p224FieldElement

-}

-

-func initP224() {

-	// See FIPS 186-3, section D.2.2

-	p224.CurveParams = &CurveParams{Name: "P-224"}

-	p224.P, _ = new(big.Int).SetString("26959946667150639794667015087019630673557916260026308143510066298881", 10)

-	p224.N, _ = new(big.Int).SetString("26959946667150639794667015087019625940457807714424391721682722368061", 10)

-	p224.B, _ = new(big.Int).SetString("b4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4", 16)

-	p224.Gx, _ = new(big.Int).SetString("b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21", 16)

-	p224.Gy, _ = new(big.Int).SetString("bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34", 16)

-	p224.BitSize = 224

-

-	p224FromBig(&p224.gx, p224.Gx)

-	p224FromBig(&p224.gy, p224.Gy)

-	p224FromBig(&p224.b, p224.B)

-}

-

-// P224 returns a Curve which implements P-224 (see FIPS 186-3, section D.2.2)

-func P224() Curve {

-	initonce.Do(initAll)

-	return p224

-}

-

-func (curve p224Curve) Params() *CurveParams {

-	return curve.CurveParams

-}

-

-func (curve p224Curve) IsOnCurve(bigX, bigY *big.Int) bool {

-	var x, y p224FieldElement

-	p224FromBig(&x, bigX)

-	p224FromBig(&y, bigY)

-

-	// y² = x³ - 3x + b

-	var tmp p224LargeFieldElement

-	var x3 p224FieldElement

-	p224Square(&x3, &x, &tmp)

-	p224Mul(&x3, &x3, &x, &tmp)

-

-	for i := 0; i < 8; i++ {

-		x[i] *= 3

-	}

-	p224Sub(&x3, &x3, &x)

-	p224Reduce(&x3)

-	p224Add(&x3, &x3, &curve.b)

-	p224Contract(&x3, &x3)

-

-	p224Square(&y, &y, &tmp)

-	p224Contract(&y, &y)

-

-	for i := 0; i < 8; i++ {

-		if y[i] != x3[i] {

-			return false

-		}

-	}

-	return true

-}

-

-func (p224Curve) Add(bigX1, bigY1, bigX2, bigY2 *big.Int) (x, y *big.Int) {

-	var x1, y1, z1, x2, y2, z2, x3, y3, z3 p224FieldElement

-

-	p224FromBig(&x1, bigX1)

-	p224FromBig(&y1, bigY1)

-	if bigX1.Sign() != 0 || bigY1.Sign() != 0 {

-		z1[0] = 1

-	}

-	p224FromBig(&x2, bigX2)

-	p224FromBig(&y2, bigY2)

-	if bigX2.Sign() != 0 || bigY2.Sign() != 0 {

-		z2[0] = 1

-	}

-

-	p224AddJacobian(&x3, &y3, &z3, &x1, &y1, &z1, &x2, &y2, &z2)

-	return p224ToAffine(&x3, &y3, &z3)

-}

-

-func (p224Curve) Double(bigX1, bigY1 *big.Int) (x, y *big.Int) {

-	var x1, y1, z1, x2, y2, z2 p224FieldElement

-

-	p224FromBig(&x1, bigX1)

-	p224FromBig(&y1, bigY1)

-	z1[0] = 1

-

-	p224DoubleJacobian(&x2, &y2, &z2, &x1, &y1, &z1)

-	return p224ToAffine(&x2, &y2, &z2)

-}

-

-func (p224Curve) ScalarMult(bigX1, bigY1 *big.Int, scalar []byte) (x, y *big.Int) {

-	var x1, y1, z1, x2, y2, z2 p224FieldElement

-

-	p224FromBig(&x1, bigX1)

-	p224FromBig(&y1, bigY1)

-	z1[0] = 1

-

-	p224ScalarMult(&x2, &y2, &z2, &x1, &y1, &z1, scalar)

-	return p224ToAffine(&x2, &y2, &z2)

-}

-

-func (curve p224Curve) ScalarBaseMult(scalar []byte) (x, y *big.Int) {

-	var z1, x2, y2, z2 p224FieldElement

-

-	z1[0] = 1

-	p224ScalarMult(&x2, &y2, &z2, &curve.gx, &curve.gy, &z1, scalar)

-	return p224ToAffine(&x2, &y2, &z2)

-}

-

-// Field element functions.

-//

-// The field that we're dealing with is ℤ/pℤ where p = 2**224 - 2**96 + 1.

-//

-// Field elements are represented by a FieldElement, which is a typedef to an

-// array of 8 uint32's. The value of a FieldElement, a, is:

-//   a[0] + 2**28·a[1] + 2**56·a[1] + ... + 2**196·a[7]

-//

-// Using 28-bit limbs means that there's only 4 bits of headroom, which is less

-// than we would really like. But it has the useful feature that we hit 2**224

-// exactly, making the reflections during a reduce much nicer.

-type p224FieldElement [8]uint32

-

-// p224P is the order of the field, represented as a p224FieldElement.

-var p224P = [8]uint32{1, 0, 0, 0xffff000, 0xfffffff, 0xfffffff, 0xfffffff, 0xfffffff}

-

-// p224IsZero returns 1 if a == 0 mod p and 0 otherwise.

-//

-// a[i] < 2**29

-func p224IsZero(a *p224FieldElement) uint32 {

-	// Since a p224FieldElement contains 224 bits there are two possible

-	// representations of 0: 0 and p.

-	var minimal p224FieldElement

-	p224Contract(&minimal, a)

-

-	var isZero, isP uint32

-	for i, v := range minimal {

-		isZero |= v

-		isP |= v - p224P[i]

-	}

-

-	// If either isZero or isP is 0, then we should return 1.

-	isZero |= isZero >> 16

-	isZero |= isZero >> 8

-	isZero |= isZero >> 4

-	isZero |= isZero >> 2

-	isZero |= isZero >> 1

-

-	isP |= isP >> 16

-	isP |= isP >> 8

-	isP |= isP >> 4

-	isP |= isP >> 2

-	isP |= isP >> 1

-

-	// For isZero and isP, the LSB is 0 iff all the bits are zero.

-	result := isZero & isP

-	result = (^result) & 1

-

-	return result

-}

-

-// p224Add computes *out = a+b

-//

-// a[i] + b[i] < 2**32

-func p224Add(out, a, b *p224FieldElement) {

-	for i := 0; i < 8; i++ {

-		out[i] = a[i] + b[i]

-	}

-}

-

-const two31p3 = 1<<31 + 1<<3

-const two31m3 = 1<<31 - 1<<3

-const two31m15m3 = 1<<31 - 1<<15 - 1<<3

-

-// p224ZeroModP31 is 0 mod p where bit 31 is set in all limbs so that we can

-// subtract smaller amounts without underflow. See the section "Subtraction" in

-// [1] for reasoning.

-var p224ZeroModP31 = []uint32{two31p3, two31m3, two31m3, two31m15m3, two31m3, two31m3, two31m3, two31m3}

-

-// p224Sub computes *out = a-b

-//

-// a[i], b[i] < 2**30

-// out[i] < 2**32

-func p224Sub(out, a, b *p224FieldElement) {

-	for i := 0; i < 8; i++ {

-		out[i] = a[i] + p224ZeroModP31[i] - b[i]

-	}

-}

-

-// LargeFieldElement also represents an element of the field. The limbs are

-// still spaced 28-bits apart and in little-endian order. So the limbs are at

-// 0, 28, 56, ..., 392 bits, each 64-bits wide.

-type p224LargeFieldElement [15]uint64

-

-const two63p35 = 1<<63 + 1<<35

-const two63m35 = 1<<63 - 1<<35

-const two63m35m19 = 1<<63 - 1<<35 - 1<<19

-

-// p224ZeroModP63 is 0 mod p where bit 63 is set in all limbs. See the section

-// "Subtraction" in [1] for why.

-var p224ZeroModP63 = [8]uint64{two63p35, two63m35, two63m35, two63m35, two63m35m19, two63m35, two63m35, two63m35}

-

-const bottom12Bits = 0xfff

-const bottom28Bits = 0xfffffff

-

-// p224Mul computes *out = a*b

-//

-// a[i] < 2**29, b[i] < 2**30 (or vice versa)

-// out[i] < 2**29

-func p224Mul(out, a, b *p224FieldElement, tmp *p224LargeFieldElement) {

-	for i := 0; i < 15; i++ {

-		tmp[i] = 0

-	}

-

-	for i := 0; i < 8; i++ {

-		for j := 0; j < 8; j++ {

-			tmp[i+j] += uint64(a[i]) * uint64(b[j])

-		}

-	}

-

-	p224ReduceLarge(out, tmp)

-}

-

-// Square computes *out = a*a

-//

-// a[i] < 2**29

-// out[i] < 2**29

-func p224Square(out, a *p224FieldElement, tmp *p224LargeFieldElement) {

-	for i := 0; i < 15; i++ {

-		tmp[i] = 0

-	}

-

-	for i := 0; i < 8; i++ {

-		for j := 0; j <= i; j++ {

-			r := uint64(a[i]) * uint64(a[j])

-			if i == j {

-				tmp[i+j] += r

-			} else {

-				tmp[i+j] += r << 1

-			}

-		}

-	}

-

-	p224ReduceLarge(out, tmp)

-}

-

-// ReduceLarge converts a p224LargeFieldElement to a p224FieldElement.

-//

-// in[i] < 2**62

-func p224ReduceLarge(out *p224FieldElement, in *p224LargeFieldElement) {

-	for i := 0; i < 8; i++ {

-		in[i] += p224ZeroModP63[i]

-	}

-

-	// Eliminate the coefficients at 2**224 and greater.

-	for i := 14; i >= 8; i-- {

-		in[i-8] -= in[i]

-		in[i-5] += (in[i] & 0xffff) << 12

-		in[i-4] += in[i] >> 16

-	}

-	in[8] = 0

-	// in[0..8] < 2**64

-

-	// As the values become small enough, we start to store them in |out|

-	// and use 32-bit operations.

-	for i := 1; i < 8; i++ {

-		in[i+1] += in[i] >> 28

-		out[i] = uint32(in[i] & bottom28Bits)

-	}

-	in[0] -= in[8]

-	out[3] += uint32(in[8]&0xffff) << 12

-	out[4] += uint32(in[8] >> 16)

-	// in[0] < 2**64

-	// out[3] < 2**29

-	// out[4] < 2**29

-	// out[1,2,5..7] < 2**28

-

-	out[0] = uint32(in[0] & bottom28Bits)

-	out[1] += uint32((in[0] >> 28) & bottom28Bits)

-	out[2] += uint32(in[0] >> 56)

-	// out[0] < 2**28

-	// out[1..4] < 2**29

-	// out[5..7] < 2**28

-}

-

-// Reduce reduces the coefficients of a to smaller bounds.

-//

-// On entry: a[i] < 2**31 + 2**30

-// On exit: a[i] < 2**29

-func p224Reduce(a *p224FieldElement) {

-	for i := 0; i < 7; i++ {

-		a[i+1] += a[i] >> 28

-		a[i] &= bottom28Bits

-	}

-	top := a[7] >> 28

-	a[7] &= bottom28Bits

-

-	// top < 2**4

-	mask := top

-	mask |= mask >> 2

-	mask |= mask >> 1

-	mask <<= 31

-	mask = uint32(int32(mask) >> 31)

-	// Mask is all ones if top != 0, all zero otherwise

-

-	a[0] -= top

-	a[3] += top << 12

-

-	// We may have just made a[0] negative but, if we did, then we must

-	// have added something to a[3], this it's > 2**12. Therefore we can

-	// carry down to a[0].

-	a[3] -= 1 & mask

-	a[2] += mask & (1<<28 - 1)

-	a[1] += mask & (1<<28 - 1)

-	a[0] += mask & (1 << 28)

-}

-

-// p224Invert calculates *out = in**-1 by computing in**(2**224 - 2**96 - 1),

-// i.e. Fermat's little theorem.

-func p224Invert(out, in *p224FieldElement) {

-	var f1, f2, f3, f4 p224FieldElement

-	var c p224LargeFieldElement

-

-	p224Square(&f1, in, &c)    // 2

-	p224Mul(&f1, &f1, in, &c)  // 2**2 - 1

-	p224Square(&f1, &f1, &c)   // 2**3 - 2

-	p224Mul(&f1, &f1, in, &c)  // 2**3 - 1

-	p224Square(&f2, &f1, &c)   // 2**4 - 2

-	p224Square(&f2, &f2, &c)   // 2**5 - 4

-	p224Square(&f2, &f2, &c)   // 2**6 - 8

-	p224Mul(&f1, &f1, &f2, &c) // 2**6 - 1

-	p224Square(&f2, &f1, &c)   // 2**7 - 2

-	for i := 0; i < 5; i++ {   // 2**12 - 2**6

-		p224Square(&f2, &f2, &c)

-	}

-	p224Mul(&f2, &f2, &f1, &c) // 2**12 - 1

-	p224Square(&f3, &f2, &c)   // 2**13 - 2

-	for i := 0; i < 11; i++ {  // 2**24 - 2**12

-		p224Square(&f3, &f3, &c)

-	}

-	p224Mul(&f2, &f3, &f2, &c) // 2**24 - 1

-	p224Square(&f3, &f2, &c)   // 2**25 - 2

-	for i := 0; i < 23; i++ {  // 2**48 - 2**24

-		p224Square(&f3, &f3, &c)

-	}

-	p224Mul(&f3, &f3, &f2, &c) // 2**48 - 1

-	p224Square(&f4, &f3, &c)   // 2**49 - 2

-	for i := 0; i < 47; i++ {  // 2**96 - 2**48

-		p224Square(&f4, &f4, &c)

-	}

-	p224Mul(&f3, &f3, &f4, &c) // 2**96 - 1

-	p224Square(&f4, &f3, &c)   // 2**97 - 2

-	for i := 0; i < 23; i++ {  // 2**120 - 2**24

-		p224Square(&f4, &f4, &c)

-	}

-	p224Mul(&f2, &f4, &f2, &c) // 2**120 - 1

-	for i := 0; i < 6; i++ {   // 2**126 - 2**6

-		p224Square(&f2, &f2, &c)

-	}

-	p224Mul(&f1, &f1, &f2, &c) // 2**126 - 1

-	p224Square(&f1, &f1, &c)   // 2**127 - 2

-	p224Mul(&f1, &f1, in, &c)  // 2**127 - 1

-	for i := 0; i < 97; i++ {  // 2**224 - 2**97

-		p224Square(&f1, &f1, &c)

-	}

-	p224Mul(out, &f1, &f3, &c) // 2**224 - 2**96 - 1

-}

-

-// p224Contract converts a FieldElement to its unique, minimal form.

-//

-// On entry, in[i] < 2**29

-// On exit, in[i] < 2**28

-func p224Contract(out, in *p224FieldElement) {

-	copy(out[:], in[:])

-

-	for i := 0; i < 7; i++ {

-		out[i+1] += out[i] >> 28

-		out[i] &= bottom28Bits

-	}

-	top := out[7] >> 28

-	out[7] &= bottom28Bits

-

-	out[0] -= top

-	out[3] += top << 12

-

-	// We may just have made out[i] negative. So we carry down. If we made

-	// out[0] negative then we know that out[3] is sufficiently positive

-	// because we just added to it.

-	for i := 0; i < 3; i++ {

-		mask := uint32(int32(out[i]) >> 31)

-		out[i] += (1 << 28) & mask

-		out[i+1] -= 1 & mask

-	}

-

-	// We might have pushed out[3] over 2**28 so we perform another, partial,

-	// carry chain.

-	for i := 3; i < 7; i++ {

-		out[i+1] += out[i] >> 28

-		out[i] &= bottom28Bits

-	}

-	top = out[7] >> 28

-	out[7] &= bottom28Bits

-

-	// Eliminate top while maintaining the same value mod p.

-	out[0] -= top

-	out[3] += top << 12

-

-	// There are two cases to consider for out[3]:

-	//   1) The first time that we eliminated top, we didn't push out[3] over

-	//      2**28. In this case, the partial carry chain didn't change any values

-	//      and top is zero.

-	//   2) We did push out[3] over 2**28 the first time that we eliminated top.

-	//      The first value of top was in [0..16), therefore, prior to eliminating

-	//      the first top, 0xfff1000 <= out[3] <= 0xfffffff. Therefore, after

-	//      overflowing and being reduced by the second carry chain, out[3] <=

-	//      0xf000. Thus it cannot have overflowed when we eliminated top for the

-	//      second time.

-

-	// Again, we may just have made out[0] negative, so do the same carry down.

-	// As before, if we made out[0] negative then we know that out[3] is

-	// sufficiently positive.

-	for i := 0; i < 3; i++ {

-		mask := uint32(int32(out[i]) >> 31)

-		out[i] += (1 << 28) & mask