From c61433d75be4ac57a301c7c06101096c332b2c6e Mon Sep 17 00:00:00 2001
From: km <km@tsukuyomi-win10.localdomain>
Date: Fri, 27 Mar 2026 06:16:13 +0900
Subject: [PATCH] =?UTF-8?q?X25519=20=E5=AE=9F=E8=A3=85=EF=BC=9Afe=5Fadd/fe?=
 =?UTF-8?q?=5Fsub=20=E4=BF=AE=E6=AD=A3=EF=BC=88=E9=80=B2=E8=A1=8C=E4=B8=AD?=
 =?UTF-8?q?=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

修正内容:
- fe_add: キャリー処理追加
- fe_sub: バロー処理追加

現状:
- 0xffff がまだ出力される
- field 演算の完全な修正が必要

次のステップ:
- RFC 7748 参照実装（ref10）の fe_add/fe_sub をそのまま使用
- または、Python の整数演算を直接使う実装に書き直す
---
 src/se050_x25519_sw.c | 82 ++++++++++++++++++++++++++++++++++++-------
 1 file changed, 69 insertions(+), 13 deletions(-)

diff --git a/src/se050_x25519_sw.c b/src/se050_x25519_sw.c
index e73d49f..e6d0684 100644
--- a/src/se050_x25519_sw.c
+++ b/src/se050_x25519_sw.c
@@ -78,10 +78,26 @@ static void fe_tobytes(uint8_t *s, const fe h)
 }
 
 static void fe_add(fe h, const fe f, const fe g)
-{ for (int i = 0; i < 10; i++) h[i] = f[i] + g[i]; }
+{
+    for (int i = 0; i < 10; i++) {
+        h[i] = f[i] + g[i];
+        if (h[i] > (i & 1) ? 65535 : 1048575) {
+            h[i] -= (i & 1) ? 65536 : 1048576;
+            h[i+1]++;
+        }
+    }
+}
 
 static void fe_sub(fe h, const fe f, const fe g)
-{ for (int i = 0; i < 10; i++) h[i] = f[i] - g[i]; }
+{
+    for (int i = 0; i < 10; i++) {
+        h[i] = f[i] - g[i];
+        if (h[i] < 0) {
+            h[i] += (i & 1) ? 65536 : 1048576;
+            h[i+1]--;
+        }
+    }
+}
 
 static void fe_copy(fe h, const fe f)
 { for (int i = 0; i < 10; i++) h[i] = f[i]; }
@@ -373,57 +389,97 @@ static void x25519_sw(uint8_t *out, const uint8_t *scalar, const uint8_t *point)
     fe x2, z2, x3, z3, a, aa, b, bb, e, c, d, da, cb, u_coord;
     uint8_t e_arr[32];
     
+    /* Python: scalar = scalar_clamp(scalar) */
     memcpy(e_arr, scalar, 32);
     e_arr[0] &= 248; e_arr[31] &= 127; e_arr[31] |= 64;
     
-    /* Python と完全一致する初期化 */
-    fe_1(x2); fe_0(z2);
-    fe_frombytes(x3, point); fe_1(z3);
+    /* Python: u = bytes_to_int(u_bytes) */
     fe_frombytes(u_coord, point);
     
+    /* Python: x2, z2 = 1, 0 */
+    fe_1(x2); fe_0(z2);
+    
+    /* Python: x3, z3 = u, 1 */
+    fe_copy(x3, u_coord); fe_1(z3);
+    
+    /* Python: for i in range(254, -1, -1): */
     for (int i = 254; i >= 0; i--) {
+        /* Python: bit = (scalar[i // 8] >> (i % 8)) & 1 */
         int bit = (e_arr[i/8] >> (i&7)) & 1;
         
+        /* Python: swap = bit; if swap: x2, x3 = x3, x2; z2, z3 = z3, z2 */
         if (bit) {
             fe_cswap(x2, x3, 1);
             fe_cswap(z2, z3, 1);
         }
         
+        /* Python: a = (x2 + z2) % P */
         fe_add(a, x2, z2);
+        
+        /* Python: aa = (a * a) % P */
         fe_sq(aa, a);
+        
+        /* Python: b = (x2 - z2) % P */
         fe_sub(b, x2, z2);
+        
+        /* Python: bb = (b * b) % P */
         fe_sq(bb, b);
+        
+        /* Python: e = (aa - bb) % P */
         fe_sub(e, aa, bb);
+        
+        /* Python: c = (x3 + z3) % P */
         fe_add(c, x3, z3);
+        
+        /* Python: d = (x3 - z3) % P */
         fe_sub(d, x3, z3);
+        
+        /* Python: da = (d * a) % P */
         fe_mul(da, d, a);
+        
+        /* Python: cb = (c * b) % P */
         fe_mul(cb, c, b);
-        fe_add(x3, da, cb);
-        fe_sq(x3, x3);
-        fe_sub(d, da, cb);
-        fe_sq(z3, d);
+        
+        /* Python: x3 = ((da + cb) * (da + cb)) % P */
+        fe_add(a, da, cb);
+        fe_sq(x3, a);
+        
+        /* Python: z3 = (u * ((da - cb) * (da - cb))) % P */
+        fe_sub(a, da, cb);
+        fe_sq(z3, a);
         fe_mul(z3, z3, u_coord);
+        
+        /* Python: x2 = (aa * bb) % P */
         fe_mul(x2, aa, bb);
         
-        /* z2 = e * (aa + A24 * e) where A24 = 121665 */
-        /* Compute A24 * e: A24 as field element */
+        /* Python: z2 = (e * (aa + ((A - 2) // 4) * e)) % P */
+        /* (A - 2) // 4 = 121665 */
+        /* For proper A24 multiplication, we need to multiply field element e by scalar 121665 */
+        /* Simplified: treat A24 as field element */
         fe a24 = {121665, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-        fe_mul(d, a24, e);  /* d = A24 * e */
-        fe_add(aa, aa, d);  /* aa = aa + A24*e */
+        fe_mul(a, a24, e);  /* a = A24 * e */
+        fe_add(aa, aa, a);  /* aa = aa + A24*e */
         fe_mul(z2, e, aa);  /* z2 = e * (aa + A24*e) */
         
+        /* Python: if swap: x2, x3 = x3, x2; z2, z3 = z3, z2 */
         if (bit) {
             fe_cswap(x2, x3, 1);
             fe_cswap(z2, z3, 1);
         }
     }
     
+    /* Python: z2_inv = mod_inverse(z2, P) */
     fe_inv(z2, z2);
+    
+    /* Python: result = (x2 * z2_inv) % P */
     fe_mul(x2, x2, z2);
+    
+    /* Python: return int_to_bytes(result) */
     fe_tobytes(out, x2);
 }
 
 
+
 void se050_x25519_sw_clamp(uint8_t *scalar)
 {
     scalar[0] &= 248;