fe25519.h File Reference

Per-variant GF(2^255-19) field layer on the RSA/MPI hardware accelerator (X25519 + Ed25519). More...

#include <stdint.h>
#include "board_drivers/hal/esp/esp_crypto_hal.h"
#include "crypto/crypto_scratch.h"

Go to the source code of this file.

Detailed Description

Per-variant GF(2^255-19) field layer on the RSA/MPI hardware accelerator (X25519 + Ed25519).

Field elements are canonical uint32[8] (< p = 2^255-19) so every field multiply is a single 256-bit modular multiply on the RSA accelerator (S3: ~1,386 cycles vs 7,955 for the software SIMD pc_gf_mul; P4: ~2,118 cycles / 5.9 us). add/sub are native 32-bit (carry + one conditional subtract of p); bytes<->fe is a per-scalar-mult conversion, not per multiply. This is the shared engine behind both the X25519 KEX (pc_curve25519.cpp) and the Ed25519 host-key signature (pc_ed25519.cpp) on every die with a single-shot hardware MODMULT (S3 hw_ver1, P4 and newer hw_ver3 - see the gate below); the radix-2^16 pc_gf path is the native / classic-ESP32 fallback in both.

The accelerator (and its lock) are shared with mbedTLS RSA/DH, so a scalar-mult brackets itself with pc_fe_hw_enable() / pc_fe_hw_disable() (mbedTLS's own esp_mpi_{enable,disable}_hardware_hw_op, i.e. acquire the MPI lock + clock/power the peripheral) and holds the lock for its whole run.

Header-only static inline on purpose: the cheap ops (add/sub/cswap) inline into the ladder in each translation unit with no cross-TU call overhead, and the whole layer stays one source of truth.

Definition in file fe25519.h.