37.3.4.10 Square

The purpose of this service is to compute the square of a big number and optionally accumulate/subtract from a second big number.

Please note that this service uses an optimized implementation of the squaring. It also means that when the GF(2ⁿ) flag is set, the execution time will be smaller than when not set (in that case, the squaring execution time will still be smaller than for a standard multiplication).

The available options are as follows:

• Work in the GF(2ⁿ) or in the standard integer arithmetic field
• Add of a supplemental CarryOperand
• Overlapping of the operands is possible, taking into account some constraints
• Modular Reduction of the computation result

This service provides the following (if not computing a modular reduction of the result):

R = [Z] ± (X² + CarryOperand)

Or (if computing a modular reduction of the result):

R = ([Z] ± (X² + CarryOperand))mod N

The service name for this operation is Square.

In these computations, the following data has to be provided:

• R the result (pointed by {nu1RBase,2 *u2Xlength})
• X one input number or GF(2n) polynomial (pointed by{nu1XBase,u2XLength})
• Z one optional input number or GF(2n) polynomial (pointed by {nu1ZBase,2 *u2Xlength})
• CarryOperand (provided through the CarryOptions and Carry values)

If using the big modular reduction option, the Multiply operation is followed by a reduction (see Modular Reduction from Related Links). In this case, the length of Cns is 64 bytes.

If using the modular reduction option the Square operation is followed by a reduction (see Modular Reduction from Related Links). In this case the following parameters must be additionally provided:

• N—the modulus (pointed by {nu1ModBase,u2Modlength +4}).
• Cns—the reduction constant (pointed by {nu1CnsBase,u2Modlength +8})
  • In case of big reduction option, the length of Cns is 64bytes.

For example, if u2ModLength, u2XLength is 0x80 bytes, the length of the R space is 2*(u2ModLength + 4) = 0x108 bytes because of the constraints of modular reduction.

In case of Fast or Normalized Reduction, the length of the result is u2ModLength + 4 so 0x84 bytes. Thus, the zoneX has a length of 0x84 bytes (at least). The square of X provides a result of length 0x100 bytes in the zone R so the 8 MSB bytes previously must be previously padded with zero bytes (in offsets 0x100 to 0x107).

The options are set by the u2Options input parameter, which is composed of:

• the mandatory Square operation option described in Table 37-31
• the mandatory CarryOperand option described in Table 37-32 and Table 37-33
• the facultative Modular Reduction option (see Modular Reduction from Related Links). If the Modular Reduction is not requested, this option is absent.

The u2Options number is calculated by an Inclusive OR of the options. Some Examples in C language are:

• Operation: Square only without carry and without Modular Reduction

  PUKCL(u2Options) = SET_MULTIPLIEROPTION(PUKCL_SQUARE_ONLY) | SET_CARRYOPTION(CARRY_NONE);

• Operation: Square with addition with Specific/CarryIn addition and with Fast Modular Reduction

  PUKCL(u2Options) = SET_MULTIPLIEROPTION(PUKCL_SQUARE_ADD) | SET_CARRYOPTION(ADD_CARRY) | PUKCL_REDMOD_REDUCTION | PUKCL_REDMOD_USING_FASTRED;

The following table lists all of the necessary parameters for the Square option. When the Addition or Subtraction option is not chosen it is not necessary to fill in the nu1ZBase parameter.

PUKCL_PARAM PUKCLParam;
PPUKCL_PARAM pvPUKCLParam = &PUKCLParam;


// Gf2n and CarryIn shall be beforehand filled (with zero or one) 
PUKCL(Specific).Gf2n = ...;
PUKCL(Specific).CarryIn = ...; 

PUKCL(u2Option) =...;
// Depending on the option specified, not all fields must be filled 
PUKCL_Fmult(nu1XBase) = <Base of the ram location of X>; 
PUKCL_Fmult(u2XLength) = <Length of X>;
PUKCL_Fmult(nu1ZBase) = <Base of the ram location of Z>;

// vPUKCL_Process() is a macro command, which populates the service name
// and then calls the library... 
vPUKCL_Process(Square,pvPUKCLParam); 
if (PUKCL(u2Status) == PUKCL_OK)
            {
            // The Squaring has been executed correctly
            ...
            }
else // Manage the error

When the options only indicate a square, the constraints involving nu1ZBase are not checked. The following conditions must be avoided to ensure that the service works correctly:

• nu1XBase, nu1RBase or nu1ZBase are not aligned on 32-bit boundaries
• {nu1XBase, u2XLength}, {nu1ZBase, 2*u2XLength} or {nu1RBase, 2*u2XLength} are not in Crypto RAM
• u2XLength is either: < 4, > 0xffc or not a 32-bit length
• {nu1RBase, 2*u2XLength} overlaps {nu1XBase,u2XLength}
• {nu1RBase, 2*u2XLength} overlaps {nu1ZBase, 2*u2XLength} and nu1RBase >nu1ZBase

If a modular reduction is specified, the relevant parameters must be defined according to the chosen reduction and follow the description in Modular Reduction (see Modular Reduction from Related Links). Additional constraints to be respected and error codes are described in this section and in Table 37-49.

Where the options bits specify that either an accumulation or a subtraction must be performed, this command performs the following operation:

R = (X² + CarryOperand)mod B^{2 ˟ XLength}