version 1.1.2

don't put OID for public key info.
fix configure for certdo
2014-03-07 15:43:05 +09:00 · 2014-02-25 11:06:11 +09:00 · 2014-02-25 09:25:49 +09:00 · 2014-02-21 17:24:19 +09:00 · 2014-02-21 11:36:15 +09:00 · 2014-02-20 12:02:44 +09:00
59 changed files with 3309 additions and 1265 deletions
--- a/184
+++ b/184
@@ -1,3 +1,187 @@
+2014-03-07  Niibe Yutaka  <gniibe@fsij.org>
+
+	* VERSION: 1.1.2.
+
+2014-02-25  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/openpgp-do.c (gpg_do_public_key): Don't put OID.
+
+	* src/configure [certdo] (gnuk.ld): Add TIM_SIZE and EXT_SIZE.
+	Thanks to Vasily Evseenko for the bug report.
+
+2014-02-21  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/ecc.c (compute_kG): Compute higer index at first.
+	(point_is_on_the_curve): Don't use coefficient_a if it's zero.
+
+	* src/jpc.c (jpc_double): Care coefficient A.
+
+	* src/ec_p256r1.c (COEFFICIENT_A_IS_MINUS_3): New.
+	* src/ec_p256k1.c (COEFFICIENT_A_IS_ZERO): New.
+	* src/jpc_p256r1.c (COEFFICIENT_A_IS_MINUS_3): Likewise.
+	* src/jpc_p256k1.c (COEFFICIENT_A_IS_MINUS_3): Likewise.
+
+	* src/modp256k1.c (modp256k1_shift): Bug fix.
+
+2014-02-20  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/Makefile.in (CSRC): Add files of p256k1.
+
+	* src/openpgp.c (cmd_pso): Support p256k1 for signature.
+
+	* src/openpgp-do.c (algorithm_attr_p256k1): New.
+	(gpg_do_write_prvkey): Support p256k1 for signature.
+	(proc_key_import, gpg_do_table, gpg_do_public_key): Likewise.
+
+	* src/Makefile.in (DEFS): Add -DRSA_SIG.
+
+	* src/openpgp-do.c (gpg_do_write_prvkey): Use _p256r1.
+	* src/openpgp.c (cmd_internal_authenticate): Likewise.
+
+	* src/call-ec_p256k1.c: New.  Use call-ec.c.
+	* src/call-ec_p256r1.c: Use call-ec.c.
+	* src/call-ec.c: New.
+	(ecdsa_sign): Change the signature.
+
+2014-02-19  Niibe Yutaka  <gniibe@fsij.org>
+
+	* tool/calc_precompute_table_ecc.py: New.
+
+	* src/ec_p256k1.c: New.  Use ecc.c.
+	* src/ec_p256k1.h: New.
+	* src/ec_p256r1.c: Use ecc.c.
+	* src/ecc.c: New.
+
+2014-02-18  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/jpc_p256k1.c: New.  Use jpc.c.
+	* src/jpc_p256r1.c: Use jpc.c.
+	* src/jpc.c: New.
+
+	* src/sha256.c (memcpy_output_bswap32): Bug fix.
+
+	* src/modp256k1.h, src/modp256k1.c: New.
+
+2014-02-17  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/Makefile.in (CSRC): Follow the changes of filenames.
+
+	* src/modp256r1.c (modp256r1_add, modp256r1_sub, S3)
+	(modp256r1_mul, modp256r1_sqr, modp256r1_inv, modp256r1_shift):
+	Use new function names.
+	* src/jpc_p256r1.c (jpc_double_p256r1, jpc_add_ac_signed_p256r1)
+	(jpc_to_ac_p256r1): Likewise.
+	* src/ec_p256r1.c (point_is_on_the_curve)
+	(compute_kG_p256r1, compute_kP_p256r1): Likewise.
+	* src/call-ec_p256r1.c (ecdsa_sign): Likewise.
+
+	* src/modp256r1.h: Rename from modp256.h.
+	* src/jpc-ac_p256r1.h: Rename from jpc-ac.h.
+	* src/ec_p256r1.h: Rename from ec_p256.h.
+
+	* src/modp256r1.c: Rename from modp256.c.
+	* src/jpc_p256r1.c: Rename from jpc.c.
+	* src/ec_p256r1.c: Rename from ec_p256.c.
+	* src/call-ec_p256r1.c: Rename from call-ec_p256.c.
+
+2014-02-05  NIIBE Yutaka  <gniibe@fsij.org>
+
+	* src/sha512.h, src/sha512.c: New.
+
+	* src/sha256.c (initial_state): Don't export, it's internal.
+	(memcpy_output_bswap32): Rename and remove last argument.
+
+2014-01-28  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/muladd_256.h: New.
+	* src/bn.c (bn256_mul, bn256_sqr): Assembler implementation.
+
+	* src/ec_p256.c (get_vk_kP): Bug fix.
+	(compute_kP): Bug fix for index table.
+
+2014-01-27  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/ec_p256.c (get_vk_kP): New.
+	(naf4_257_set, naf4_257_get, compute_naf4_257):	Remove.
+	(compute_kP): Change the argument, fixing for constant time.
+
+2014-01-24  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/ec_p256.c (get_vk): New.
+	(compute_kG): Fix for constant time.
+	(compute_kP): Simplify.
+
+2014-01-23  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/jpc.c (jpc_add_ac_signed): Fix for constant time.
+
+	* src/ec_p256.c (ecdsa): Bug fix for k selection.
+
+2014-01-22  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/modp256.c (modp256_inv): Fix for constant time.
+
+	* src/bn.c (bn256_sqr): Fix for constant time.
+
+	* src/mod.c (mod_inv): Fix for constant time.
+
+	* src/ec_p256.c (compute_kG): Simplify.
+
+	* src/jpc.c (jpc_double): Support calling with A = infinity.
+
+2014-01-21  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/jpc.c (jpc_add_ac_signed): Bug fix for A check.
+
+	* src/ec_p256.c (ecdsa): Fix for constant time.
+
+	* src/modp256.c (modp256_add, modp256_sub, modp256_reduce)
+	(modp256_shift): Fix for constant time.
+	(modp256_inv): Likewise (not fully constant time, yet).
+
+	* src/mod.c (mod_reduce): Fix for constant time.
+	(mod_inv): Likewise (not fully constant time, yet).
+
+	* src/bn.h (bn256, bn512): words -> word.
+	* src/ec_p256.h (naf4_257): Likewise.
+
+2014-01-20  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/fe25519.h, src/fe25519.c: New.
+
+2014-01-15  Niibe Yutaka  <gniibe@fsij.org>
+
+	* src/bn.c (bn256_is_zero, bn256_is_ge, bn256_cmp): Computation
+	should be constant time.
+
+2013-12-25  Niibe Yutaka  <gniibe@fsij.org>
+
+	* VERSION: 1.1.1.
+
+	* tool/gnuk_token.py (gnuk_token.__init__, regnual.__init__): Fix
+	the argument of setAltInterface.
+	* tool/gnuk_upgrade.py: Likewise.
+	* tool/dfuse.py (DFU_STM32.__init__): Likewise.
+	* tool/stlinkv2.py (stlinkv2.__init__): Likewise.
+
+2013-12-24  Niibe Yutaka  <gniibe@fsij.org>
+
+	* polarssl/include/polarssl/bn_mul.h (MULADDC_1024_CORE)
+	(MULADDC_1024_LOOP): Use younger number registers more for shorter
+	instructions and better performance.
+	* polarssl/library/bignum.c (mpi_montsqr): Likewise.  Change loop
+	structure and conditional branch for better performance.
+
+2013-12-23  Niibe Yutaka  <gniibe@fsij.org>
+
+	* polarssl/library/bignum.c (mpi_montmul): Computation
+	time should not depends on input.
+	(mpi_montmul, mpi_montred, mpi_montsqr): Change the API.
+	(mpi_exp_mod): Follow the change of the API.  Allocate memory on
+	stack instead of malloc.
+
+	* src/gnuk.ld.in (__process3_stack_size__): Increase stack size.
+
 2013-12-20  Niibe Yutaka  <gniibe@fsij.org>

 	* Version 1.1.0.
--- a/23
+++ b/23
@@ -1,5 +1,28 @@
 Gnuk NEWS - User visible changes

+* Major changes in Gnuk 1.1.2
+
+  Released 2014-03-07, by NIIBE Yutaka
+
+** Experimental ECC support for secp256k1.
+After configure, you can edit the DEFS variable in src/Makefile, so
+that Gnuk can support ECDSA with NIST P256 (for authentication), and
+ECDSA with secp256k1 (for signature).  Note that this is pretty much
+experimental, and subjects to change.
+
+
+* Major changes in Gnuk 1.1.1
+
+  Released 2013-12-25, by NIIBE Yutaka
+
+** Tools and test suite now work with PyUSB 1.0, too.
+It only worked with PyUSB 0.4.3, but it works with PyUSB 1.0 too.
+
+** Improved RSA routine
+Working memory for RSA computation is taken from stack instead of
+malloc (mostly).
+
+
 * Major changes in Gnuk 1.1.0

  Released 2013-12-20, by NIIBE Yutaka
--- a/44
+++ b/44
@@ -1,18 +1,21 @@
 Gnuk - An Implementation of USB Cryptographic Token for GnuPG

-							  Version 1.1.0
-							     2013-12-20
+							  Version 1.1.2
+							     2014-03-07
 							   Niibe Yutaka
 				      Free Software Initiative of Japan

 Warning
 =======

-This is an experimental release of Gnuk 1.1.0, which has incompatible
-changes to Gnuk 1.0.x.  Specifically, it now supports overriding key
-import, but importing keys (or generating keys) results password
-reset.  Please update your documentation for Gnuk Token, so that the
-instruction of importing keys won't cause any confusion.
+This is another experimental release of Gnuk, version 1.1.2, which has
+incompatible changes to Gnuk 1.0.x.  Specifically, it now supports
+overriding key import, but importing keys (or generating keys) results
+password reset.  Please update your documentation for Gnuk Token, so
+that the instruction of importing keys won't cause any confusion.  It
+has support of ECDSA (with NIST P256 and secp256k1), but this feature
+is pretty much experimental, and it requires development version of
+GnuPG with newest version of libgcrypt.


 What's Gnuk?
@@ -52,7 +55,8 @@ A0: Good points of Gnuk are:
 	    "for Free Software"; Gnuk supports GnuPG.

 Q1: What kind of key algorithm is supported?
-A1: Gnuk version 1 only supports 2048-bit RSA.
+A1: Gnuk version 1.0 only supports 2048-bit RSA.
+    Development version of Gnuk (1.1.x) supports 256-bit ECDSA.

 Q2: How long does it take for digital signing?
 A2: It takes a second and a half or so. 
@@ -122,11 +126,12 @@ Ac: ST-Link/V2 is cheap one.  We have a tool/stlinkv2.py as flash ROM
 Release notes
 =============

-This is an experimental release in version 1.1 series of Gnuk.
+This is third experimental release in version 1.1 series of Gnuk.

-While it is daily use for a year and a half, some newly introduced
-features (including key generation and firmware upgrade) should be
-considered experimental.
+While it is daily use by its developer, some newly introduced features
+(including ECDSA, key generation and firmware upgrade) should be
+considered experimental.  ECDSA is really experimental.  The feature
+even requires manual edit of Makefile after 'configure'.

 Tested features are:

@@ -218,7 +223,7 @@ External source code

 Gnuk is distributed with external source code.

-* chopstx/  -- Chopstx 0.04
+* chopstx/  -- Chopstx 0.03 (+ STBee support)

  We use Chopstx as the kernel for Gnuk.

@@ -465,7 +470,7 @@ How to configure
 ================

 You need python and pyscard (python-pyscard package in Debian) or
-PyUSB (python-usb package in Debian).
+PyUSB 0.4.3 (python-usb package in Debian).

 (1) [pyscard] Stop scdaemon
    [PyUSB] Stop the pcsc daemon.
@@ -581,10 +586,19 @@ Git Repositories

 Please use: http://gitorious.org/gnuk

+You can get it by:
+ 
+    $ git clone git://gitorious.org/gnuk/gnuk.git
+
 It's also available at: www.gniibe.org
 You can browse at: http://www.gniibe.org/gitweb?p=gnuk.git;a=summary

-We migrated from ChibiOS/RT to Chopstix.  If you have old code of
+I put Chopstx as a submodule of Git.  Please do this:
+
+  $ git submodule init
+  $ git submodule update
+
+We have migrated from ChibiOS/RT to Chopstx.  If you have old code of
 ChibiOS/RT, you need:

    Edit .git/config to remove chibios reference
--- a/1
+++ b/1
@@ -19,4 +19,5 @@ NAGAMI Takeshi		nagami-takeshi@aist.go.jp
 Nguyễn Hồng Quân	quannguyen@mbm.vn
 Paul Bakker		polarssl_maintainer@polarssl.org
 Shane Coughlan		scoughlan@openinventionnetwork.com
+Vasily Evseenko
 Werner Koch		wk@gnupg.org
--- a/2
+++ b/2
@@ -1 +1 @@
-release/1.1.0
+release/1.1.2
--- a/doc/development.rst
+++ b/doc/development.rst
@@ -38,7 +38,7 @@ You need GNU toolchain and newlib for 'arm-none-eabi' target.
 There is "gcc-arm-embedded" project.  See:
 https://launchpad.net/gcc-arm-embedded/

-It is based on GCC 4.7 (as of October, 2013).  We are using "-O3 -Os"
+It is based on GCC 4.8 (as of December, 2013).  We are using "-O3 -Os"
 for compiler option.


--- a/doc/generating-2048-RSA-key.rst
+++ b/doc/generating-2048-RSA-key.rst
@@ -121,7 +121,7 @@ Then, GnuPG generate keys.  It takes some time.  ::
  Not enough random bytes available.  Please do some other work to give
  the OS a chance to collect more entropy! (Need 15 more bytes)
  ...+++++
-  gpg: key 28C0CD7C marked as ultimately trusted
+  gpg: key 4CA7BABE marked as ultimately trusted
  public and secret key created and signed.
  
  gpg: checking the trustdb
--- a/doc/gnuk-keytocard-noremoval.rst
+++ b/doc/gnuk-keytocard-noremoval.rst
@@ -44,7 +44,6 @@ and type ``1`` to say it's signature key. ::

  gpg> keytocard
  Really move the primary key? (y/N) y
-  gpg: detected reader `FSIJ Gnuk (0.12-38FF6A06) 00 00'
  Signature key ....: [none]
  Encryption key....: [none]
  Authentication key: [none]
--- a/doc/gnuk-keytocard.rst
+++ b/doc/gnuk-keytocard.rst
@@ -56,7 +56,6 @@ and type ``1`` to say it's signature key. ::

  gpg> keytocard
  Really move the primary key? (y/N) y
-  gpg: detected reader `FSIJ Gnuk (0.12-38FF6A06) 00 00'
  Signature key ....: [none]
  Encryption key....: [none]
  Authentication key: [none]
--- a/doc/gnuk-passphrase-setting.rst
+++ b/doc/gnuk-passphrase-setting.rst
@@ -28,27 +28,38 @@ Set up PW1, PW3 and reset code
 Invoke GnuPG with the option ``--card-edit``.  ::

  $ gpg --card-edit
-  gpg: detected reader `FSIJ Gnuk (0.12-34006E06) 00 00'
  Application ID ...: D276000124010200F517000000010000
  Version ..........: 2.0
  Manufacturer .....: FSIJ
  Serial number ....: 00000001
-  Name of cardholder: [not set]
-  Language prefs ...: [not set]
-  Sex ..............: unspecified
-  URL of public key : [not set]
-  Login data .......: [not set]
-  Signature PIN ....: forced
+  Name of cardholder: Yutaka Niibe
+  Language prefs ...: ja
+  Sex ..............: male
+  URL of public key : http://www.gniibe.org/gniibe.asc
+  Login data .......: gniibe
+  Signature PIN ....: not forced
  Key attributes ...: 2048R 2048R 2048R
  Max. PIN lengths .: 127 127 127
  PIN retry counter : 3 3 3
  Signature counter : 0
-  Signature key ....: [none]
-  Encryption key....: [none]
-  Authentication key: [none]
-  General key info..: [none]
+  Signature key ....: 1241 24BD 3B48 62AF 7A0A  42F1 00B4 5EBD 4CA7 BABE
+        created ....: 2010-10-15 06:46:33
+  Encryption key....: 42E1 E805 4E6F 1F30 26F2  DC79 79A7 9093 0842 39CF
+        created ....: 2010-10-15 06:46:33
+  Authentication key: B4D9 7142 C42D 6802 F5F7  4E70 9C33 B6BA 5BB0 65DC
+        created ....: 2010-10-22 06:06:36
+  General key info..: 
+  pub  2048R/4CA7BABE 2010-10-15 NIIBE Yutaka <gniibe@fsij.org>
+  sec>  2048R/4CA7BABE  created: 2010-10-15  expires: never     
+                        card-no: F517 00000001
+  ssb>  2048R/084239CF  created: 2010-10-15  expires: never     
+                        card-no: F517 00000001
+  ssb>  2048R/5BB065DC  created: 2010-10-22  expires: never     
+                        card-no: F517 00000001

-It shows the status of the card (as same as the output of ``gpg --card-status``).  It shows token's name and its USB serial string (0.12-34006E06) from PC/SC-lite.
+  gpg/card> 
+
+It shows the status of the card (as same as the output of ``gpg --card-status``).

 Then, GnuPG enters its own command interaction mode.  The prompt is ``gpg/card>``.

@@ -83,8 +94,13 @@ please change admin-password at first.
 Then, the token works as same as OpenPGPcard specification
 with regards to PW1 and PW3.)

-Lastly, I setup reset code.  This is optional. ::
+Lastly, I setup reset code, entering admin mode.
+Having reset code, you can unblock PIN when the token will be blocked
+(by wrong attempt to entering PIN).  This is optional step. ::

+  gpg/card> admin
+  Admin commands are allowed
+  
  gpg/card> passwd
  gpg: OpenPGP card no. D276000124010200F517000000010000 detected
  
--- a/doc/gnuk-personalization.rst
+++ b/doc/gnuk-personalization.rst
@@ -9,11 +9,10 @@ Personalize your Gnuk Token
 Invoke GnuPG with the option ``--card-edit``.  ::

  $ gpg --card-edit
-  gpg: detected reader `FSIJ Gnuk (0.12-34006E06) 00 00'
-  Application ID ...: D276000124010200F517000000010000
+  Application ID ...: D276000124010200FFFE330069060000
  Version ..........: 2.0
-  Manufacturer .....: FSIJ
-  Serial number ....: 00000001
+  Manufacturer .....: unmanaged S/N range
+  Serial number ....: 33006906
  Name of cardholder: [not set]
  Language prefs ...: [not set]
  Sex ..............: unspecified
@@ -28,8 +27,10 @@ Invoke GnuPG with the option ``--card-edit``.  ::
  Encryption key....: [none]
  Authentication key: [none]
  General key info..: [none]
+  
+  gpg/card> 

-It shows the status of the card (as same as the output of ``gpg --card-status``).  It shows token's name and its USB serial string (0.12-34006E06) from PC/SC-lite.
+It shows the status of the card (as same as the output of ``gpg --card-status``).

 Then, GnuPG enters its own command interaction mode.  The prompt is ``gpg/card>``.

--- a/doc/intro.rst
+++ b/doc/intro.rst
@@ -51,7 +51,7 @@ Host prerequisites for using Gnuk Token

 * [Optional] PC/SC lite (pcscd, libccid)

-* SSH: openssh
+* [Optional] SSH: openssh

 * [optional] Web: scute, firefox

--- a/doc/note/HACKING
+++ b/doc/note/HACKING
@@ -5,7 +5,7 @@ It is important to collect enough entropy.  Perhaps, it would
 be possible to get entropy from USB traffic (of other devices).


-* RSA
+* [Mostly DONE] RSA

 It would be good not to use malloc.

--- a/doc/using-gnuk-token-with-another-computer.rst
+++ b/doc/using-gnuk-token-with-another-computer.rst
@@ -18,7 +18,6 @@ key reference (to the token) in ``.gnupg``.
 To do that, invoke GnuPG with ``--card-edit`` option. ::

  $ gpg --card-edit
-  gpg: detected reader `FSIJ Gnuk (0.12-37006A06) 00 00'
  Application ID ...: D276000124010200F517000000010000
  Version ..........: 2.0
  Manufacturer .....: FSIJ
--- a/polarssl/include/polarssl/bn_mul.h
+++ b/polarssl/include/polarssl/bn_mul.h
@@ -496,64 +496,64 @@

 #if defined(__arm__)
 #define MULADDC_1024_CORE                        \
-       "ldmia  %0!, { r5, r6, r7 }  \n\t"        \
-       "ldmia  %1, { r8, r9, r10 }  \n\t"        \
-       "adcs   r8, r8, %2           \n\t"        \
-       "umull  r11, r12, r5, %4     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r8, r8, r11          \n\t"        \
-       "adcs   r9, r9, %2           \n\t"        \
-       "umull  r11, r12, r6, %4     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r9, r9, r11          \n\t"        \
-       "adcs   r10, r10, %2         \n\t"        \
-       "umull  r11, r12, r7, %4     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r10, r10, r11        \n\t"        \
-       "stmia  %1!, { r8, r9, r10 } \n\t"
+       "ldmia  %[s]!, { r8, r9, r10 } \n\t"      \
+       "ldmia  %[d], { r5, r6, r7 }   \n\t"      \
+       "adcs   r5, r5, %[c]           \n\t"      \
+       "umull  r4, r8, r8, %[b]       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r5, r5, r4             \n\t"      \
+       "adcs   r6, r6, %[c]           \n\t"      \
+       "umull  r4, r8, r9, %[b]       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r6, r6, r4             \n\t"      \
+       "adcs   r7, r7, %[c]           \n\t"      \
+       "umull  r4, r8, r10, %[b]      \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r7, r7, r4             \n\t"      \
+       "stmia  %[d]!, { r5, r6, r7 }  \n\t"

 #define MULADDC_1024_LOOP                        \
-  asm( "tst    %3, #0xfe0           \n\t"        \
-       "beq    0f                   \n"          \
-"1:	sub    %3, %3, #32          \n\t"        \
-       "ldmia  %0!, { r5, r6, r7 }  \n\t"        \
-       "ldmia  %1, { r8, r9, r10 }  \n\t"        \
-       "adds   r8, r8, %2           \n\t"        \
-       "umull  r11, r12, %4, r5     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r8, r8, r11          \n\t"        \
-       "adcs   r9, r9, %2           \n\t"        \
-       "umull  r11, r12, %4, r6     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r9, r9, r11          \n\t"        \
-       "adcs   r10, r10, %2         \n\t"        \
-       "umull  r11, r12, %4, r7     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r10, r10, r11        \n\t"        \
-       "stmia  %1!, { r8, r9, r10 } \n\t"        \
+  asm( "tst    %[i], #0xfe0           \n\t"      \
+       "beq    0f                     \n"        \
+"1:	ldmia  %[s]!, { r8, r9, r10 } \n\t"      \
+       "ldmia  %[d], { r5, r6, r7 }   \n\t"      \
+       "sub    %[i], %[i], #32        \n\t"      \
+       "adds   r5, r5, %[c]           \n\t"      \
+       "umull  r4, r8, %[b], r8       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r5, r5, r4             \n\t"      \
+       "adcs   r6, r6, %[c]           \n\t"      \
+       "umull  r4, r8, %[b], r9       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r6, r6, r4             \n\t"      \
+       "adcs   r7, r7, %[c]           \n\t"      \
+       "umull  r4, r8, %[b], r10      \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r7, r7, r4             \n\t"      \
+       "stmia  %[d]!, { r5, r6, r7 }  \n\t"      \
       MULADDC_1024_CORE MULADDC_1024_CORE       \
       MULADDC_1024_CORE MULADDC_1024_CORE       \
       MULADDC_1024_CORE MULADDC_1024_CORE       \
       MULADDC_1024_CORE MULADDC_1024_CORE       \
       MULADDC_1024_CORE                         \
-       "ldmia  %0!, { r5, r6 }      \n\t"        \
-       "ldmia  %1, { r8, r9 }       \n\t"        \
-       "adcs   r8, r8, %2           \n\t"        \
-       "umull  r11, r12, %4, r5     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r8, r8, r11          \n\t"        \
-       "adcs   r9, r9, %2           \n\t"        \
-       "umull  r11, r12, %4, r6     \n\t"        \
-       "adc    %2, r12, #0          \n\t"        \
-       "adds   r9, r9, r11          \n\t"        \
-       "stmia  %1!, { r8, r9 }      \n\t"        \
-       "adc    %2, %2, #0           \n\t"        \
-       "tst    %3, #0xfe0           \n\t"        \
-       "bne    1b                   \n"          \
+       "ldmia  %[s]!, { r8, r9 }      \n\t"      \
+       "ldmia  %[d], { r5, r6 }       \n\t"      \
+       "adcs   r5, r5, %[c]           \n\t"      \
+       "umull  r4, r8, %[b], r8       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r5, r5, r4             \n\t"      \
+       "adcs   r6, r6, %[c]           \n\t"      \
+       "umull  r4, r8, %[b], r9       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r6, r6, r4             \n\t"      \
+       "adc    %[c], %[c], #0         \n\t"      \
+       "stmia  %[d]!, { r5, r6 }      \n\t"      \
+       "tst    %[i], #0xfe0           \n\t"      \
+       "bne    1b                     \n"        \
 "0:"                                             \
-       : "=r" (s), "=r" (d), "=r" (c), "=r" (i)       \
-       : "r" (b), "0" (s), "1" (d), "2" (c), "3" (i)  \
-       : "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12", "memory", "cc" );
+       : [s] "=r" (s), [d] "=r" (d), [c] "=r" (c), [i] "=r" (i)    \
+       : [b] "r" (b), "[s]" (s), "[d]" (d), "[c]" (c), "[i]" (i)   \
+       : "r4", "r5", "r6", "r7", "r8", "r9", "r10", "memory", "cc" );

 /* Just for reference (dead code) */
 #define MULADDC_HUIT                                   \
--- a/polarssl/library/bignum.c
+++ b/polarssl/library/bignum.c
@@ -1382,16 +1382,13 @@ static void mpi_montg_init( t_uint *mm, const mpi *N )

 /*
 * Montgomery multiplication: A = A * B * R^-1 mod N  (HAC 14.36)
- * A is placed at the upper half of T.
+ * A is placed at the upper half of D.
 */
-static void mpi_montmul( const mpi *B, const mpi *N, t_uint mm, mpi *T )
+static void mpi_montmul( size_t n, const t_uint *np, t_uint mm, t_uint *d,
+                         const t_uint *bp )
 {
-    size_t i, n, m;
-    t_uint u0, u1, *d, c = 0;
-
-    d = T->p;
-    n = N->n;
-    m = ( B->n < n ) ? B->n : n;
+    size_t i;
+    t_uint u0, u1, c = 0;

    for( i = 0; i < n; i++ )
    {
@@ -1400,31 +1397,28 @@ static void mpi_montmul( const mpi *B, const mpi *N, t_uint mm, mpi *T )
         */
        u0 = d[n];
        d[n] = c;
-        u1 = ( d[0] + u0 * B->p[0] ) * mm;
+        u1 = ( d[0] + u0 * bp[0] ) * mm;

-        mpi_mul_hlp( m, B->p, d, u0 );
-        c = mpi_mul_hlp( n, N->p, d, u1 );
+        mpi_mul_hlp( n, bp, d, u0 );
+        c = mpi_mul_hlp( n, np, d, u1 );
        d++;
    }

    /* prevent timing attacks */
-    if( ((mpi_cmp_abs_limbs ( n, d, N->p ) >= 0) | c) )
-        mpi_sub_hlp( n, N->p, d );
+    if( ((mpi_cmp_abs_limbs ( n, d, np ) >= 0) | c) )
+        mpi_sub_hlp( n, np, d );
    else
-        mpi_sub_hlp( n, T->p, T->p);
+        mpi_sub_hlp( n, d - n, d - n);
 }

 /*
 * Montgomery reduction: A = A * R^-1 mod N
- * A is placed at the upper half of T.
+ * A is placed at the upper half of D.
 */
-static void mpi_montred( const mpi *N, t_uint mm, mpi *T )
+static void mpi_montred( size_t n, const t_uint *np, t_uint mm, t_uint *d )
 {
-    size_t i, j, n;
-    t_uint u0, u1, *d, c = 0;
-
-    d = T->p;
-    n = N->n;
+    size_t i, j;
+    t_uint u0, u1, c = 0;

    for( i = 0; i < n; i++ )
    {
@@ -1442,116 +1436,106 @@ static void mpi_montred( const mpi *N, t_uint mm, mpi *T )
            d[j] += c; c = ( d[j] < c );
          }

-        c = mpi_mul_hlp( n, N->p, d, u1 );
+        c = mpi_mul_hlp( n, np, d, u1 );
        d++;
    }

    /* prevent timing attacks */
-    if( ((mpi_cmp_abs_limbs ( n, d, N->p ) >= 0) | c) )
-        mpi_sub_hlp( n, N->p, d );
+    if( ((mpi_cmp_abs_limbs ( n, d, np ) >= 0) | c) )
+        mpi_sub_hlp( n, np, d );
    else
-        mpi_sub_hlp( n, T->p, T->p);
+        mpi_sub_hlp( n, d - n, d - n);
 }

 /*
 * Montgomery square: A = A * A * R^-1 mod N
- * A is placed at the upper half of T.
+ * A is placed at the upper half of D.
 */
-static void mpi_montsqr( const mpi *N, t_uint mm, mpi *T )
+static void mpi_montsqr( size_t n, const t_uint *np, t_uint mm, t_uint *d )
 {
-  size_t n, i;
-  t_uint c = 0, *d;
-
-  d = T->p;
-  n = N->n;
+  size_t i;
+  register t_uint c = 0;

  for (i = 0; i < n; i++)
    {
      t_uint *wij = &d[i*2];
      t_uint *xj = &d[i+n];
-      t_uint u, x_i;
+      t_uint x_i;

      x_i = *xj;
      *xj++ = c;
-      asm ("mov    r8, #0\n\t"  /* R8 := 0, the constant ZERO from here.  */
-           /* (C,U,R9) := w_i_i + x_i*x_i; w_i_i := R9; */
-           "ldr    r9, [%[wij]]\n\t"          /* R9 := w_i_i; */
-           "mov    %[c], r8\n\t"
-           "umull  r11, r12, %[x_i], %[x_i]\n\t"
-           "adds   r9, r9, r11\n\t"
-           "adc    %[u], r8, r12\n\t"
-           "str    r9, [%[wij]], #4\n\t"
+      asm (/* (C,R4,R5) := w_i_i + x_i*x_i; w_i_i := R5; */
+           "mov    %[c], #0\n\t"
+           "ldr    r5, [%[wij]]\n\t"          /* R5 := w_i_i; */
+           "mov    r4, %[c]\n\t"
+           "umlal  r5, r4, %[x_i], %[x_i]\n\t"
+           "str    r5, [%[wij]], #4\n\t"
+           "cmp    %[xj], %[x_max1]\n\t"
+           "bhi    0f\n\t"
+           "mov    r9, %[c]\n\t"  /* R9 := 0, the constant ZERO from here.  */
+           "beq    1f\n"
+   "2:\n\t"
+           "ldmia  %[xj]!, { r7, r8 }\n\t"
+           "ldmia  %[wij], { r5, r6 }\n\t"
+           /* (C,R4,R5) := (C,R4) + w_i_j + 2*x_i*x_j; */
+           "umull  r7, r12, %[x_i], r7\n\t"
+           "adds   r5, r5, r4\n\t"
+           "adc    r4, %[c], r9\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], r9, r9\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], %[c], r9\n\t"
+           /* (C,R4,R6) := (C,R4) + w_i_j + 2*x_i*x_j; */
+           "adds   r6, r6, r4\n\t"
+           "adc    r4, %[c], r9\n\t"
+           "umull  r7, r12, %[x_i], r8\n\t"
+           "adds   r6, r6, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], r9, r9\n\t"
+           "adds   r6, r6, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], %[c], r9\n\t"
           /**/
-           "subs   r9, %[xj_max], %[xj]\n\t"
-           "bls    1f\n\t"
-           /**/
-           "tst    r9, #4\n\t"
-           "beq    0f\n\t"
-           /* (C,U,R9) := (C,U) + w_i_j + 2*x_i*x_j; */
-           "ldr    r10, [%[xj]], #4\n\t"
-           "ldr    r9, [%[wij]]\n\t"
-           "adds   r9, r9, %[u]\n\t"
-           "adc    %[u], %[c], r8\n\t"
-           "umull  r11, r12, %[x_i], r10\n\t"
-           "adds   r9, r9, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], r8, r8\n\t"
-           "adds   r9, r9, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], %[c], r8\n\t"
-           "str    r9, [%[wij]], #4\n\t"
-           /**/
-           "subs   r9, %[xj_max], %[xj]\n\t"
-           "bls    1f\n"
-   "0:\n\t"
-           "ldmia  %[xj]!, { r6, r7 }\n\t"
-           "ldmia  %[wij], { r9, r10 }\n\t"
-           /* (C,U,R9) := (C,U) + w_i_j + 2*x_i*x_j; */
-           "umull  r11, r12, %[x_i], r6\n\t"
-           "adds   r9, r9, %[u]\n\t"
-           "adc    %[u], %[c], r8\n\t"
-           "adds   r9, r9, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], r8, r8\n\t"
-           "adds   r9, r9, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], %[c], r8\n\t"
-           /* (C,U,R10) := (C,U) + w_i_j + 2*x_i*x_j; */
-           "adds   r10, r10, %[u]\n\t"
-           "adc    %[u], %[c], r8\n\t"
-           "umull  r11, r12, %[x_i], r7\n\t"
-           "adds   r10, r10, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], r8, r8\n\t"
-           "adds   r10, r10, r11\n\t"
-           "adcs   %[u], %[u], r12\n\t"
-           "adc    %[c], %[c], r8\n\t"
-           /**/
-           "stmia  %[wij]!, { r9, r10 }\n\t"
-           /**/
-           "cmp    %[xj], %[xj_max]\n\t"
-           "bcc    0b\n"
+           "stmia  %[wij]!, { r5, r6 }\n\t"
+           "cmp    %[xj], %[x_max1]\n\t"
+           "bcc    2b\n\t"
+           "bne    0f\n"
   "1:\n\t"
-           "ldr    r9, [%[wij]]\n\t"
-           "adds   %[u], %[u], r9\n\t"
-           "adc    %[c], %[c], r8\n\t"
-           "str    %[u], [%[wij]]"
-           : [c] "=&r" (c), [u] "=&r" (u), [wij] "=r" (wij), [xj] "=r" (xj)
-           : [x_i] "r" (x_i), [xj_max] "r" (&d[n*2]),
+           /* (C,R4,R5) := (C,R4) + w_i_j + 2*x_i*x_j; */
+           "ldr    r5, [%[wij]]\n\t"
+           "ldr    r6, [%[xj]], #4\n\t"
+           "adds   r5, r5, r4\n\t"
+           "adc    r4, %[c], r9\n\t"
+           "umull  r7, r12, %[x_i], r6\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], r9, r9\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], %[c], r9\n\t"
+           "str    r5, [%[wij]], #4\n"
+   "0:\n\t"
+           "ldr    r5, [%[wij]]\n\t"
+           "adds   r4, r4, r5\n\t"
+           "adc    %[c], %[c], #0\n\t"
+           "str    r4, [%[wij]]"
+           : [c] "=&r" (c), [wij] "=r" (wij), [xj] "=r" (xj)
+           : [x_i] "r" (x_i), [x_max1] "r" (&d[n*2-1]),
             "[wij]" (wij), "[xj]" (xj)
-           : "r6", "r7", "r8", "r9", "r10", "r11", "r12", "memory", "cc" );
+           : "r4", "r5", "r6", "r7", "r8", "r9", "r12", "memory", "cc");

-        u = d[i] * mm;
-        c += mpi_mul_hlp( n, N->p, &d[i], u );
+        c += mpi_mul_hlp( n, np, &d[i], d[i] * mm );
    }

-  d = T->p + n;
+  d += n;

  /* prevent timing attacks */
-  if( ((mpi_cmp_abs_limbs ( n, d, N->p ) >= 0) | c) )
-      mpi_sub_hlp( n, N->p, d );
+  if( ((mpi_cmp_abs_limbs ( n, d, np ) >= 0) | c) )
+      mpi_sub_hlp( n, np, d );
  else
-      mpi_sub_hlp( n, T->p, T->p);
+      mpi_sub_hlp( n, d - n, d - n);
 }

 /*
@@ -1560,12 +1544,17 @@ static void mpi_montsqr( const mpi *N, t_uint mm, mpi *T )
 int mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR )
 {
    int ret;
-    size_t wbits, wsize, one = 1;
-    size_t i, j, nblimbs;
+    size_t i = mpi_msb( E );
+    size_t wsize = ( i > 671 ) ? 6 : ( i > 239 ) ? 5 :
+                   ( i >  79 ) ? 4 : ( i >  23 ) ? 3 : 1;
+    size_t wbits, one = 1;
+    size_t nblimbs;
    size_t bufsize, nbits;
    t_uint ei, mm, state;
-    mpi RR, T, W[ 2 << POLARSSL_MPI_WINDOW_SIZE ], Apos;
-    int neg;
+    mpi RR;
+    t_uint d[N->n*2];
+    t_uint w1[N->n];
+    t_uint wn[(one << (wsize - 1))][N->n];

    if( mpi_cmp_int( N, 0 ) < 0 || ( N->p[0] & 1 ) == 0 )
        return( POLARSSL_ERR_MPI_BAD_INPUT_DATA );
@@ -1573,97 +1562,76 @@ int mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR )
    if( mpi_cmp_int( E, 0 ) < 0 )
        return( POLARSSL_ERR_MPI_BAD_INPUT_DATA );

+    if( A->s == -1 )
+        return( POLARSSL_ERR_MPI_BAD_INPUT_DATA );
+
    /*
     * Init temps and window size
     */
    mpi_montg_init( &mm, N );
-    mpi_init( &RR ); mpi_init( &T );
-    memset( W, 0, sizeof( W ) );
-
-    i = mpi_msb( E );
-
-    wsize = ( i > 671 ) ? 6 : ( i > 239 ) ? 5 :
-            ( i >  79 ) ? 4 : ( i >  23 ) ? 3 : 1;
-
-    if( wsize > POLARSSL_MPI_WINDOW_SIZE )
-        wsize = POLARSSL_MPI_WINDOW_SIZE;
-
-    j = N->n;
    MPI_CHK( mpi_grow( X, N->n ) );
-    MPI_CHK( mpi_grow( &W[1],  N->n ) );
-    MPI_CHK( mpi_grow( &T, N->n * 2 ) ); /* T = 0 here.  */
-
-    /*
-     * Compensate for negative A (and correct at the end)
-     */
-    neg = ( A->s == -1 );
-
-    mpi_init( &Apos );
-    if( neg )
-    {
-        MPI_CHK( mpi_copy( &Apos, A ) );
-        Apos.s = 1;
-        A = &Apos;
-    }

    /*
     * If 1st call, pre-compute R^2 mod N
     */
    if( _RR == NULL || _RR->p == NULL )
    {
-        /* T->p is all zero here. */
-        mpi_sub_hlp( N->n, N->p, T.p + N->n);
+        mpi T;
+
+        mpi_init( &RR );
+        T.s = 1; T.n = N->n * 2; T.p = d;
+        memset (d, 0, 2 * N->n * ciL); /* Set D zero. */
+        mpi_sub_hlp( N->n, N->p, d + N->n);
        MPI_CHK( mpi_mod_mpi( &RR, &T, N ) );

        if( _RR != NULL )
            memcpy( _RR, &RR, sizeof( mpi ) );

-        /* The condition of "the lower half of T is all zero" is kept. */
+        /* The condition of "the lower half of D is all zero" is kept. */
    }
-    else
+    else {
        memcpy( &RR, _RR, sizeof( mpi ) );
+        memset (d, 0, N->n * ciL); /* Set lower half of D zero. */
+    }

    /*
     * W[1] = A * R^2 * R^-1 mod N = A * R mod N
     */
-    if( mpi_cmp_mpi( A, N ) >= 0 )
-        mpi_mod_mpi( &W[1], A, N );
-    else   mpi_copy( &W[1], A );
+    if( mpi_cmp_mpi( A, N ) >= 0 ) {
+        mpi W1;
+        W1.s = 1; W1.n = N->n; W1.p = d + N->n;
+        mpi_mod_mpi( &W1, A, N );
+    } else {
+        memset (d + N->n, 0, N->n * ciL);
+        memcpy (d + N->n, A->p, A->n * ciL);
+    }

-    memcpy ( T.p + N->n, W[1].p, N->n * ciL);
-    mpi_montmul( &RR, N, mm, &T );
-    memcpy ( W[1].p, T.p + N->n, N->n * ciL);
+    mpi_montmul( N->n, N->p, mm, d, RR.p );
+    memcpy (w1, d + N->n, N->n * ciL);

-    if( wsize > 1 )
    {
        /*
         * W[1 << (wsize - 1)] = W[1] ^ ( 2 ^ (wsize - 1) )
         */
-        j =  one << (wsize - 1);
-
-        MPI_CHK( mpi_grow( &W[j], N->n  ) );
-
        for( i = 0; i < wsize - 1; i++ )
-            mpi_montsqr( N, mm, &T );
-        memcpy ( W[j].p, T.p + N->n, N->n * ciL);
+            mpi_montsqr( N->n, N->p, mm, d );
+        memcpy (wn[0], d + N->n, N->n * ciL);

        /*
         * W[i] = W[i - 1] * W[1]
         */
-        for( i = j + 1; i < (one << wsize); i++ )
+        for( i = 1; i < (one << (wsize - 1)); i++ )
        {
-            MPI_CHK( mpi_grow( &W[i], N->n      ) );
-
-            mpi_montmul( &W[1], N, mm, &T );
-            memcpy ( W[i].p, T.p + N->n, N->n * ciL);
+            mpi_montmul( N->n, N->p, mm, d, w1 );
+            memcpy (wn[i], d + N->n, N->n * ciL);
        }
    }

    /*
     * X = R^2 * R^-1 mod N = R mod N
     */
-    memcpy ( T.p + N->n, RR.p, N->n * ciL);
-    mpi_montred( N, mm, &T );
+    memcpy (d + N->n, RR.p, N->n * ciL);
+    mpi_montred( N->n, N->p, mm, d );

    nblimbs = E->n;
    bufsize = 0;
@@ -1696,7 +1664,7 @@ int mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR )
            /*
             * out of window, square X
             */
-            mpi_montsqr( N, mm, &T );
+             mpi_montsqr( N->n, N->p, mm, d );
            continue;
        }

@@ -1714,12 +1682,12 @@ int mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR )
             * X = X^wsize R^-1 mod N
             */
            for( i = 0; i < wsize; i++ )
-                mpi_montsqr( N, mm, &T );
+                mpi_montsqr( N->n, N->p, mm, d );

            /*
             * X = X * W[wbits] R^-1 mod N
             */
-            mpi_montmul( &W[wbits], N, mm, &T );
+            mpi_montmul( N->n, N->p, mm, d, wn[wbits - (one << (wsize - 1))]);

            state--;
            nbits = 0;
@@ -1732,33 +1700,22 @@ int mpi_exp_mod( mpi *X, const mpi *A, const mpi *E, const mpi *N, mpi *_RR )
     */
    for( i = 0; i < nbits; i++ )
    {
-        mpi_montsqr( N, mm, &T );
+        mpi_montsqr( N->n, N->p, mm, d );

        wbits <<= 1;

        if( (wbits & (one << wsize)) != 0 )
-            mpi_montmul( &W[1], N, mm, &T );
+            mpi_montmul( N->n, N->p, mm, d, w1);
    }

    /*
     * X = A^E * R * R^-1 mod N = A^E mod N
     */
-    mpi_montred( N, mm, &T );
-    memcpy ( X->p, T.p + N->n, N->n * ciL);
-
-    if( neg )
-    {
-        X->s = -1;
-        mpi_add_mpi( X, N, X );
-    }
+    mpi_montred( N->n, N->p, mm, d );
+    memcpy (X->p, d + N->n, N->n * ciL);

 cleanup:

-    for( i = (one << (wsize - 1)); i < (one << wsize); i++ )
-        mpi_free( &W[i] );
-
-    mpi_free( &W[1] ); mpi_free( &T ); mpi_free( &Apos );
-
    if( _RR == NULL )
        mpi_free( &RR );

--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -12,7 +12,9 @@ CSRC = main.c usb_stm32f103.c adc_stm32f103.c \
 	usb_desc.c usb_ctrl.c \
 	call-rsa.c \
 	usb-icc.c openpgp.c ac.c openpgp-do.c flash.c \
-	bn.c modp256.c jpc.c mod.c ec_p256.c call-ec_p256.c \
+	bn.c mod.c \
+	modp256r1.c jpc_p256r1.c ec_p256r1.c call-ec_p256r1.c \
+	modp256k1.c jpc_p256k1.c ec_p256k1.c call-ec_p256k1.c \
 	random.c neug.c sha256.c sys.c

 INCDIR =
@@ -52,7 +54,7 @@ OBJCOPY   = $(CROSS)objcopy
 MCU   = cortex-m3
 CWARN = -Wall -Wextra -Wstrict-prototypes
 # DEFS: Add  
-DEFS  = -DCHX_PRIO_MAIN=5 -DRSA_AUTH @KEYGEN_SUPPORT@ @HAVE_SYS_H@
+DEFS  = -DCHX_PRIO_MAIN=5 -DRSA_AUTH -DRSA_SIG @KEYGEN_SUPPORT@ @HAVE_SYS_H@
 OPT   = -O3 -Os -g
 LIBS  =

--- a/src/bn.c
+++ b/src/bn.c
@@ -1,7 +1,7 @@
 /*
 * bn.c -- 256-bit (and 512-bit) bignum calculation
 *
- * Copyright (C) 2011, 2013 Free Software Initiative of Japan
+ * Copyright (C) 2011, 2013, 2014 Free Software Initiative of Japan
 * Author: NIIBE Yutaka <gniibe@fsij.org>
 *
 * This file is a part of Gnuk, a GnuPG USB Token implementation.
@@ -22,7 +22,7 @@
 */

 #include <stdint.h>
-#include <stdlib.h>
+#include <string.h>
 #include "random.h"
 #include "bn.h"

@@ -34,9 +34,9 @@ bn256_add (bn256 *X, const bn256 *A, const bn256 *B)
  uint32_t *px;
  const uint32_t *pa, *pb;

-  px = X->words;
-  pa = A->words;
-  pb = B->words;
+  px = X->word;
+  pa = A->word;
+  pb = B->word;

  for (i = 0; i < BN256_WORDS; i++)
    {
@@ -60,9 +60,9 @@ bn256_sub (bn256 *X, const bn256 *A, const bn256 *B)
  uint32_t *px;
  const uint32_t *pa, *pb;

-  px = X->words;
-  pa = A->words;
-  pb = B->words;
+  px = X->word;
+  pa = A->word;
+  pb = B->word;

  for (i = 0; i < BN256_WORDS; i++)
    {
@@ -87,8 +87,8 @@ bn256_add_uint (bn256 *X, const bn256 *A, uint32_t w)
  uint32_t *px;
  const uint32_t *pa;

-  px = X->words;
-  pa = A->words;
+  px = X->word;
+  pa = A->word;

  for (i = 0; i < BN256_WORDS; i++)
    {
@@ -115,8 +115,8 @@ bn256_sub_uint (bn256 *X, const bn256 *A, uint32_t w)
  uint32_t *px;
  const uint32_t *pa;

-  px = X->words;
-  pa = A->words;
+  px = X->word;
+  pa = A->word;

  for (i = 0; i < BN256_WORDS; i++)
    {
@@ -138,9 +138,30 @@ bn256_sub_uint (bn256 *X, const bn256 *A, uint32_t w)
  return borrow;
 }

+#ifndef BN256_C_IMPLEMENTATION
+#define ASM_IMPLEMENTATION 1
+#endif
 void
 bn256_mul (bn512 *X, const bn256 *A, const bn256 *B)
 {
+#if ASM_IMPLEMENTATION
+#include "muladd_256.h"
+  const uint32_t *s;
+  uint32_t *d;
+  uint32_t w;
+  uint32_t c;
+
+  memset (X->word, 0, sizeof (uint32_t)*BN256_WORDS*2);
+
+  s = A->word;  d = &X->word[0];  w = B->word[0];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &X->word[1];  w = B->word[1];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &X->word[2];  w = B->word[2];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &X->word[3];  w = B->word[3];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &X->word[4];  w = B->word[4];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &X->word[5];  w = B->word[5];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &X->word[6];  w = B->word[6];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &X->word[7];  w = B->word[7];  MULADD_256 (s, d, w, c);
+#else
  int i, j, k;
  int i_beg, i_end;
  uint32_t r0, r1, r2;
@@ -167,7 +188,7 @@ bn256_mul (bn512 *X, const bn256 *A, const bn256 *B)

 	  j = k - i;

-	  uv = ((uint64_t )A->words[i])*((uint64_t )B->words[j]);
+	  uv = ((uint64_t )A->word[i])*((uint64_t )B->word[j]);
 	  v = uv;
 	  u = (uv >> 32);
 	  r0 += v;
@@ -179,18 +200,96 @@ bn256_mul (bn512 *X, const bn256 *A, const bn256 *B)
 	  r2 += carry;
 	}

-      X->words[k] = r0;
+      X->word[k] = r0;
      r0 = r1;
      r1 = r2;
      r2 = 0;
    }

-  X->words[k] = r0;
+  X->word[k] = r0;
+#endif
 }

 void
 bn256_sqr (bn512 *X, const bn256 *A)
 {
+#if ASM_IMPLEMENTATION
+  int i;
+
+  memset (X->word, 0, sizeof (bn512));
+  for (i = 0; i < BN256_WORDS; i++)
+    {
+      uint32_t *wij = &X->word[i*2];
+      const uint32_t *xj = &A->word[i];
+      uint32_t x_i = *xj++;
+      uint32_t c;
+
+      asm (/* (C,R4,R5) := w_i_i + x_i*x_i; w_i_i := R5; */
+           "mov    %[c], #0\n\t"
+           "ldr    r5, [%[wij]]\n\t"          /* R5 := w_i_i; */
+           "mov    r4, %[c]\n\t"
+           "umlal  r5, r4, %[x_i], %[x_i]\n\t"
+           "str    r5, [%[wij]], #4\n\t"
+           "cmp    %[xj], %[x_max1]\n\t"
+           "bhi    0f\n\t"
+           "mov    r9, %[c]\n\t"  /* R9 := 0, the constant ZERO from here.  */
+           "beq    1f\n"
+   "2:\n\t"
+           "ldmia  %[xj]!, { r7, r8 }\n\t"
+           "ldmia  %[wij], { r5, r6 }\n\t"
+           /* (C,R4,R5) := (C,R4) + w_i_j + 2*x_i*x_j; */
+           "umull  r7, r12, %[x_i], r7\n\t"
+           "adds   r5, r5, r4\n\t"
+           "adc    r4, %[c], r9\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], r9, r9\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], %[c], r9\n\t"
+           /* (C,R4,R6) := (C,R4) + w_i_j + 2*x_i*x_j; */
+           "adds   r6, r6, r4\n\t"
+           "adc    r4, %[c], r9\n\t"
+           "umull  r7, r12, %[x_i], r8\n\t"
+           "adds   r6, r6, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], r9, r9\n\t"
+           "adds   r6, r6, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], %[c], r9\n\t"
+           /**/
+           "stmia  %[wij]!, { r5, r6 }\n\t"
+           "cmp    %[xj], %[x_max1]\n\t"
+           "bcc    2b\n\t"
+           "bne    0f\n"
+   "1:\n\t"
+           /* (C,R4,R5) := (C,R4) + w_i_j + 2*x_i*x_j; */
+           "ldr    r5, [%[wij]]\n\t"
+           "ldr    r6, [%[xj]], #4\n\t"
+           "adds   r5, r5, r4\n\t"
+           "adc    r4, %[c], r9\n\t"
+           "umull  r7, r12, %[x_i], r6\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], r9, r9\n\t"
+           "adds   r5, r5, r7\n\t"
+           "adcs   r4, r4, r12\n\t"
+           "adc    %[c], %[c], r9\n\t"
+           "str    r5, [%[wij]], #4\n"
+   "0:\n\t"
+           "ldr    r5, [%[wij]]\n\t"
+           "adds   r4, r4, r5\n\t"
+           "adc    %[c], %[c], #0\n\t"
+           "str    r4, [%[wij]], #4"
+           : [c] "=&r" (c), [wij] "=r" (wij), [xj] "=r" (xj)
+           : [x_i] "r" (x_i), [x_max1] "r" (&A->word[BN256_WORDS-1]),
+             "[wij]" (wij), "[xj]" (xj)
+           : "r4", "r5", "r6", "r7", "r8", "r9", "r12", "memory", "cc");
+
+      if (i < BN256_WORDS - 1)
+	*wij = c;
+    }
+#else
  int i, j, k;
  int i_beg, i_end;
  uint32_t r0, r1, r2;
@@ -217,11 +316,10 @@ bn256_sqr (bn512 *X, const bn256 *A)

 	  j = k - i;

-	  uv = ((uint64_t )A->words[i])*((uint64_t )A->words[j]);
+	  uv = ((uint64_t )A->word[i])*((uint64_t )A->word[j]);
 	  if (i < j)
 	    {
-	      if ((uv >> 63) != 0)
-		r2++;
+	      r2 += ((uv >> 63) != 0);
 	      uv <<= 1;
 	    }
 	  v = uv;
@@ -235,13 +333,14 @@ bn256_sqr (bn512 *X, const bn256 *A)
 	  r2 += carry;
 	}

-      X->words[k] = r0;
+      X->word[k] = r0;
      r0 = r1;
      r1 = r2;
      r2 = 0;
    }

-  X->words[k] = r0;
+  X->word[k] = r0;
+#endif
 }

 uint32_t
@@ -254,8 +353,8 @@ bn256_shift (bn256 *X, const bn256 *A, int shift)
    {
      for (i = 0; i < BN256_WORDS; i++)
 	{
-	  next_carry = A->words[i] >> (32 - shift);
-	  X->words[i] = (A->words[i] << shift) | carry;
+	  next_carry = A->word[i] >> (32 - shift);
+	  X->word[i] = (A->word[i] << shift) | carry;
 	  carry = next_carry;
 	}
    }
@@ -265,8 +364,8 @@ bn256_shift (bn256 *X, const bn256 *A, int shift)

      for (i = BN256_WORDS - 1; i >= 0; i--)
 	{
-	  next_carry = A->words[i] & ((1 << shift) - 1);
-	  X->words[i] = (A->words[i] >> shift) | (carry << (32 - shift));
+	  next_carry = A->word[i] & ((1 << shift) - 1);
+	  X->word[i] = (A->word[i] >> shift) | (carry << (32 - shift));
 	  carry = next_carry;
 	}
    }
@@ -278,63 +377,59 @@ int
 bn256_is_zero (const bn256 *X)
 {
  int i;
+  int r = 1;

  for (i = 0; i < BN256_WORDS; i++)
-    if (X->words[i] != 0)
-      return 0;
+    r &=  (X->word[i] == 0);

-  return 1;
+  return r;
 }

 int
 bn256_is_even (const bn256 *X)
 {
-  return !(X->words[0] & 1);
+  return !(X->word[0] & 1);
 }

 int
 bn256_is_ge (const bn256 *A, const bn256 *B)
 {
-  int i;
+  uint32_t borrow;
+  bn256 tmp[1];

-  for (i = BN256_WORDS - 1; i >= 0; i--)
-    if (A->words[i] > B->words[i])
-      return 1;
-    else if (A->words[i] < B->words[i])
-      return 0;
-
-  return 1;
+  borrow = bn256_sub (tmp, A, B);
+  return borrow == 0;
 }


 int
 bn256_cmp (const bn256 *A, const bn256 *B)
 {
-  int i;
+  uint32_t borrow;
+  int is_zero;
+  bn256 tmp[1];

-  for (i = BN256_WORDS - 1; i >= 0; i--)
-    if (A->words[i] > B->words[i])
-      return 1;
-    else if (A->words[i] < B->words[i])
-      return -1;
-
-  return 0;
+  borrow = bn256_sub (tmp, A, B);
+  is_zero = bn256_is_zero (tmp);
+  return is_zero ? 0 : (borrow ? -1 : 1);
 }


+#ifndef BN256_NO_RANDOM
 void
 bn256_random (bn256 *X)
 {
  const uint8_t *rand = random_bytes_get ();

-  X->words[7] = ((uint32_t *)rand)[7];
-  X->words[6] = ((uint32_t *)rand)[6];
-  X->words[5] = ((uint32_t *)rand)[5];
-  X->words[4] = ((uint32_t *)rand)[4];
-  X->words[3] = ((uint32_t *)rand)[3];
-  X->words[2] = ((uint32_t *)rand)[2];
-  X->words[1] = ((uint32_t *)rand)[1];
-  X->words[0] = ((uint32_t *)rand)[0];
+  X->word[7] = ((uint32_t *)rand)[7];
+  X->word[6] = ((uint32_t *)rand)[6];
+  X->word[5] = ((uint32_t *)rand)[5];
+  X->word[4] = ((uint32_t *)rand)[4];
+  X->word[3] = ((uint32_t *)rand)[3];
+  X->word[2] = ((uint32_t *)rand)[2];
+  X->word[1] = ((uint32_t *)rand)[1];
+  X->word[0] = ((uint32_t *)rand)[0];

  random_bytes_free (rand);
 }
+#endif
--- a/src/bn.h
+++ b/src/bn.h
@@ -1,11 +1,11 @@
 #define BN256_WORDS 8
 typedef struct bn256 {
-  uint32_t words[ BN256_WORDS ]; /* Little endian */
+  uint32_t word[ BN256_WORDS ]; /* Little endian */
 } bn256;

 #define BN512_WORDS 16
 typedef struct bn512 {
-  uint32_t words[ BN512_WORDS ]; /* Little endian */
+  uint32_t word[ BN512_WORDS ]; /* Little endian */
 } bn512;

 uint32_t bn256_add (bn256 *X, const bn256 *A, const bn256 *B);
--- a/src/call-ec_p256.c
+++ b/src/call-ec_p256.c
@@ -1,5 +1,5 @@
 /*
- * call-ec_p256.c - interface between Gnuk and Elliptic curve over GF(p256)
+ * call-ec.c - interface between Gnuk and Elliptic curve over GF(prime)
 *
 * Copyright (C) 2013 Free Software Initiative of Japan
 * Author: NIIBE Yutaka <gniibe@fsij.org>
@@ -21,24 +21,15 @@
 *
 */

-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-#include "bn.h"
-#include "jpc-ac.h"
-#include "ec_p256.h"
-
-#include "config.h"
-
-#include "gnuk.h"
+#include "field-group-select.h"

 /* We are little endian.  */

 #define ECDSA_BYTE_SIZE 32

 int
-ecdsa_sign (const uint8_t *hash, uint8_t *output,
-	    const struct key_data *kd)
+FUNC(ecdsa_sign) (const uint8_t *hash, uint8_t *output,
+		  const uint8_t *key_data)
 {
  int i;
  bn256 r[1], s[1], z[1], d[1];
@@ -46,13 +37,13 @@ ecdsa_sign (const uint8_t *hash, uint8_t *output,

  p = (uint8_t *)d;
  for (i = 0; i < ECDSA_BYTE_SIZE; i++)
-    p[ECDSA_BYTE_SIZE - i - 1] = kd->data[i];
+    p[ECDSA_BYTE_SIZE - i - 1] = key_data[i];

  p = (uint8_t *)z;
  for (i = 0; i < ECDSA_BYTE_SIZE; i++)
    p[ECDSA_BYTE_SIZE - i - 1] = hash[i];

-  ecdsa (r, s, z, d);
+  FUNC(ecdsa) (r, s, z, d);
  p = (uint8_t *)r;
  for (i = 0; i < ECDSA_BYTE_SIZE; i++)
    *output++ = p[ECDSA_BYTE_SIZE - i - 1];
@@ -63,7 +54,7 @@ ecdsa_sign (const uint8_t *hash, uint8_t *output,
 }

 uint8_t *
-ecdsa_compute_public (const uint8_t *key_data)
+FUNC(ecdsa_compute_public) (const uint8_t *key_data)
 {
  uint8_t *p0, *p, *p1;
  ac q[1];
@@ -77,7 +68,7 @@ ecdsa_compute_public (const uint8_t *key_data)
  p = (uint8_t *)k;
  for (i = 0; i < ECDSA_BYTE_SIZE; i++)
    p[ECDSA_BYTE_SIZE - i - 1] = key_data[i];
-  if (compute_kG (q, k) < 0)
+  if (FUNC(compute_kG) (q, k) < 0)
    {
      free (p0);
      return NULL;
--- a/src/call-ec_p256k1.c
+++ b/src/call-ec_p256k1.c
@@ -0,0 +1,34 @@
+/*
+ * call-ec_p256k1.c - interface between Gnuk and Elliptic curve over
+ *                    GF(p256k1)
+ *
+ * Copyright (C) 2014 Free Software Initiative of Japan
+ * Author: NIIBE Yutaka <gniibe@fsij.org>
+ *
+ * This file is a part of Gnuk, a GnuPG USB Token implementation.
+ *
+ * Gnuk is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Gnuk is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include "bn.h"
+#include "jpc-ac_p256k1.h"
+#include "ec_p256k1.h"
+
+#define FIELD p256k1
+
+#include "call-ec.c"
--- a/src/call-ec_p256r1.c
+++ b/src/call-ec_p256r1.c
@@ -0,0 +1,34 @@
+/*
+ * call-ec_p256r1.c - interface between Gnuk and Elliptic curve over
+ *                    GF(p256r1)
+ *
+ * Copyright (C) 2014 Free Software Initiative of Japan
+ * Author: NIIBE Yutaka <gniibe@fsij.org>
+ *
+ * This file is a part of Gnuk, a GnuPG USB Token implementation.
+ *
+ * Gnuk is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Gnuk is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include "bn.h"
+#include "jpc-ac_p256r1.h"
+#include "ec_p256r1.h"
+
+#define FIELD p256r1
+
+#include "call-ec.c"
--- a/src/configure
+++ b/src/configure
@@ -321,6 +321,8 @@ if test "$certdo" = "yes"; then
      -e "s/@MEMORY_SIZE@/$MEMORY_SIZE/" \
      -e "s/@FLASH_PAGE_SIZE@/$FLASH_PAGE_SIZE/" \
      -e "s/@MSC_SIZE@/$MSC_SIZE/" \
+      -e "s/@TIM_SIZE@/$TIM_SIZE/" \
+      -e "s/@EXT_SIZE@/$EXT_SIZE/" \
 	< gnuk.ld.in > gnuk.ld
 else
  sed -e "/^@CERTDO_SUPPORT_START@$/,/^@CERTDO_SUPPORT_END@$/ d" \
--- a/src/ec_p256.h
+++ b/src/ec_p256.h
@@ -1,12 +0,0 @@
-/* Non-adjacent form */
-typedef struct naf4_257 {
-  uint32_t words[ BN256_WORDS*4 ]; /* Little endian */
-  uint8_t last_nibble;		   /* most significant nibble */
-} naf4_257;
-
-void compute_naf4_257 (naf4_257 *NAF_K, const bn256 *K);
-int compute_kP (ac *X, const naf4_257 *NAF_K, const ac *P);
-
-int compute_kG (ac *X, const bn256 *K);
-void ecdsa (bn256 *r, bn256 *s, const bn256 *z, const bn256 *d);
-
--- a/src/ec_p256k1.c
+++ b/src/ec_p256k1.c
@@ -0,0 +1,224 @@
+/*                                                    -*- coding: utf-8 -*-
+ * ec_p256k1.c - Elliptic curve over GF(p256k1)
+ *
+ * Copyright (C) 2014 Free Software Initiative of Japan
+ * Author: NIIBE Yutaka <gniibe@fsij.org>
+ *
+ * This file is a part of Gnuk, a GnuPG USB Token implementation.
+ *
+ * Gnuk is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Gnuk is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include "bn.h"
+#include "modp256k1.h"
+#include "jpc-ac_p256k1.h"
+#include "mod.h"
+#include "ec_p256k1.h"
+
+#define FIELD p256k1
+#define COEFFICIENT_A_IS_ZERO    1
+
+/*
+ * a = 0, b = 7
+ */
+static const bn256 coefficient_a[1] = {
+  {{ 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }}
+};
+
+static const bn256 coefficient_b[1] = {
+  {{ 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 }}
+};
+
+
+static const ac precomputed_KG[15] = {
+  {
+    {{{ 0x16f81798, 0x59f2815b, 0x2dce28d9, 0x029bfcdb,
+	0xce870b07, 0x55a06295, 0xf9dcbbac, 0x79be667e }}},
+    {{{ 0xfb10d4b8, 0x9c47d08f, 0xa6855419, 0xfd17b448,
+	0x0e1108a8, 0x5da4fbfc, 0x26a3c465, 0x483ada77 }}}
+  }, {
+    {{{ 0x42d0e6bd, 0x13b7e0e7, 0xdb0f5e53, 0xf774d163,
+	0x104d6ecb, 0x82a2147c, 0x243c4e25, 0x3322d401 }}},
+    {{{ 0x6c28b2a0, 0x24f3a2e9, 0xa2873af6, 0x2805f63e,
+	0x4ddaf9b7, 0xbfb019bc, 0xe9664ef5, 0x56e70797 }}}
+  }, {
+    {{{ 0x829d122a, 0xdca81127, 0x67e99549, 0x8f17f314,
+	0x6a8a9e73, 0x9b889085, 0x846dd99d, 0x583fdfd9 }}},
+    {{{ 0x63c4eac4, 0xf3c7719e, 0xb734b37a, 0xb44685a3,
+	0x572a47a6, 0x9f92d2d6, 0x2ff57d81, 0xabc6232f }}}
+  }, {
+    {{{ 0x9ec4c0da, 0x1b7b444c, 0x723ea335, 0xe88c5678,
+	0x981f162e, 0x9239c1ad, 0xf63b5f33, 0x8f68b9d2 }}},
+    {{{ 0x501fff82, 0xf23cbf79, 0x95510bfd, 0xbbea2cfe,
+	0xb6be215d, 0xde1d90c2, 0xba063986, 0x662a9f2d }}}
+  }, {
+    {{{ 0x114cbf09, 0x63c5e885, 0x7be77e3e, 0x2f27ce93,
+	0xf54a3e33, 0xdaa6d12d, 0x3eff872c, 0x8b300e51 }}},
+    {{{ 0xb3b10a39, 0x26c6ff28, 0x9aaf7169, 0x08f6a7aa,
+	0x6b8238ea, 0x446f0d46, 0x7f43c0cc, 0x1cec3067 }}}
+  }, {
+    {{{ 0x075e9070, 0xba16ce6a, 0x9b5cfe37, 0xbc26893d,
+	0x9c510774, 0xe1ddadfe, 0xfe3ae2f4, 0x90922d88 }}},
+    {{{ 0x5c08824a, 0x653943cc, 0xfce8f4bc, 0x06d74475,
+	0x533c615d, 0x8d101fa7, 0x742108a9, 0x7b1903f6 }}}
+  }, {
+    {{{ 0x6ebdc96c, 0x1bcfa45c, 0x1c7584ba, 0xe400bc04,
+	0x74cf531f, 0x6395e20e, 0xc5131b30, 0x1edd0bb1 }}},
+    {{{ 0xe358cf9e, 0xa117161b, 0x2724d11c, 0xe490d6f0,
+	0xee6dd8c9, 0xf75062f6, 0xfba373e4, 0x31e03b2b }}}
+  }, {
+    {{{ 0x2120e2b3, 0x7f3b58fa, 0x7f47f9aa, 0x7a58fdce,
+	0x4ce6e521, 0xe7be4ae3, 0x1f51bdba, 0xeaa649f2 }}},
+    {{{ 0xba5ad93d, 0xd47a5305, 0xf13f7e59, 0x01a6b965,
+	0x9879aa5a, 0xc69a80f8, 0x5bbbb03a, 0xbe3279ed }}}
+  }, {
+    {{{ 0x27bb4d71, 0xcf291a33, 0x33524832, 0x6caf7d6b,
+	0x766584ee, 0x6e0ee131, 0xd064c589, 0x160cb0f6 }}},
+    {{{ 0x17136e8d, 0x9d5de554, 0x1aab720e, 0xe3f2d468,
+	0xccf75cc2, 0xd1378b49, 0xc4ff16e1, 0x6920c375 }}}
+  }, {
+    {{{ 0x1a9ee611, 0x3eef9e96, 0x9cc37faf, 0xfe4d7bf3,
+	0xb321d965, 0x462aa9b3, 0x208736c5, 0x1702da3e }}},
+    {{{ 0x3a545ceb, 0xfba57bbf, 0x7ea858f5, 0x6dbcd766,
+	0x680d92f1, 0x088e897c, 0xbc626c80, 0x468c1fd8 }}}
+  }, {
+    {{{ 0xb188660a, 0xb40f85c7, 0x99bc3c36, 0xc5873c19,
+	0x7f33b54c, 0x3c7b4541, 0x1f8c9bf8, 0x4cd3a93c }}},
+    {{{ 0x33099cb0, 0xf8dce380, 0x2edd2f33, 0x7a167dd6,
+	0x0ffe35b7, 0x576d8987, 0xc68ace5c, 0xd2de0386 }}}
+  }, {
+    {{{ 0x6658bb08, 0x9a9e0a72, 0xc589607b, 0xe23c5f2a,
+	0xf2bfb4c8, 0xa048ca14, 0xc62c2291, 0x4d9a0f89 }}},
+    {{{ 0x0f827294, 0x427b5f31, 0x9f2c35cd, 0x1ea7a8b5,
+	0x85a3c00f, 0x95442e56, 0x9b57975a, 0x8cb83121 }}}
+  }, {
+    {{{ 0x51f5cf67, 0x4333f0da, 0xf4f0d3cb, 0x6d3ea47c,
+	0xa05a831f, 0x442fda14, 0x016d3e81, 0x6a496013 }}},
+    {{{ 0xe52e0f48, 0xf647318c, 0x4a0d5ff1, 0x5ff3a66e,
+	0x61199ba8, 0x046ed81a, 0x3e79c23a, 0x578edf08 }}}
+  }, {
+    {{{ 0x3ea01ea7, 0xb8f996f8, 0x7497bb15, 0xc0045d33,
+	0x6205647c, 0xc4749dc9, 0x0efd22c9, 0xd8946054 }}},
+    {{{ 0x12774ad5, 0x062dcb09, 0x8be06e3a, 0xcb13f310,
+	0x235de1a9, 0xca281d35, 0x69c3645c, 0xaf8a7412 }}}
+  }, {
+    {{{ 0xbeb8b1e2, 0x8808ca5f, 0xea0dda76, 0x0262b204,
+	0xddeb356b, 0xb6fffffc, 0xfbb83870, 0x52de253a }}},
+    {{{ 0x8f8d21ea, 0x961f40c0, 0x002f03ed, 0x89686278,
+	0x38e421ea, 0x0ff834d7, 0xd36fb8db, 0x3a270d6f }}}
+  }
+};
+
+static const ac precomputed_2E_KG[15] = {
+  {
+    {{{ 0x39a48db0, 0xefd7835b, 0x9b3c03bf, 0x9f1215a2,
+	0x9b7bde45, 0x2791d0a0, 0x696e7167, 0x100f44da }}},
+    {{{ 0x2bc65a09, 0x0fbd5cd6, 0xff5195ac, 0xb7ff4a18,
+	0x0c090666, 0x2ec8f330, 0x92a00b77, 0xcdd9e131 }}}
+  }, {
+    {{{ 0x40fb27b6, 0x32427e28, 0xbe430576, 0xc76e3db2,
+	0x61686aa5, 0x10f238ad, 0xbe778b1b, 0xfea74e3d }}},
+    {{{ 0xf23cb96f, 0x701d3db7, 0x973f7b77, 0x126b596b,
+	0xccb6af93, 0x7cf674de, 0x9b0b1329, 0x6e0568db }}}
+  }, {
+    {{{ 0x2c8118bc, 0x6cac5154, 0x399ddd98, 0x19bd4b34,
+	0x2e9c8949, 0x47248a8d, 0x2cefa3b1, 0x734cb6a8 }}},
+    {{{ 0x1e410fd5, 0xf1b340ad, 0xc4873539, 0xa2982bee,
+	0xd4de4530, 0x7b5a3ea4, 0x42202574, 0xae46e10e }}}
+  }, {
+    {{{ 0xac1f98cd, 0xcbfc99c8, 0x4d7f0308, 0x52348905,
+	0x1cc66021, 0xfaed8a9c, 0x4a474870, 0x9c3919a8 }}},
+    {{{ 0xd4fc599d, 0xbe7e5e03, 0x6c64c8e6, 0x905326f7,
+	0xf260e641, 0x584f044b, 0x4a4ddd57, 0xddb84f0f }}}
+  }, {
+    {{{ 0xed7cebed, 0xc4aacaa8, 0x4fae424e, 0xb75d2dce,
+	0xba20735e, 0xa01585a2, 0xba122399, 0x3d75f24b }}},
+    {{{ 0xd5570dce, 0xcbe4606f, 0x2da192c2, 0x9d00bfd7,
+	0xa57b7265, 0x9c3ce86b, 0xec4edf5e, 0x987a22f1 }}}
+  }, {
+    {{{ 0x73ea0665, 0x211b9715, 0xf3a1abbb, 0x86f485d4,
+	0xcd076f0e, 0xabd242d8, 0x0ba5dc88, 0x862332ab }}},
+    {{{ 0x7b784911, 0x09af505c, 0xcaf4fae7, 0xc89544e8,
+	0xae9a32eb, 0x256625f6, 0x606d1a3f, 0xe2532b72 }}}
+  }, {
+    {{{ 0x0deaf885, 0x79e9f313, 0x46df21c9, 0x938ff76e,
+	0xa953bb2c, 0x1968f5fb, 0x29155f27, 0xdff538bf }}},
+    {{{ 0x31d5d020, 0xf7bae0b1, 0x1a676a8d, 0x5afdc787,
+	0xfa9d53ff, 0x11b4f032, 0xc5959167, 0x86ba433e }}}
+  }, {
+    {{{ 0x9475b7ba, 0x884fdff0, 0xe4918b3d, 0xe039e730,
+	0xf5018cdb, 0x3d3e57ed, 0x1943785c, 0x95939698 }}},
+    {{{ 0x7524f2fd, 0xe9b8abf8, 0xc8709385, 0x9c653f64,
+	0x4b9cd684, 0x8ba0386a, 0x88c331dd, 0x2e7e5528 }}}
+  }, {
+    {{{ 0xeefe79e5, 0x940bef53, 0xbe9b87f3, 0xc518d286,
+	0x7833042c, 0x9e0c7c76, 0x11fbe152, 0x104e2cb5 }}},
+    {{{ 0x50bbec83, 0xc0d35e0f, 0x4acd0fcc, 0xee4879be,
+	0x006085ee, 0xc8d80f5d, 0x72fe1ac1, 0x3c51bc1c }}}
+  }, {
+    {{{ 0xb2de976e, 0x06187f61, 0xf5e4b4b6, 0x52869e18,
+	0x38d332ca, 0x74d4facd, 0xb3a2f8d9, 0x5c1c90b4 }}},
+    {{{ 0xdaa37893, 0x98644d09, 0xabe39818, 0x682435a8,
+	0x469c53a0, 0x17e46617, 0x77dc2e64, 0x642f9632 }}}
+  }, {
+    {{{ 0x222f6c54, 0xad2101c5, 0xfa74785e, 0xb05c7a58,
+	0x489bcdaf, 0xce55fa79, 0xffe88d54, 0xc1f920fd }}},
+    {{{ 0x9065e490, 0x32553ab0, 0x35329f74, 0x7611b9af,
+	0xab7b24c0, 0x57df19ef, 0x6181c447, 0xb9a78749 }}}
+  }, {
+    {{{ 0xa80b7ea8, 0x392f156f, 0x8ae4a8bf, 0x57ab7ca0,
+	0x50c4b178, 0xac320747, 0x0e781feb, 0x146041b9 }}},
+    {{{ 0x845279b2, 0xd343f075, 0x7387afa5, 0x2d4fe757,
+	0xa72f3c39, 0x151e0948, 0x550da168, 0x41a6d54e }}}
+  }, {
+    {{{ 0x075a0010, 0xb3134ed3, 0x7ae93e23, 0x9fa76f4b,
+	0x7bb4daaa, 0xc0db256f, 0x464dd8a3, 0x7668dc27 }}},
+    {{{ 0x9f5da977, 0x150063f5, 0x05efce00, 0x3acac5c8,
+	0x884493fe, 0xc8e12ffc, 0x88f06bd2, 0x4ab936d8 }}}
+  }, {
+    {{{ 0x5d09ea98, 0x996fde77, 0x4145da58, 0x16ddf512,
+	0xdc2fb225, 0xa97a6ca8, 0xfbdcdf5a, 0xc7331f30 }}},
+    {{{ 0x86a86e52, 0x838f99e0, 0x77795edd, 0x68d39b29,
+	0x9f412aaa, 0xe4e4f97e, 0x30d25352, 0xe5cc2c0a }}}
+  }, {
+    {{{ 0x9c21ff71, 0xb3d68650, 0xddbe3884, 0x11e7589d,
+	0x423bac67, 0x7efd4055, 0x46957425, 0x587a7293 }}},
+    {{{ 0x8f5a8fc6, 0x360adc2e, 0xbd69f12e, 0x6f8bbafb,
+	0x0a3f3b4d, 0xf671f423, 0x59942dc3, 0xb49acb47 }}}
+  }
+};
+
+/*
+ * N: order of G
+ *    0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
+ */
+static const bn256 N[1] = {
+  {{ 0xd0364141, 0xbfd25e8c, 0xaf48a03b, 0xbaaedce6,
+     0xfffffffe, 0xffffffff, 0xffffffff, 0xffffffff }}
+};
+
+/*
+ * MU = 2^512 / N
+ * MU = ( (1 << 256) | MU_lower )
+ */
+static const bn256 MU_lower[1] = {
+  {{ 0x2fc9bec0, 0x402da173, 0x50b75fc4, 0x45512319,
+     0x1, 0x0, 0x0, 0x0 }}
+};
+
+
+#include "ecc.c"
--- a/src/ec_p256k1.h
+++ b/src/ec_p256k1.h
@@ -0,0 +1,4 @@
+int compute_kP_p256k1 (ac *X, const bn256 *K, const ac *P);
+
+int compute_kG_p256k1 (ac *X, const bn256 *K);
+void ecdsa_p256k1 (bn256 *r, bn256 *s, const bn256 *z, const bn256 *d);
--- a/src/ec_p256r1.c
+++ b/src/ec_p256r1.c
@@ -1,7 +1,7 @@
-/*
- * ec_p256.c - Elliptic curve over GF(p256)
+/*                                                    -*- coding: utf-8 -*-
+ * ec_p256r1.c - Elliptic curve over GF(p256r1)
 *
- * Copyright (C) 2011, 2013 Free Software Initiative of Japan
+ * Copyright (C) 2014 Free Software Initiative of Japan
 * Author: NIIBE Yutaka <gniibe@fsij.org>
 *
 * This file is a part of Gnuk, a GnuPG USB Token implementation.
@@ -21,45 +21,19 @@
 *
 */

-/*
- * References:
- *
- * [1] Suite B Implementer's Guide to FIPS 186-3 (ECDSA), February 3, 2010.
- *
- * [2] Michael Brown, Darrel Hankerson, Julio López, and Alfred Menezes,
- *     Software Implementation of the NIST Elliptic Curves Over Prime Fields,
- *     Proceedings of the 2001 Conference on Topics in Cryptology: The
- *     Cryptographer's Track at RSA
- *     Pages 250-265, Springer-Verlag London, UK, 2001
- *     ISBN:3-540-41898-9
- */
-
 #include <stdint.h>
 #include <string.h>
 #include "bn.h"
-#include "modp256.h"
-#include "jpc-ac.h"
+#include "modp256r1.h"
+#include "jpc-ac_p256r1.h"
 #include "mod.h"
-#include "ec_p256.h"
-
-#if TEST
-/*
- * Generator of Elliptic curve over GF(p256)
- */
-const bn256 Gx[1] = {
-  {{  0xd898c296, 0xf4a13945, 0x2deb33a0, 0x77037d81,
-      0x63a440f2, 0xf8bce6e5, 0xe12c4247, 0x6b17d1f2  }}
-};
-
-const bn256 Gy[1] = {
-  {{  0x37bf51f5, 0xcbb64068, 0x6b315ece, 0x2bce3357,
-      0x7c0f9e16, 0x8ee7eb4a, 0xfe1a7f9b, 0x4fe342e2  }}
-};
-#endif
+#include "ec_p256r1.h"

+#define FIELD p256r1
+#define COEFFICIENT_A_IS_MINUS_3 1

 /*
- * a = -3 mod p256
+ * a = -3 mod p256r1
 */
 static const bn256 coefficient_a[1] = {
  {{  0xfffffffc, 0xffffffff, 0xffffffff, 0x00000000,
@@ -72,13 +46,6 @@ static const bn256 coefficient_b[1] = {
 };


-/*
- * w = 4
- * m = 256
- * d = 64
- * e = 32
- */
-
 static const ac precomputed_KG[15] = {
  {
    {{{ 0xd898c296, 0xf4a13945, 0x2deb33a0, 0x77037d81,
@@ -237,271 +204,6 @@ static const ac precomputed_2E_KG[15] = {
  }
 };

-/**
- * @brief	X  = k * G
- *
- * @param K	scalar k
- *
- * Return -1 on error.
- * Return 0 on success.
- */
-int
-compute_kG (ac *X, const bn256 *K)
-{
-  int i;
-  int q_is_infinite = 1;
-  jpc Q[1];
-
-  for (i = 31; i >= 0; i--)
-    {
-      int k_i, k_i_e;
-
-      if (!q_is_infinite)
-	jpc_double (Q, Q);
-
-      k_i = (((K->words[6] >> i) & 1) << 3)
-	| (((K->words[4] >> i) & 1) << 2)
-	| (((K->words[2] >> i) & 1) << 1)
-	| ((K->words[0] >> i) & 1);
-      k_i_e = (((K->words[7] >> i) & 1) << 3)
-	| (((K->words[5] >> i) & 1) << 2)
-	| (((K->words[3] >> i) & 1) << 1)
-	| ((K->words[1] >> i) & 1);
-
-      if (k_i)
-	{
-	  if (q_is_infinite)
-	    {
-	      memcpy (Q->x, (&precomputed_KG[k_i - 1])->x, sizeof (bn256));
-	      memcpy (Q->y, (&precomputed_KG[k_i - 1])->y, sizeof (bn256));
-	      Q->z->words[0] = 1;
-	      Q->z->words[1] = Q->z->words[2] = Q->z->words[3]
-		= Q->z->words[4] = Q->z->words[5] = Q->z->words[6]
-		= Q->z->words[7] = 0;
-	      q_is_infinite = 0;
-	    }
-	  else
-	    jpc_add_ac (Q, Q, &precomputed_KG[k_i - 1]);
-	}
-      if (k_i_e)
-	{
-	  if (q_is_infinite)
-	    {
-	      memcpy (Q->x, (&precomputed_2E_KG[k_i_e - 1])->x, sizeof (bn256));
-	      memcpy (Q->y, (&precomputed_2E_KG[k_i_e - 1])->y, sizeof (bn256));
-	      memset (Q->z, 0, sizeof (bn256));
-	      Q->z->words[0] = 1;
-	      q_is_infinite = 0;
-	    }
-	  else
-	    jpc_add_ac (Q, Q, &precomputed_2E_KG[k_i_e - 1]);
-	}
-    }
-
-  return jpc_to_ac (X, Q);
-}
-
-
-#define NAF_K_SIGN(k)	(k&8)
-#define NAF_K_INDEX(k)	((k&7)-1)
-
-static void
-naf4_257_set (naf4_257 *NAF_K, int i, int ki)
-{
-  if (ki != 0)
-    {
-      if (ki > 0)
-	ki = (ki+1)/2;
-      else
-	ki = (1-ki)/2 | 8;
-    }
-
-  if (i == 256)
-    NAF_K->last_nibble = ki;
-  else
-    {
-      NAF_K->words[i/8] &= ~(0x0f << ((i & 0x07)*4));
-      NAF_K->words[i/8] |= (ki << ((i & 0x07)*4));
-    }
-}
-
-static int
-naf4_257_get (const naf4_257 *NAF_K, int i)
-{
-  int ki;
-
-  if (i == 256)
-    ki = NAF_K->last_nibble;
-  else
-    {
-      ki = NAF_K->words[i/8] >> ((i & 0x07)*4);
-      ki &= 0x0f;
-    }
-
-  return ki;
-}
-
-
-/*
- * convert 256-bit bignum into non-adjacent form (NAF)
- */
-void
-compute_naf4_257 (naf4_257 *NAF_K, const bn256 *K)
-{
-  int i = 0;
-  bn256 K_tmp[1];
-  uint32_t carry = 0;
-
-  memcpy (K_tmp, K, sizeof (bn256));
-  memset (NAF_K, 0, sizeof (naf4_257));
-
-  while (!bn256_is_zero (K_tmp))
-    {
-      if (bn256_is_even (K_tmp))
-	naf4_257_set (NAF_K, i, 0);
-      else
-	{
-	  int ki = (K_tmp->words[0]) & 0x0f;
-
-	  if ((ki & 0x08))
-	    {
-	      carry = bn256_add_uint (K_tmp, K_tmp, 16 - ki);
-	      ki = ki - 16;
-	    }
-	  else
-	    K_tmp->words[0] &= 0xfffffff0;
-
-	  naf4_257_set (NAF_K, i, ki);
-	}
-
-      bn256_shift (K_tmp, K_tmp, -1);
-      if (carry)
-	{
-	  K_tmp->words[7] |= 0x80000000;
-	  carry = 0;
-	}
-      i++;
-    }
-}
-
-/**
- * check if P is on the curve.
- *
- * Return -1 on error.
- * Return 0 on success.
- */
-static int
-point_is_on_the_curve (const ac *P)
-{
-  bn256 s[1], t[1];
-
-  /* Elliptic curve: y^2 = x^3 + a*x + b */
-  modp256_sqr (s, P->x);
-  modp256_mul (s, s, P->x);
-
-  modp256_mul (t, coefficient_a, P->x);
-  modp256_add (s, s, t);
-  modp256_add (s, s, coefficient_b);
-
-  modp256_sqr (t, P->y);
-  if (bn256_cmp (s, t) == 0)
-    return 0;
-
-  return -1;
-}
-
-/**
- * @brief	X  = k * P
- *
- * @param NAF_K	NAF representation of k
- * @param P	P in affine coordiate
- *
- * Return -1 on error.
- * Return 0 on success.
- *
- * For the curve (cofactor is 1 and n is prime), possible error cases are:
- *
- *     P is not on the curve.
- *     P = G, k = n
- *     Something wrong in the code.
- *
- * Mathmatically, k=1 and P=O is another possible case, but O cannot be
- * represented by affine coordinate.
- */
-int
-compute_kP (ac *X, const naf4_257 *NAF_K, const ac *P)
-{
-  int i;
-  int q_is_infinite = 1;
-  jpc Q[1];
-  ac P3[1], P5[1], P7[1];
-  const ac *p_Pi[4];
-
-  if (point_is_on_the_curve (P) < 0)
-    return -1;
-
-  p_Pi[0] = P;
-  p_Pi[1] = P3;
-  p_Pi[2] = P5;
-  p_Pi[3] = P7;
-
-  {
-    jpc Q1[1];
-
-    memcpy (Q->x, P->x, sizeof (bn256));
-    memcpy (Q->y, P->y, sizeof (bn256));
-    memset (Q->z, 0, sizeof (bn256));
-    Q->z->words[0] = 1;
-
-    jpc_double (Q, Q);
-    jpc_add_ac (Q1, Q, P);
-    if (jpc_to_ac (P3, Q1) < 0)	/* Never occurs, except coding errors.  */
-      return -1;
-    jpc_double (Q, Q);
-    jpc_add_ac (Q1, Q, P);
-    if (jpc_to_ac (P5, Q1) < 0)	/* Never occurs, except coding errors.  */
-      return -1;
-
-    memcpy (Q->x, P3->x, sizeof (bn256));
-    memcpy (Q->y, P3->y, sizeof (bn256));
-    memset (Q->z, 0, sizeof (bn256));
-    Q->z->words[0] = 1;
-    jpc_double (Q, Q);
-    jpc_add_ac (Q1, Q, P);
-    if (jpc_to_ac (P7, Q1) < 0)	/* Never occurs, except coding errors.  */
-      return -1;
-  }
-
-  for (i = 256; i >= 0; i--)
-    {
-      int k_i;
-
-      if (!q_is_infinite)
-	jpc_double (Q, Q);
-
-      k_i = naf4_257_get (NAF_K, i);
-      if (k_i)
-	{
-	  if (q_is_infinite)
-	    {
-	      memcpy (Q->x, p_Pi[NAF_K_INDEX(k_i)]->x, sizeof (bn256));
-	      if (NAF_K_SIGN (k_i))
-		bn256_sub (Q->y, P256, p_Pi[NAF_K_INDEX(k_i)]->y);
-	      else
-		memcpy (Q->y, p_Pi[NAF_K_INDEX(k_i)]->y, sizeof (bn256));
-	      memset (Q->z, 0, sizeof (bn256));
-	      Q->z->words[0] = 1;
-	      q_is_infinite = 0;
-	    }
-	  else
-	    jpc_add_ac_signed (Q, Q, p_Pi[NAF_K_INDEX(k_i)], NAF_K_SIGN (k_i));
-	}
-    }
-
-  return jpc_to_ac (X, Q);
-}
-
-
 /*
 * N: order of G
 */
@@ -520,46 +222,4 @@ static const bn256 MU_lower[1] = {
 };


-/**
- * @brief Compute signature (r,s) of hash string z with secret key d
- */
-void
-ecdsa (bn256 *r, bn256 *s, const bn256 *z, const bn256 *d)
-{
-  bn256 k[1];
-  ac KG[1];
-  bn512 tmp[1];
-  bn256 k_inv[1];
-  uint32_t carry;
-
-#define tmp_k k_inv
-
-  do
-    {
-      do
-	{
-	  bn256_random (k);
-	  if (bn256_sub (tmp_k, k, N) == 0)	/* > N, it's too big.  */
-	    continue;
-	  if (bn256_add_uint (tmp_k, tmp_k, 2)) /* > N - 2, still big.  */
-	    continue;
-	  bn256_add_uint (k, k, 1);
-	  compute_kG (KG, k);
-	  if (bn256_is_ge (KG->x, N))
-	    bn256_sub (r, KG->x, N);
-	  else
-	    memcpy (r, KG->x, sizeof (bn256));
-	}
-      while (bn256_is_zero (r));
-
-      mod_inv (k_inv, k, N);
-      bn256_mul (tmp, r, d);
-      mod_reduce (s, tmp, N, MU_lower);
-      carry = bn256_add (s, s, z);
-      if (carry)
-	bn256_sub (s, s, N);
-      bn256_mul (tmp, s, k_inv);
-      mod_reduce (s, tmp, N, MU_lower);
-    }
-  while (bn256_is_zero (s));
-}
+#include "ecc.c"
--- a/src/ec_p256r1.h
+++ b/src/ec_p256r1.h
@@ -0,0 +1,5 @@
+int compute_kP_p256r1 (ac *X, const bn256 *K, const ac *P);
+
+int compute_kG_p256r1 (ac *X, const bn256 *K);
+void ecdsa_p256r1 (bn256 *r, bn256 *s, const bn256 *z, const bn256 *d);
+
--- a/src/ecc.c
+++ b/src/ecc.c
@@ -0,0 +1,368 @@
+/*                                                    -*- coding: utf-8 -*-
+ * ecc.c - Elliptic curve over GF(prime)
+ *
+ * Copyright (C) 2011, 2013, 2014 Free Software Initiative of Japan
+ * Author: NIIBE Yutaka <gniibe@fsij.org>
+ *
+ * This file is a part of Gnuk, a GnuPG USB Token implementation.
+ *
+ * Gnuk is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Gnuk is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/*
+ * References:
+ *
+ * [1] Suite B Implementer's Guide to FIPS 186-3 (ECDSA), February 3, 2010.
+ *
+ * [2] Michael Brown, Darrel Hankerson, Julio López, and Alfred Menezes,
+ *     Software Implementation of the NIST Elliptic Curves Over Prime Fields,
+ *     Proceedings of the 2001 Conference on Topics in Cryptology: The
+ *     Cryptographer's Track at RSA
+ *     Pages 250-265, Springer-Verlag London, UK, 2001
+ *     ISBN:3-540-41898-9
+ *
+ * [3] Mustapha Hedabou, Pierre Pinel, Lucien Bénéteau, 
+ *     A comb method to render ECC resistant against Side Channel Attacks,
+ *     2004
+ */
+
+#include "field-group-select.h"
+
+/*
+ * Coefficients
+ */
+/*
+ * static const bn256 *coefficient_a;
+ * static const bn256 *coefficient_b;
+ */
+/*
+ * N: order of G
+ */
+/*
+ * static const bn256 N[1];
+ */
+/*
+ * MU = 2^512 / N
+ * MU = ( (1 << 256) | MU_lower )
+ */
+/*
+ * static const bn256 MU_lower[1];
+ */
+
+/*
+ * w = 4
+ * m = 256
+ * d = 64
+ * e = 32
+ */
+
+/*
+ * static const ac precomputed_KG[15];
+ * static const ac precomputed_2E_KG[15];
+ */
+
+#if TEST
+/*
+ * Generator of Elliptic curve over GF(p256)
+ */
+const ac *G = &precomputed_KG[0];
+#endif
+
+
+static int
+get_vk (const bn256 *K, int i)
+{
+  uint32_t w0, w1, w2, w3;
+
+  if (i < 32)
+    {
+      w3 = K->word[6]; w2 = K->word[4]; w1 = K->word[2]; w0 = K->word[0];
+    }
+  else
+    {
+      w3 = K->word[7]; w2 = K->word[5]; w1 = K->word[3]; w0 = K->word[1];
+      i -= 32;
+    }
+
+  w3 >>= i;  w2 >>= i;  w1 >>= i;  w0 >>= i;
+  return ((w3 & 1) << 3) | ((w2 & 1) << 2) | ((w1 & 1) << 1) | (w0 & 1);
+}
+
+
+/**
+ * @brief	X  = k * G
+ *
+ * @param K	scalar k
+ *
+ * Return -1 on error.
+ * Return 0 on success.
+ */
+int
+FUNC(compute_kG) (ac *X, const bn256 *K)
+{
+  uint8_t index[64]; /* Lower 4-bit for index absolute value, msb is
+			for sign (encoded as: 0 means 1, 1 means -1).  */
+  bn256 K_dash[1];
+  jpc Q[1], tmp[1], *dst;
+  int i;
+  int vk;
+  uint32_t k_is_even = bn256_is_even (K);
+
+  bn256_sub_uint (K_dash, K, k_is_even);
+  /* It keeps the condition: 1 <= K' <= N - 2, and K' is odd.  */
+
+  /* Fill index.  */
+  vk = get_vk (K_dash, 0);
+  for (i = 1; i < 64; i++)
+    {
+      int vk_next, is_zero;
+
+      vk_next = get_vk (K_dash, i);
+      is_zero = (vk_next == 0);
+      index[i-1] = (vk - 1) | (is_zero << 7);
+      vk = (is_zero ? vk : vk_next);
+    }
+  index[63] = vk - 1;
+
+  memset (Q->z, 0, sizeof (bn256)); /* infinity */
+  for (i = 31; i >= 0; i--)
+    {
+      FUNC(jpc_double) (Q, Q);
+      FUNC(jpc_add_ac_signed) (Q, Q, &precomputed_2E_KG[index[i+32]&0x0f],
+			       index[i+32] >> 7);
+      FUNC(jpc_add_ac_signed) (Q, Q, &precomputed_KG[index[i]&0x0f],
+			       index[i] >> 7);
+    }
+
+  dst = k_is_even ? Q : tmp;
+  FUNC(jpc_add_ac) (dst, Q, &precomputed_KG[0]);
+
+  return FUNC(jpc_to_ac) (X, Q);
+}
+
+
+
+/**
+ * check if P is on the curve.
+ *
+ * Return -1 on error.
+ * Return 0 on success.
+ */
+static int
+point_is_on_the_curve (const ac *P)
+{
+  bn256 s[1], t[1];
+
+  /* Elliptic curve: y^2 = x^3 + a*x + b */
+  MFNC(sqr) (s, P->x);
+  MFNC(mul) (s, s, P->x);
+
+#ifdef COEFFICIENT_A_IS_ZERO
+  MFNC(mul) (t, coefficient_a, P->x);
+  MFNC(add) (s, s, t);
+#endif
+  MFNC(add) (s, s, coefficient_b);
+
+  MFNC(sqr) (t, P->y);
+  if (bn256_cmp (s, t) == 0)
+    return 0;
+  else
+    return -1;
+}
+
+
+static int
+get_vk_kP (const bn256 *K, int i)
+{
+  uint32_t w;
+  uint8_t blk = i/32;
+  uint8_t pos = i%32;
+  uint8_t col = 3*(pos % 11) + (pos >= 11) + (pos >= 22);
+  uint8_t word_index = (blk * 3) + (pos / 11);
+
+  w = ((K->word[word_index] >> col) & 7);
+  if (word_index < 7 && (pos == 10 || pos == 21))
+    {
+      uint8_t mask;
+      uint8_t shift;
+
+      word_index++;
+      if (pos == 10)
+	{
+	  shift = 2;
+	  mask = 4;
+	}
+      else
+	{
+	  shift = 1;
+	  mask = 6;
+	}
+
+      w |= ((K->word[word_index] << shift) & mask);
+    }
+
+  return w;
+}
+
+/**
+ * @brief	X  = k * P
+ *
+ * @param K	scalar k
+ * @param P	P in affine coordiate
+ *
+ * Return -1 on error.
+ * Return 0 on success.
+ *
+ * For the curve (cofactor is 1 and n is prime), possible error cases are:
+ *
+ *     P is not on the curve.
+ *     P = G, k = n
+ *     Something wrong in the code.
+ *
+ * Mathmatically, k=1 and P=O is another possible case, but O cannot be
+ * represented by affine coordinate.
+ */
+int
+FUNC(compute_kP) (ac *X, const bn256 *K, const ac *P)
+{
+  uint8_t index[86]; /* Lower 2-bit for index absolute value, msb is
+			for sign (encoded as: 0 means 1, 1 means -1).  */
+  bn256 K_dash[1];
+  uint32_t k_is_even = bn256_is_even (K);
+  jpc Q[1], tmp[1], *dst;
+  int i;
+  int vk;
+  ac P3[1], P5[1], P7[1];
+  const ac *p_Pi[4];
+
+  if (point_is_on_the_curve (P) < 0)
+    return -1;
+
+  if (bn256_sub (K_dash, K, N) == 0)	/* >= N, it's too big.  */
+    return -1;
+
+  bn256_sub_uint (K_dash, K, k_is_even);
+  /* It keeps the condition: 1 <= K' <= N - 2, and K' is odd.  */
+
+  p_Pi[0] = P;
+  p_Pi[1] = P3;
+  p_Pi[2] = P5;
+  p_Pi[3] = P7;
+
+  {
+    jpc Q1[1];
+
+    memcpy (Q->x, P->x, sizeof (bn256));
+    memcpy (Q->y, P->y, sizeof (bn256));
+    memset (Q->z, 0, sizeof (bn256));
+    Q->z->word[0] = 1;
+
+    FUNC(jpc_double) (Q, Q);
+    FUNC(jpc_add_ac) (Q1, Q, P);
+    if (FUNC(jpc_to_ac) (P3, Q1) < 0) /* Never occurs, except coding errors.  */
+      return -1;
+    FUNC(jpc_double) (Q, Q);
+    FUNC(jpc_add_ac) (Q1, Q, P);
+    if (FUNC(jpc_to_ac) (P5, Q1) < 0) /* Never occurs, except coding errors.  */
+      return -1;
+
+    memcpy (Q->x, P3->x, sizeof (bn256));
+    memcpy (Q->y, P3->y, sizeof (bn256));
+    memset (Q->z, 0, sizeof (bn256));
+    Q->z->word[0] = 1;
+    FUNC(jpc_double) (Q, Q);
+    FUNC(jpc_add_ac) (Q1, Q, P);
+    if (FUNC(jpc_to_ac) (P7, Q1) < 0) /* Never occurs, except coding errors.  */
+      return -1;
+  }
+
+  /* Fill index.  */
+  vk = get_vk_kP (K_dash, 0);
+  for (i = 1; i < 86; i++)
+    {
+      int vk_next, is_even;
+
+      vk_next = get_vk_kP (K_dash, i);
+      is_even = ((vk_next & 1) == 0);
+      index[i-1] = (is_even << 7) | ((is_even?7-vk:vk-1) >> 1);
+      vk = vk_next + is_even;
+    }
+  index[85] = ((vk - 1) >> 1);
+
+  memset (Q->z, 0, sizeof (bn256)); /* infinity */
+  for (i = 85; i >= 0; i--)
+    {
+      FUNC(jpc_double) (Q, Q);
+      FUNC(jpc_double) (Q, Q);
+      FUNC(jpc_double) (Q, Q);
+      FUNC(jpc_add_ac_signed) (Q, Q, p_Pi[index[i]&0x03], index[i] >> 7);
+    }
+
+  dst = k_is_even ? Q : tmp;
+  FUNC(jpc_add_ac) (dst, Q, &precomputed_KG[0]);
+
+  return FUNC(jpc_to_ac) (X, Q);
+}
+
+
+/**
+ * @brief Compute signature (r,s) of hash string z with secret key d
+ */
+void
+FUNC(ecdsa) (bn256 *r, bn256 *s, const bn256 *z, const bn256 *d)
+{
+  bn256 k[1];
+  ac KG[1];
+  bn512 tmp[1];
+  bn256 k_inv[1];
+  uint32_t carry;
+#define borrow carry
+#define tmp_k k_inv
+
+  do
+    {
+      do
+	{
+	  bn256_random (k);
+	  if (bn256_add_uint (k, k, 1))
+	    continue;
+	  if (bn256_sub (tmp_k, k, N) == 0)	/* >= N, it's too big.  */
+	    continue;
+	  /* 1 <= k <= N - 1 */
+	  FUNC(compute_kG) (KG, k);
+	  borrow = bn256_sub (r, KG->x, N);
+	  if (borrow)
+	    memcpy (r, KG->x, sizeof (bn256));
+	  else
+	    memcpy (KG->x, r, sizeof (bn256));
+	}
+      while (bn256_is_zero (r));
+
+      mod_inv (k_inv, k, N);
+      bn256_mul (tmp, r, d);
+      mod_reduce (s, tmp, N, MU_lower);
+      carry = bn256_add (s, s, z);
+      if (carry)
+	bn256_sub (s, s, N);
+      else
+	bn256_sub ((bn256 *)tmp, s, N);
+      bn256_mul (tmp, s, k_inv);
+      mod_reduce (s, tmp, N, MU_lower);
+    }
+  while (bn256_is_zero (s));
+
+#undef tmp_k
+#undef borrow
+}
--- a/src/fe25519.c
+++ b/src/fe25519.c
@@ -0,0 +1,134 @@
+/*
+ * fe25519.c -- 2^255-19 field element computation
+ *
+ * Copyright (C) 2014 Free Software Initiative of Japan
+ * Author: NIIBE Yutaka <gniibe@fsij.org>
+ *
+ * This file is a part of Gnuk, a GnuPG USB Token implementation.
+ *
+ * Gnuk is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Gnuk is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/*
+ * The field is \Z/(2^255-19)
+ *
+ * We use radix-32.  During computation, it's not reduced to 2^255-19,
+ * but it is represented in 256-bit (it is redundant representation).
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include "fe25519.h"
+
+#define ADDWORD_256(d_,w_,c_)                    \
+ asm ( "ldmia  %[d], { r4, r5, r6, r7 } \n\t"    \
+       "adds   r4, r4, %[w]             \n\t"    \
+       "adcs   r5, r5, #0               \n\t"    \
+       "adcs   r6, r6, #0               \n\t"    \
+       "adcs   r7, r7, #0               \n\t"    \
+       "stmia  %[d]!, { r4, r5, r6, r7 }\n\t"    \
+       "ldmia  %[d], { r4, r5, r6, r7 } \n\t"    \
+       "adcs   r4, r4, #0               \n\t"    \
+       "adcs   r5, r5, #0               \n\t"    \
+       "adcs   r6, r6, #0               \n\t"    \
+       "adcs   r7, r7, #0               \n\t"    \
+       "stmia  %[d]!, { r4, r5, r6, r7 }\n\t"    \
+       "mov    %[c], #0                 \n\t"    \
+       "adc    %[c], %[c], #0"                   \
+       : [d] "=&r" (d_), [c] "=&r" (c_)            \
+       : "[d]" (d_), [w] "r" (w_)                \
+       : "r4", "r5", "r6", "r7", "memory", "cc" )
+
+#define MULADD_256(s_,d_,w_,c_)   do {           \
+ asm ( "ldmia  %[s]!, { r8, r9, r10 } \n\t"      \
+       "ldmia  %[d], { r5, r6, r7 }   \n\t"      \
+       "umull  r4, r8, %[w], r8       \n\t"      \
+       "adds   r5, r5, r4             \n\t"      \
+       "adcs   r6, r6, r8             \n\t"      \
+       "umull  r4, r8, %[w], r9       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r6, r6, r4             \n\t"      \
+       "adcs   r7, r7, %[c]           \n\t"      \
+       "umull  r4, r8, %[w], r10      \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r7, r7, r4             \n\t"      \
+       "stmia  %[d]!, { r5, r6, r7 }  \n\t"      \
+       "ldmia  %[s]!, { r8, r9, r10 } \n\t"      \
+       "ldmia  %[d], { r5, r6, r7 }   \n\t"      \
+       "adcs   r5, r5, %[c]           \n\t"      \
+       "umull  r4, r8, %[w], r8       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r5, r5, r4             \n\t"      \
+       "adcs   r6, r6, %[c]           \n\t"      \
+       "umull  r4, r8, %[w], r9       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r6, r6, r4             \n\t"      \
+       "adcs   r7, r7, %[c]           \n\t"      \
+       "umull  r4, r8, %[w], r10      \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r7, r7, r4             \n\t"      \
+       "stmia  %[d]!, { r5, r6, r7 }  \n\t"      \
+       "ldmia  %[s]!, { r8, r9 }      \n\t"      \
+       "ldmia  %[d], { r5, r6 }       \n\t"      \
+       "adcs   r5, r5, %[c]           \n\t"      \
+       "umull  r4, r8, %[w], r8       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r5, r5, r4             \n\t"      \
+       "adcs   r6, r6, %[c]           \n\t"      \
+       "umull  r4, r8, %[w], r9       \n\t"      \
+       "adc    %[c], r8, #0           \n\t"      \
+       "adds   r6, r6, r4             \n\t"      \
+       "adc    %[c], %[c], #0         \n\t"      \
+       "stmia  %[d]!, { r5, r6 }"                \
+       : [s] "=&r" (s_), [d] "=&r" (d_), [c] "=&r" (c_)     \
+       : "[s]" (s_), "[d]" (d_), [w] "r" (w_)            \
+       : "r4", "r5", "r6", "r7", "r8", "r9", "r10",      \
+         "memory", "cc" );                               \
+  *d_ = c_;                                              \
+} while (0)
+
+static void mul_hlp (const uint32_t *s, uint32_t *d, uint32_t w)
+{
+  uint32_t c;
+
+  MULADD_256 (s, d, w, c);
+}
+
+
+void fe_mul (fe25519 *X, const fe25519 *A, const fe25519 *B)
+{
+  uint32_t word[FE25519_WORDS*2];
+  const uint32_t *s;
+  uint32_t *d;
+  uint32_t w;
+  uint32_t c, c0;
+
+  memset (word, 0, sizeof (uint32_t)*FE25519_WORDS);
+
+  s = A->word;  d = &word[0];  w = B->word[0];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &word[1];  w = B->word[1];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &word[2];  w = B->word[2];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &word[3];  w = B->word[3];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &word[4];  w = B->word[4];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &word[5];  w = B->word[5];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &word[6];  w = B->word[6];  MULADD_256 (s, d, w, c);
+  s = A->word;  d = &word[7];  w = B->word[7];  MULADD_256 (s, d, w, c);
+  s = &word[8]; d = &word[0];  w = 38;          MULADD_256 (s, d, w, c);
+  c0 = word[8] * 38;
+  s = word;
+  ADDWORD_256 (s, c0, c);
+  word[0] += c * 38;
+  memcpy (X->word, word, sizeof X->word);
+}
--- a/src/fe25519.h
+++ b/src/fe25519.h
@@ -0,0 +1,4 @@
+#define FE25519_WORDS 8
+typedef struct fe25519 {
+  uint32_t word[FE25519_WORDS]; /* Little endian */
+} fe25519;
--- a/src/field-group-select.h
+++ b/src/field-group-select.h
@@ -0,0 +1,7 @@
+#define CONCAT0(a,b) a##b
+#define CONCAT1(a,b) CONCAT0(a,b)
+#define CONCAT2(a,b,c) CONCAT1(a,b##c)
+#define CONCAT3(a,b,c) CONCAT2(a,b,c)
+
+#define FUNC(func) CONCAT1(func##_,FIELD)
+#define MFNC(func) CONCAT3(mod,FIELD,_##func)
--- a/src/gnuk.h
+++ b/src/gnuk.h
@@ -246,9 +246,13 @@ extern int rsa_verify (const uint8_t *pubkey, const uint8_t *hash,
 		       const uint8_t *signature);
 extern uint8_t *rsa_genkey (void);

-extern int ecdsa_sign  (const uint8_t *hash, uint8_t *output,
-			const struct key_data *kd);
-extern uint8_t *ecdsa_compute_public (const uint8_t *key_data);
+extern int ecdsa_sign_p256r1  (const uint8_t *hash, uint8_t *output,
+			       const uint8_t *key_data);
+extern uint8_t *ecdsa_compute_public_p256r1 (const uint8_t *key_data);
+
+extern int ecdsa_sign_p256k1  (const uint8_t *hash, uint8_t *output,
+			       const uint8_t *key_data);
+extern uint8_t *ecdsa_compute_public_p256k1 (const uint8_t *key_data);

 extern const uint8_t *gpg_do_read_simple (uint8_t);
 extern void gpg_do_write_simple (uint8_t, const uint8_t *, int);
--- a/src/gnuk.ld.in
+++ b/src/gnuk.ld.in
@@ -5,7 +5,7 @@ __main_stack_size__      = 0x0100;      /* Exception handlers     */
 __process0_stack_size__  = 0x0100;      /* main */
 __process1_stack_size__  = 0x0140;      /* ccid */
 __process2_stack_size__  = 0x0180;      /* rng */
-__process3_stack_size__  = 0x0b00;      /* gpg */
+__process3_stack_size__  = 0x1600;      /* gpg */
 __process4_stack_size__  = 0x0100;      /* intr: usb */
 __process5_stack_size__  = @MSC_SIZE@;  /* msc */
 __process6_stack_size__  = @TIM_SIZE@;  /* intr: timer */
--- a/src/jpc-ac.h
+++ b/src/jpc-ac.h
@@ -1,23 +0,0 @@
-/**
- * @brief	Jacobian projective coordinates
- */
-typedef struct
-{
-  bn256 x[1];
-  bn256 y[1];
-  bn256 z[1];
-} jpc;
-
-/**
- * @brief	Affin coordinates
- */
-typedef struct
-{
-  bn256 x[1];
-  bn256 y[1];
-} ac;
-
-void jpc_double (jpc *X, const jpc *A);
-void jpc_add_ac (jpc *X, const jpc *A, const ac *B);
-void jpc_add_ac_signed (jpc *X, const jpc *A, const ac *B, int minus);
-int jpc_to_ac (ac *X, const jpc *A);
--- a/src/jpc-ac_p256k1.h
+++ b/src/jpc-ac_p256k1.h
@@ -0,0 +1,23 @@
+/**
+ * @brief	Jacobian projective coordinates
+ */
+typedef struct
+{
+  bn256 x[1];
+  bn256 y[1];
+  bn256 z[1];
+} jpc;
+
+/**
+ * @brief	Affin coordinates
+ */
+typedef struct
+{
+  bn256 x[1];
+  bn256 y[1];
+} ac;
+
+void jpc_double_p256k1 (jpc *X, const jpc *A);
+void jpc_add_ac_p256k1 (jpc *X, const jpc *A, const ac *B);
+void jpc_add_ac_signed_p256k1 (jpc *X, const jpc *A, const ac *B, int minus);
+int jpc_to_ac_p256k1 (ac *X, const jpc *A);
--- a/src/jpc-ac_p256r1.h
+++ b/src/jpc-ac_p256r1.h
@@ -0,0 +1,23 @@
+/**
+ * @brief	Jacobian projective coordinates
+ */
+typedef struct
+{
+  bn256 x[1];
+  bn256 y[1];
+  bn256 z[1];
+} jpc;
+
+/**
+ * @brief	Affin coordinates
+ */
+typedef struct
+{
+  bn256 x[1];
+  bn256 y[1];
+} ac;
+
+void jpc_double_p256r1 (jpc *X, const jpc *A);
+void jpc_add_ac_p256r1 (jpc *X, const jpc *A, const ac *B);
+void jpc_add_ac_signed_p256r1 (jpc *X, const jpc *A, const ac *B, int minus);
+int jpc_to_ac_p256r1 (ac *X, const jpc *A);
--- a/src/jpc.c
+++ b/src/jpc.c
@@ -1,5 +1,5 @@
 /*
- * jpc.c -- arithmetic on Jacobian projective coordinates and Affin coordinates
+ * jpc.c -- arithmetic on Jacobian projective coordinates.
 *
 * Copyright (C) 2011, 2013 Free Software Initiative of Japan
 * Author: NIIBE Yutaka <gniibe@fsij.org>
@@ -21,11 +21,7 @@
 *
 */

-#include <stdint.h>
-#include <string.h>
-#include "bn.h"
-#include "modp256.h"
-#include "jpc-ac.h"
+#include "field-group-select.h"

 /**
 * @brief	X = 2 * A
@@ -34,36 +30,48 @@
 * @param A	JPC
 */
 void
-jpc_double (jpc *X, const jpc *A)
+FUNC(jpc_double) (jpc *X, const jpc *A)
 {
  bn256 a[1], b[1], c[1], tmp0[1];
-  bn256 *d = X->x;
+  bn256 *d;

-  modp256_sqr (a, A->y);
+  if (bn256_is_zero (A->z))		/* A is infinite */
+    return;
+
+  d = X->x;
+  MFNC(sqr) (a, A->y);
  memcpy (b, a, sizeof (bn256));
-  modp256_mul (a, a, A->x);
-  modp256_shift (a, a, 2);
+  MFNC(mul) (a, a, A->x);
+  MFNC(shift) (a, a, 2);

-  modp256_sqr (b, b);
-  modp256_shift (b, b, 3);
+  MFNC(sqr) (b, b);
+  MFNC(shift) (b, b, 3);

-  modp256_sqr (tmp0, A->z);
-  modp256_sub (c, A->x, tmp0);
-  modp256_add (tmp0, tmp0, A->x);
-  modp256_mul (tmp0, tmp0, c);
-  modp256_shift (c, tmp0, 1);
-  modp256_add (c, c, tmp0);
+#if defined(COEFFICIENT_A_IS_MINUS_3)
+  MFNC(sqr) (tmp0, A->z);
+  MFNC(sub) (c, A->x, tmp0);
+  MFNC(add) (tmp0, tmp0, A->x);
+  MFNC(mul) (tmp0, tmp0, c);
+  MFNC(shift) (c, tmp0, 1);
+  MFNC(add) (c, c, tmp0);
+#elif defined (COEFFICIENT_A_IS_ZERO)
+  MFNC(sqr) (tmp0, A->x);
+  MFNC(shift) (c, tmp0, 1);
+  MFNC(add) (c, c, tmp0);
+#else
+#error "not supported."
+#endif

-  modp256_sqr (d, c);
-  modp256_shift (tmp0, a, 1);
-  modp256_sub (d, d, tmp0);
+  MFNC(sqr) (d, c);
+  MFNC(shift) (tmp0, a, 1);
+  MFNC(sub) (d, d, tmp0);

-  modp256_mul (X->z, A->y, A->z);
-  modp256_shift (X->z, X->z, 1);
+  MFNC(mul) (X->z, A->y, A->z);
+  MFNC(shift) (X->z, X->z, 1);

-  modp256_sub (tmp0, a, d);
-  modp256_mul (tmp0, c, tmp0);
-  modp256_sub (X->y, tmp0, b);
+  MFNC(sub) (tmp0, a, d);
+  MFNC(mul) (tmp0, c, tmp0);
+  MFNC(sub) (X->y, tmp0, b);
 }

 /**
@@ -75,9 +83,9 @@ jpc_double (jpc *X, const jpc *A)
 * @param MINUS if 1 subtraction, addition otherwise.
 */
 void
-jpc_add_ac_signed (jpc *X, const jpc *A, const ac *B, int minus)
+FUNC(jpc_add_ac_signed) (jpc *X, const jpc *A, const ac *B, int minus)
 {
-  bn256 a[1], b[1], c[1], d[1];
+  bn256 a[1], b[1], c[1], d[1], tmp[1];
 #define minus_B_y c
 #define c_sqr a
 #define c_cube b
@@ -88,58 +96,66 @@ jpc_add_ac_signed (jpc *X, const jpc *A, const ac *B, int minus)
 #define y3_tmp c
 #define y1_c_cube a

-  if (A->z == 0)		/* A is infinite */
+  if (bn256_is_zero (A->z))		/* A is infinite */
    {
      memcpy (X->x, B->x, sizeof (bn256));
      if (minus)
-	bn256_sub (X->y, P256, B->y);
+	{
+	  memcpy (tmp, B->y, sizeof (bn256));
+	  bn256_sub (X->y, CONST_P256, B->y);
+	}
      else
-	memcpy (X->y, B->y, sizeof (bn256));
+	{
+	  memcpy (X->y, B->y, sizeof (bn256));
+	  bn256_sub (tmp, CONST_P256, B->y);
+	}
      memset (X->z, 0, sizeof (bn256));
-      X->z->words[0] = 1;
+      X->z->word[0] = 1;
      return;
    }

-  modp256_sqr (a, A->z);
+  MFNC(sqr) (a, A->z);
  memcpy (b, a, sizeof (bn256));
-  modp256_mul (a, a, B->x);
+  MFNC(mul) (a, a, B->x);

-  modp256_mul (b, b, A->z);
+  MFNC(mul) (b, b, A->z);
  if (minus)
    {
-      bn256_sub (minus_B_y, P256, B->y);
-      modp256_mul (b, b, minus_B_y);
+      bn256_sub (minus_B_y, CONST_P256, B->y);
+      MFNC(mul) (b, b, minus_B_y);
    }
  else
-    modp256_mul (b, b, B->y);
+    {
+      bn256_sub (tmp, CONST_P256, B->y);
+      MFNC(mul) (b, b, B->y);
+    }

-  if (bn256_cmp (A->x, a) == 0)
-    if (bn256_cmp (A->y, b) == 0)
-      {
-	jpc_double (X, A);
-	return;
-      }
+  if (bn256_cmp (A->x, a) == 0 && bn256_cmp (A->y, b) == 0)
+    {
+      FUNC(jpc_double) (X, A);
+      return;
+    }

-  modp256_sub (c, a, A->x);
-  modp256_sub (d, b, A->y);
+  MFNC(sub) (c, a, A->x);
+  MFNC(sub) (d, b, A->y);

-  modp256_mul (X->z, A->z, c);
+  MFNC(mul) (X->z, A->z, c);

-  modp256_sqr (c_sqr, c);
-  modp256_mul (c_cube, c_sqr, c);
+  MFNC(sqr) (c_sqr, c);
+  MFNC(mul) (c_cube, c_sqr, c);

-  modp256_mul (x1_c_sqr, A->x, c_sqr);
+  MFNC(mul) (x1_c_sqr, A->x, c_sqr);

-  modp256_sqr (X->x, d);
+  MFNC(sqr) (X->x, d);
  memcpy (x1_c_sqr_copy, x1_c_sqr, sizeof (bn256));
-  modp256_shift (x1_c_sqr_2, x1_c_sqr, 1);
-  modp256_add (c_cube_plus_x1_c_sqr_2, x1_c_sqr_2, c_cube);
-  modp256_sub (X->x, X->x, c_cube_plus_x1_c_sqr_2);
+  MFNC(shift) (x1_c_sqr_2, x1_c_sqr, 1);
+  MFNC(add) (c_cube_plus_x1_c_sqr_2, x1_c_sqr_2, c_cube);
+  MFNC(sub) (X->x, X->x, c_cube_plus_x1_c_sqr_2);

-  modp256_sub (y3_tmp, x1_c_sqr_copy, X->x);
-  modp256_mul (y3_tmp, y3_tmp, d);
-  modp256_mul (y1_c_cube, A->y, c_cube);
-  modp256_sub (X->y, y3_tmp, y1_c_cube);
+  MFNC(sub) (y3_tmp, x1_c_sqr_copy, X->x);
+  MFNC(mul) (y3_tmp, y3_tmp, d);
+  MFNC(mul) (y1_c_cube, A->y, c_cube);
+  MFNC(sub) (X->y, y3_tmp, y1_c_cube);
 }

 /**
@@ -150,9 +166,9 @@ jpc_add_ac_signed (jpc *X, const jpc *A, const ac *B, int minus)
 * @param B	AC
 */
 void
-jpc_add_ac (jpc *X, const jpc *A, const ac *B)
+FUNC(jpc_add_ac) (jpc *X, const jpc *A, const ac *B)
 {
-  jpc_add_ac_signed (X, A, B, 0);
+  FUNC(jpc_add_ac_signed) (X, A, B, 0);
 }

 /**
@@ -165,17 +181,17 @@ jpc_add_ac (jpc *X, const jpc *A, const ac *B)
 * Return 0 on success.
 */
 int
-jpc_to_ac (ac *X, const jpc *A)
+FUNC(jpc_to_ac) (ac *X, const jpc *A)
 {
  bn256 z_inv[1], z_inv_sqr[1];

-  if (modp256_inv (z_inv, A->z) < 0)
+  if (MFNC(inv) (z_inv, A->z) < 0)
    return -1;

-  modp256_sqr (z_inv_sqr, z_inv);
-  modp256_mul (z_inv, z_inv, z_inv_sqr);
+  MFNC(sqr) (z_inv_sqr, z_inv);
+  MFNC(mul) (z_inv, z_inv, z_inv_sqr);

-  modp256_mul (X->x, A->x, z_inv_sqr);
-  modp256_mul (X->y, A->y, z_inv);
+  MFNC(mul) (X->x, A->x, z_inv_sqr);
+  MFNC(mul) (X->y, A->y, z_inv);
  return 0;
 }
--- a/src/jpc_p256k1.c
+++ b/src/jpc_p256k1.c
@@ -0,0 +1,34 @@
+/*
+ * jpc_p256k1.c -- arithmetic on Jacobian projective coordinates for p256k1.
+ *
+ * Copyright (C) 2014 Free Software Initiative of Japan
+ * Author: NIIBE Yutaka <gniibe@fsij.org>
+ *
+ * This file is a part of Gnuk, a GnuPG USB Token implementation.
+ *
+ * Gnuk is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Gnuk is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include "bn.h"
+#include "modp256k1.h"
+#include "jpc-ac_p256k1.h"
+
+#define FIELD p256k1
+#define CONST_P256 P256K1
+#define COEFFICIENT_A_IS_ZERO    1
+
+#include "jpc.c"
--- a/src/jpc_p256r1.c
+++ b/src/jpc_p256r1.c
@@ -0,0 +1,34 @@
+/*
+ * jpc_p256r1.c -- arithmetic on Jacobian projective coordinates for p256r1.
+ *
+ * Copyright (C) 2014 Free Software Initiative of Japan
+ * Author: NIIBE Yutaka <gniibe@fsij.org>
+ *
+ * This file is a part of Gnuk, a GnuPG USB Token implementation.
+ *
+ * Gnuk is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Gnuk is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include "bn.h"
+#include "modp256r1.h"
+#include "jpc-ac_p256r1.h"
+
+#define FIELD p256r1
+#define CONST_P256 P256R1
+#define COEFFICIENT_A_IS_MINUS_3 1
+
+#include "jpc.c"
--- a/src/mod.c
+++ b/src/mod.c
@@ -1,7 +1,7 @@
 /*
 * mod.c -- modulo arithmetic
 *
- * Copyright (C) 2011 Free Software Initiative of Japan
+ * Copyright (C) 2011, 2014 Free Software Initiative of Japan
 * Author: NIIBE Yutaka <gniibe@fsij.org>
 *
 * This file is a part of Gnuk, a GnuPG USB Token implementation.
@@ -39,157 +39,306 @@ mod_reduce (bn256 *X, const bn512 *A, const bn256 *B, const bn256 *MU_lower)
  uint32_t borrow_next;

  memset (q, 0, sizeof (bn256));
-  q->words[0] = A->words[15];
+  q->word[0] = A->word[15];
  bn256_mul (tmp, q, MU_lower);
-  tmp->words[8] += A->words[15];
-  carry = (tmp->words[8] < A->words[15]);
-  tmp->words[9] += carry;
+  tmp->word[8] += A->word[15];
+  carry = (tmp->word[8] < A->word[15]);
+  tmp->word[9] += carry;

-  q->words[7] = A->words[14];
-  q->words[6] = A->words[13];
-  q->words[5] = A->words[12];
-  q->words[4] = A->words[11];
-  q->words[3] = A->words[10];
-  q->words[2] = A->words[9];
-  q->words[1] = A->words[8];
-  q->words[0] = A->words[7];
+  q->word[7] = A->word[14];
+  q->word[6] = A->word[13];
+  q->word[5] = A->word[12];
+  q->word[4] = A->word[11];
+  q->word[3] = A->word[10];
+  q->word[2] = A->word[9];
+  q->word[1] = A->word[8];
+  q->word[0] = A->word[7];
  bn256_mul (q_big, q, MU_lower);
-  bn256_add ((bn256 *)&q_big->words[8], (bn256 *)&q_big->words[8], q);
+  bn256_add ((bn256 *)&q_big->word[8], (bn256 *)&q_big->word[8], q);

-  q->words[0] = q_big->words[9] + tmp->words[1];
-  carry = (q->words[0] < tmp->words[1]);
+  q->word[0] = q_big->word[9] + tmp->word[1];
+  carry = (q->word[0] < tmp->word[1]);

-  q->words[1] = q_big->words[10] + carry;
-  carry = (q->words[1] < carry);
-  q->words[1] += tmp->words[2];
-  carry += (q->words[1] < tmp->words[2]);
+  q->word[1] = q_big->word[10] + carry;
+  carry = (q->word[1] < carry);
+  q->word[1] += tmp->word[2];
+  carry += (q->word[1] < tmp->word[2]);

-  q->words[2] = q_big->words[11] + carry;
-  carry = (q->words[2] < carry);
-  q->words[2] += tmp->words[3];
-  carry += (q->words[2] < tmp->words[3]);
+  q->word[2] = q_big->word[11] + carry;
+  carry = (q->word[2] < carry);
+  q->word[2] += tmp->word[3];
+  carry += (q->word[2] < tmp->word[3]);

-  q->words[3] = q_big->words[12] + carry;
-  carry = (q->words[3] < carry);
-  q->words[3] += tmp->words[4];
-  carry += (q->words[3] < tmp->words[4]);
+  q->word[3] = q_big->word[12] + carry;
+  carry = (q->word[3] < carry);
+  q->word[3] += tmp->word[4];
+  carry += (q->word[3] < tmp->word[4]);

-  q->words[4] = q_big->words[13] + carry;
-  carry = (q->words[4] < carry);
-  q->words[4] += tmp->words[5];
-  carry += (q->words[4] < tmp->words[5]);
+  q->word[4] = q_big->word[13] + carry;
+  carry = (q->word[4] < carry);
+  q->word[4] += tmp->word[5];
+  carry += (q->word[4] < tmp->word[5]);

-  q->words[5] = q_big->words[14] + carry;
-  carry = (q->words[5] < carry);
-  q->words[5] += tmp->words[6];
-  carry += (q->words[5] < tmp->words[6]);
+  q->word[5] = q_big->word[14] + carry;
+  carry = (q->word[5] < carry);
+  q->word[5] += tmp->word[6];
+  carry += (q->word[5] < tmp->word[6]);

-  q->words[6] = q_big->words[15] + carry;
-  carry = (q->words[6] < carry);
-  q->words[6] += tmp->words[7];
-  carry += (q->words[6] < tmp->words[7]);
+  q->word[6] = q_big->word[15] + carry;
+  carry = (q->word[6] < carry);
+  q->word[6] += tmp->word[7];
+  carry += (q->word[6] < tmp->word[7]);

-  q->words[7] = carry;
-  q->words[7] += tmp->words[8];
-  carry = (q->words[7] < tmp->words[8]);
+  q->word[7] = carry;
+  q->word[7] += tmp->word[8];
+  carry = (q->word[7] < tmp->word[8]);

  memset (q_big, 0, sizeof (bn512));
-  q_big->words[8] = A->words[8];
-  q_big->words[7] = A->words[7];
-  q_big->words[6] = A->words[6];
-  q_big->words[5] = A->words[5];
-  q_big->words[4] = A->words[4];
-  q_big->words[3] = A->words[3];
-  q_big->words[2] = A->words[2];
-  q_big->words[1] = A->words[1];
-  q_big->words[0] = A->words[0];
+  q_big->word[8] = A->word[8];
+  q_big->word[7] = A->word[7];
+  q_big->word[6] = A->word[6];
+  q_big->word[5] = A->word[5];
+  q_big->word[4] = A->word[4];
+  q_big->word[3] = A->word[3];
+  q_big->word[2] = A->word[2];
+  q_big->word[1] = A->word[1];
+  q_big->word[0] = A->word[0];

  bn256_mul (tmp, q, B);
+  tmp->word[8] += carry * B->word[0];
+  tmp->word[15] = tmp->word[14] = tmp->word[13] = tmp->word[12]
+    = tmp->word[11] = tmp->word[10] = tmp->word[9] = 0;
+
+  borrow = bn256_sub (X, (bn256 *)&q_big->word[0], (bn256 *)&tmp->word[0]);
+  borrow_next = (q_big->word[8] < borrow);
+  q_big->word[8] -= borrow;
+  borrow_next += (q_big->word[8] < tmp->word[8]);
+  q_big->word[8] -= tmp->word[8];
+
+  carry = q_big->word[8];
  if (carry)
-    tmp->words[8] += B->words[0];
-  tmp->words[15] = tmp->words[14] = tmp->words[13] = tmp->words[12]
-    = tmp->words[11] = tmp->words[10] = tmp->words[9] = 0;
+    carry -= bn256_sub (X, X, B);
+  else
+    bn256_sub (q, X, B);

-  borrow = bn256_sub (X, (bn256 *)&q_big->words[0], (bn256 *)&tmp->words[0]);
-  borrow_next = (q_big->words[8] < borrow);
-  q_big->words[8] -= borrow;
-  borrow_next += (q_big->words[8] < tmp->words[8]);
-  q_big->words[8] -= tmp->words[8];
+  if (carry)
+    carry -= bn256_sub (X, X, B);
+  else
+    bn256_sub (q, X, B);

-  carry = q_big->words[8];
-  while (carry)
-    {
-      borrow_next = bn256_sub (X, X, B);
-      carry -= borrow_next;
-    }
-
-  if (bn256_is_ge (X, B))
-    bn256_sub (X, X, B);
+  borrow = bn256_sub (q, X, B);
+  if (borrow)
+    memcpy (q, X, sizeof (bn256));
+  else
+    memcpy (X, q, sizeof (bn256));
+#undef borrow
 }

 /**
 * @brief C = X^(-1) mod N
 * 
 */
+#define MAX_N_BITS 256
+
 void
 mod_inv (bn256 *C, const bn256 *X, const bn256 *N)
 {
-  bn256 u[1], v[1];
+  bn256 u[1], v[1], tmp[1];
  bn256 A[1] = { { { 1, 0, 0, 0, 0, 0, 0, 0 } } };
+  uint32_t carry;
+#define borrow carry
+  int n = MAX_N_BITS * 3;

  memset (C, 0, sizeof (bn256));
  memcpy (u, X, sizeof (bn256));
  memcpy (v, N, sizeof (bn256));

-  while (!bn256_is_zero (u))
+  while (n--)
    {
-      while (bn256_is_even (u))
+      int c = (bn256_is_even (u) << 1) + bn256_is_even (v);
+
+      switch (c)
 	{
+	case 3:
 	  bn256_shift (u, u, -1);
 	  if (bn256_is_even (A))
-	    bn256_shift (A, A, -1);
-	  else
 	    {
-	      int carry = bn256_add (A, A, N);
-
-	      bn256_shift (A, A, -1);
-	      if (carry)
-		A->words[7] |= 0x80000000;
+	      bn256_add (tmp, A, N);
+	      carry = 0;
 	    }
-	}
+	  else
+	    carry = bn256_add (A, A, N);
+
+	  bn256_shift (A, A, -1);
+	  A->word[7] |= carry * 0x80000000;

-      while (bn256_is_even (v))
-	{
 	  bn256_shift (v, v, -1);
 	  if (bn256_is_even (C))
-	    bn256_shift (C, C, -1);
+	    {
+	      bn256_add (tmp, C, N);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (C, C, N);
+
+	  bn256_shift (C, C, -1);
+	  C->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (tmp, tmp))
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      borrow = bn256_sub (tmp, tmp, tmp);
+	      if (borrow)
+		bn256_add (tmp, tmp, tmp);
+	      else
+		bn256_add (tmp, A, N);
+	    }
 	  else
 	    {
-	      int carry = bn256_add (C, C, N);
-
-	      bn256_shift (C, C, -1);
-	      if (carry)
-		C->words[7] |= 0x80000000;
+	      bn256_sub (tmp, tmp, tmp);
+	      borrow = bn256_sub (tmp, tmp, tmp);
+	      if (borrow)
+		bn256_add (tmp, tmp, tmp);
+	      else
+		bn256_add (tmp, tmp, N);
 	    }
-	}
+	  break;

-      if (bn256_is_ge (u, v))
-	{
-	  int borrow;
+	case 1:
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, N);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, N);

-	  bn256_sub (u, u, v);
-	  borrow = bn256_sub (A, A, C);
-	  if (borrow)
-	    bn256_add (A, A, N);
-	}
-      else
-	{
-	  int borrow;
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;

-	  bn256_sub (v, v, u);
-	  borrow = bn256_sub (C, C, A);
-	  if (borrow)
-	    bn256_add (C, C, N);
+	  bn256_shift (v, v, -1);
+	  if (bn256_is_even (C))
+	    {
+	      bn256_add (tmp, C, N);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (C, C, N);
+
+	  bn256_shift (C, C, -1);
+	  C->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (tmp, tmp))
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      borrow = bn256_sub (tmp, tmp, tmp);
+	      if (borrow)
+		bn256_add (tmp, tmp, tmp);
+	      else
+		bn256_add (tmp, A, N);
+	    }
+	  else
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      borrow = bn256_sub (tmp, tmp, tmp);
+	      if (borrow)
+		bn256_add (tmp, tmp, tmp);
+	      else
+		bn256_add (tmp, tmp, N);
+	    }
+	  break;
+
+	case 2:
+	  bn256_shift (u, u, -1);
+	  if (bn256_is_even (A))
+	    {
+	      bn256_add (tmp, A, N);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (A, A, N);
+
+	  bn256_shift (A, A, -1);
+	  A->word[7] |= carry * 0x80000000;
+
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, N);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, N);
+
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (tmp, tmp))
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      borrow = bn256_sub (tmp, tmp, tmp);
+	      if (borrow)
+		bn256_add (tmp, tmp, tmp);
+	      else
+		bn256_add (tmp, A, N);
+	    }
+	  else
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      borrow = bn256_sub (tmp, tmp, tmp);
+	      if (borrow)
+		bn256_add (tmp, tmp, tmp);
+	      else
+		bn256_add (tmp, tmp, N);
+	    }
+	  break;
+
+	case 0:
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, N);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, N);
+
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;
+
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, N);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, N);
+
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (u, v))
+	    {
+	      bn256_sub (u, u, v);
+	      borrow = bn256_sub (A, A, C);
+	      if (borrow)
+		bn256_add (A, A, N);
+	      else
+		bn256_add (tmp, A, N);
+	    }
+	  else
+	    {
+	      bn256_sub (v, v, u);
+	      borrow = bn256_sub (C, C, A);
+	      if (borrow)
+		bn256_add (C, C, N);
+	      else
+		bn256_add (tmp, C, N);
+	    }
+	  break;
 	}
    }
+#undef borrow
 }
--- a/src/modp256.c
+++ b/src/modp256.c
@@ -1,305 +0,0 @@
-/*
- * modp256.c -- modulo P256 arithmetic
- *
- * Copyright (C) 2011, 2013 Free Software Initiative of Japan
- * Author: NIIBE Yutaka <gniibe@fsij.org>
- *
- * This file is a part of Gnuk, a GnuPG USB Token implementation.
- *
- * Gnuk is free software: you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * Gnuk is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
- * License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-/*
- * p256 =  2^256 - 2^224 + 2^192 + 2^96 - 1
- */
-#include <stdint.h>
-#include <string.h>
-
-#include "bn.h"
-#include "modp256.h"
-
-/*
-256      224      192      160      128       96       64       32        0
-2^256
-  1 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
-2^256 - 2^224
-  0 ffffffff 00000000 00000000 00000000 00000000 00000000 00000000 00000000
-2^256 - 2^224 + 2^192
-  0 ffffffff 00000001 00000000 00000000 00000000 00000000 00000000 00000000
-2^256 - 2^224 + 2^192 + 2^96
-  0 ffffffff 00000001 00000000 00000000 00000001 00000000 00000000 00000000
-2^256 - 2^224 + 2^192 + 2^96 - 1
-  0 ffffffff 00000001 00000000 00000000 00000000 ffffffff ffffffff ffffffff
-*/
-const bn256 p256 = { {0xffffffff, 0xffffffff, 0xffffffff, 0x00000000,
-		      0x00000000, 0x00000000, 0x00000001, 0xffffffff} };
-
-/**
- * @brief  X = (A + B) mod p256
- */
-void
-modp256_add (bn256 *X, const bn256 *A, const bn256 *B)
-{
-  int carry;
-
-  carry = bn256_add (X, A, B);
-  if (carry)
-    bn256_sub (X, X, P256);
-}
-
-/**
- * @brief  X = (A - B) mod p256
- */
-void
-modp256_sub (bn256 *X, const bn256 *A, const bn256 *B)
-{
-  int borrow;
-
-  borrow = bn256_sub (X, A, B);
-  if (borrow)
-    bn256_add (X, X, P256);
-}
-
-/**
- * @brief  X = A mod p256
- */
-void
-modp256_reduce (bn256 *X, const bn512 *A)
-{
-  bn256 tmp[1];
-
-#define S1 X
-#define S2 tmp
-#define S3 tmp
-#define S4 tmp
-#define S5 tmp
-#define S6 tmp
-#define S7 tmp
-#define S8 tmp
-#define S9 tmp
-
-  S1->words[7] = A->words[7];
-  S1->words[6] = A->words[6];
-  S1->words[5] = A->words[5];
-  S1->words[4] = A->words[4];
-  S1->words[3] = A->words[3];
-  S1->words[2] = A->words[2];
-  S1->words[1] = A->words[1];
-  S1->words[0] = A->words[0];
-  /* X = S1 */
-
-  S2->words[7] = A->words[15];
-  S2->words[6] = A->words[14];
-  S2->words[5] = A->words[13];
-  S2->words[4] = A->words[12];
-  S2->words[3] = A->words[11];
-  S2->words[2] = S2->words[1] = S2->words[0] = 0;
-  /* X += 2 * S2 */
-  modp256_add (X, X, S2);
-  modp256_add (X, X, S2);
-
-  S3->words[7] = 0;
-  S3->words[6] = A->words[15];
-  S3->words[5] = A->words[14];
-  S3->words[4] = A->words[13];
-  S3->words[3] = A->words[12];
-  S3->words[2] = S3->words[1] = S3->words[0] = 0;
-  /* X += 2 * S3 */
-  modp256_add (X, X, S3);
-  modp256_add (X, X, S3);
-
-  S4->words[7] = A->words[15];
-  S4->words[6] = A->words[14];
-  S4->words[5] = S4->words[4] = S4->words[3] = 0;
-  S4->words[2] = A->words[10];
-  S4->words[1] = A->words[9];
-  S4->words[0] = A->words[8];
-  /* X += S4 */
-  modp256_add (X, X, S4);
-
-  S5->words[7] = A->words[8];
-  S5->words[6] = A->words[13];
-  S5->words[5] = A->words[15];
-  S5->words[4] = A->words[14];
-  S5->words[3] = A->words[13];
-  S5->words[2] = A->words[11];
-  S5->words[1] = A->words[10];
-  S5->words[0] = A->words[9];
-  /* X += S5 */
-  modp256_add (X, X, S5);
-
-  S6->words[7] = A->words[10];
-  S6->words[6] = A->words[8];
-  S6->words[5] = S6->words[4] = S6->words[3] = 0;
-  S6->words[2] = A->words[13];
-  S6->words[1] = A->words[12];
-  S6->words[0] = A->words[11];
-  /* X -= S6 */
-  modp256_sub (X, X, S6);
-
-  S7->words[7] = A->words[11];
-  S7->words[6] = A->words[9];
-  S7->words[5] = S7->words[4] = 0;
-  S7->words[3] = A->words[15];
-  S7->words[2] = A->words[14];
-  S7->words[1] = A->words[13];
-  S7->words[0] = A->words[12];
-  /* X -= S7 */
-  modp256_sub (X, X, S7);
-
-  S8->words[7] = A->words[12];
-  S8->words[6] = 0;
-  S8->words[5] = A->words[10];
-  S8->words[4] = A->words[9];
-  S8->words[3] = A->words[8];
-  S8->words[2] = A->words[15];
-  S8->words[1] = A->words[14];
-  S8->words[0] = A->words[13];
-  /* X -= S8 */
-  modp256_sub (X, X, S8);
-
-  S9->words[7] = A->words[13];
-  S9->words[6] = 0;
-  S9->words[5] = A->words[11];
-  S9->words[4] = A->words[10];
-  S9->words[3] = A->words[9];
-  S9->words[2] = 0;
-  S9->words[1] = A->words[15];
-  S9->words[0] = A->words[14];
-  /* X -= S9 */
-  modp256_sub (X, X, S9);
-
-  if (bn256_is_ge (X, P256))
-    bn256_sub (X, X, P256);
-}
-
-/**
- * @brief  X = (A * B) mod p256
- */
-void
-modp256_mul (bn256 *X, const bn256 *A, const bn256 *B)
-{
-  bn512 AB[1];
-
-  bn256_mul (AB, A, B);
-  modp256_reduce (X, AB);
-}
-
-/**
- * @brief  X = A * A mod p256
- */
-void
-modp256_sqr (bn256 *X, const bn256 *A)
-{
-  bn512 AA[1];
-
-  bn256_sqr (AA, A);
-  modp256_reduce (X, AA);
-}
-
-/**
- * @brief  C = (1 / a)  mod p256
- *
- * Return -1 on error.
- * Return 0 on success.
- */
-int
-modp256_inv (bn256 *C, const bn256 *a)
-{
-  bn256 u[1], v[1];
-  bn256 A[1] = { { { 1, 0, 0, 0, 0, 0, 0, 0 } } };
-
-  if (bn256_is_zero (a))
-    return -1;
-
-  memset (C, 0, sizeof (bn256));
-  memcpy (u, a, sizeof (bn256));
-  memcpy (v, P256, sizeof (bn256));
-
-  while (!bn256_is_zero (u))
-    {
-      while (bn256_is_even (u))
-	{
-	  bn256_shift (u, u, -1);
-	  if (bn256_is_even (A))
-	    bn256_shift (A, A, -1);
-	  else
-	    {
-	      int carry = bn256_add (A, A, P256);
-
-	      bn256_shift (A, A, -1);
-	      if (carry)
-		A->words[7] |= 0x80000000;
-	    }
-	}
-
-      while (bn256_is_even (v))
-	{
-	  bn256_shift (v, v, -1);
-	  if (bn256_is_even (C))
-	    bn256_shift (C, C, -1);
-	  else
-	    {
-	      int carry = bn256_add (C, C, P256);
-
-	      bn256_shift (C, C, -1);
-	      if (carry)
-		C->words[7] |= 0x80000000;
-	    }
-	}
-
-      if (bn256_is_ge (u, v))
-	{
-	  bn256_sub (u, u, v);
-	  modp256_sub (A, A, C);
-	}
-      else
-	{
-	  bn256_sub (v, v, u);
-	  modp256_sub (C, C, A);
-	}
-    }
-
-  return 0;
-}
-
-/**
- * @brief  X = (A << shift) mod p256
- * @note   shift <= 32
- */
-void
-modp256_shift (bn256 *X, const bn256 *A, int shift)
-{
-  uint32_t carry;
-  bn256 tmp[1];
-
-  carry = bn256_shift (X, A, shift);
-  if (shift < 0)
-    return;
-
-  memset (tmp, 0, sizeof (bn256));
-  tmp->words[7] = carry;
-  tmp->words[0] = carry;
-  modp256_add (X, X, tmp);
-
-  tmp->words[7] = 0;
-  tmp->words[0] = 0;
-  tmp->words[6] = carry;
-  tmp->words[3] = carry;
-  modp256_sub (X, X, tmp);
-
-  if (bn256_is_ge (X, P256))
-    bn256_sub (X, X, P256);
-}
--- a/src/modp256.h
+++ b/src/modp256.h
@@ -1,10 +0,0 @@
-extern const bn256 p256;
-#define P256 (&p256)
-
-void modp256_add (bn256 *X, const bn256 *A, const bn256 *B);
-void modp256_sub (bn256 *X, const bn256 *A, const bn256 *B);
-void modp256_reduce (bn256 *X, const bn512 *A);
-void modp256_mul (bn256 *X, const bn256 *A, const bn256 *B);
-void modp256_sqr (bn256 *X, const bn256 *A);
-void modp256_shift (bn256 *X, const bn256 *A, int shift);
-int modp256_inv (bn256 *C, const bn256 *a);
--- a/src/modp256k1.c
+++ b/src/modp256k1.c
@@ -0,0 +1,485 @@
+/*
+ * modp256k1.c -- modulo arithmetic for p256k1
+ *
+ * Copyright (C) 2014 Free Software Initiative of Japan
+ * Author: NIIBE Yutaka <gniibe@fsij.org>
+ *
+ * This file is a part of Gnuk, a GnuPG USB Token implementation.
+ *
+ * Gnuk is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Gnuk is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/*
+ * p256k1 =  2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1
+ */
+#include <stdint.h>
+#include <string.h>
+
+#include "bn.h"
+#include "modp256k1.h"
+
+/*
+256      224      192      160      128       96       64       32        0
+2^256
+  1 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+2^256 - 2^32
+  0 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff 00000000
+2^256 - 2^32 - 2^9
+  0 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe fffffe00
+2^256 - 2^32 - 2^9 - 2^8
+  0 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe fffffd00
+2^256 - 2^32 - 2^9 - 2^8 - 2^7
+  0 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe fffffc80
+2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6
+  0 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe fffffc40
+2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4
+  0 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe fffffc30
+2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1
+  0 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe fffffc2f
+*/
+const bn256 p256k1 = { {0xfffffc2f, 0xfffffffe, 0xffffffff, 0xffffffff,
+			0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff } };
+
+/**
+ * @brief  X = (A + B) mod p256k1
+ */
+void
+modp256k1_add (bn256 *X, const bn256 *A, const bn256 *B)
+{
+  uint32_t carry;
+  bn256 tmp[1];
+
+  carry = bn256_add (X, A, B);
+  if (carry)
+    bn256_sub (X, X, P256K1);
+  else
+    bn256_sub (tmp, X, P256K1);
+}
+
+/**
+ * @brief  X = (A - B) mod p256
+ */
+void
+modp256k1_sub (bn256 *X, const bn256 *A, const bn256 *B)
+{
+  uint32_t borrow;
+  bn256 tmp[1];
+
+  borrow = bn256_sub (X, A, B);
+  if (borrow)
+    bn256_add (X, X, P256K1);
+  else
+    bn256_add (tmp, X, P256K1);
+}
+
+/**
+ * @brief  X = A mod p256k1
+ */
+void
+modp256k1_reduce (bn256 *X, const bn512 *A)
+{
+  bn256 tmp[1];
+  uint32_t carry;
+#define borrow carry
+  uint32_t s0, s1;
+#define s00 tmp->word[0]
+#define s01 tmp->word[1]
+#define s02 tmp->word[2]
+
+#define W0 X
+#define W1 tmp
+#define W2 tmp
+#define W3 tmp
+#define W4 tmp
+#define W5 tmp
+#define W6 tmp
+#define W7 tmp
+#define S  tmp
+
+  /*
+   * Suppose: P256K1 = 2^256 - CONST
+   * Then, compute: W = A_low + A_high * CONST
+   *                256-bit W0 = W mod 2^256
+   *                64-bit (S1, S0) = W / 2^256
+   * where: CONST = 2^32 + 2^9 + 2^8 + 2^7 + 2^6 + 2^4 + 1
+   */
+
+  /* W0 = A_low   */
+  /* W7 = A_high  */
+  /* W0 += W7 */
+  carry = bn256_add (W0, (const bn256 *)&A->word[8], (const bn256 *)A);
+
+  /* W6 = W7 << 4 */
+  /* W0 += W6 */
+  bn256_shift (W6, (const bn256 *)&A->word[8], 4);
+  carry += bn256_add (W0, W0, W6);
+
+  /* W5 = W6 << 2 */
+  /* W0 += W5 */
+  bn256_shift (W5, W6, 2);
+  carry += bn256_add (W0, W0, W5);
+
+  /* W4 = W5 << 1 */
+  /* W0 += W4 */
+  bn256_shift (W4, W5, 1);
+  carry += bn256_add (W0, W0, W4);
+
+  /* W3 = W4 << 1 */
+  /* W0 += W3 */
+  bn256_shift (W3, W4, 1);
+  carry += bn256_add (W0, W0, W3);
+
+  /* W2 = W3 << 1 */
+  /* W0 += W2 */
+  bn256_shift (W2, W3, 1);
+  carry += bn256_add (W0, W0, W2);
+
+  /* W1 = A_high << 32 */
+  /* W0 += W1 */
+  W1->word[7] = A->word[14];
+  W1->word[6] = A->word[13];
+  W1->word[5] = A->word[12];
+  W1->word[4] = A->word[11];
+  W1->word[3] = A->word[10];
+  W1->word[2] = A->word[9];
+  W1->word[1] = A->word[8];
+  W1->word[0] = 0;
+  carry += bn256_add (W0, W0, W1);
+
+  /* (S1, S0) = W / 2^256 */
+  s0 = A->word[15];
+  carry += (s0 >> 28) + (s0 >> 26) + (s0 >> 25) + (s0 >> 24) + (s0 >> 23);
+  carry += s0;
+  s1 = (carry < s0) ? 1 : 0;
+  s0 = carry;
+
+  /*
+   * Compute: S:=(S02, S01, S00), S = (S1,S0)*CONST
+   */
+  S->word[7] = S->word[6] = S->word[5] = S->word[4] = S->word[3] = 0;
+
+  /* (S02, S01, S00) = (S1, S0) + (S1, S0)*2^32 */ 
+  s00 = s0;
+  s01 = s0 + s1;
+  s02 = s1 + ((s01 < s0)? 1 : 0);
+
+  /* (S02, S01, S00) += (S1, S0)*2^9 */ 
+  carry = (s0 >> 23) + s01;
+  s02 += (s1 >> 23) + ((carry < s01)? 1 : 0);
+  s01 = (s1 << 9) + carry;
+  s02 += ((s01 < carry)? 1 : 0);
+  s00 += (s0 << 9);
+  carry = ((s00 < (s0 << 9))? 1 : 0);
+  s01 += carry;
+  s02 += ((s01 < carry)? 1 : 0);
+
+  /* (S02, S01, S00) += (S1, S0)*2^8 */ 
+  carry = (s0 >> 24) + s01;
+  s02 += (s1 >> 24) + ((carry < s01)? 1 : 0);
+  s01 = (s1 << 8) + carry;
+  s02 += ((s01 < carry)? 1 : 0);
+  s00 += (s0 << 8);
+  carry = ((s00 < (s0 << 8))? 1 : 0);
+  s01 += carry;
+  s02 += ((s01 < carry)? 1 : 0);
+
+  /* (S02, S01, S00) += (S1, S0)*2^7 */ 
+  carry = (s0 >> 25) + s01;
+  s02 += (s1 >> 25) + ((carry < s01)? 1 : 0);
+  s01 = (s1 << 7) + carry;
+  s02 += ((s01 < carry)? 1 : 0);
+  s00 += (s0 << 7);
+  carry = ((s00 < (s0 << 7))? 1 : 0);
+  s01 += carry;
+  s02 += ((s01 < carry)? 1 : 0);
+
+  /* (S02, S01, S00) += (S1, S0)*2^6 */ 
+  carry = (s0 >> 26) + s01;
+  s02 += (s1 >> 26) + ((carry < s01)? 1 : 0);
+  s01 = (s1 << 6) + carry;
+  s02 += ((s01 < carry)? 1 : 0);
+  s00 += (s0 << 6);
+  carry = ((s00 < (s0 << 6))? 1 : 0);
+  s01 += carry;
+  s02 += ((s01 < carry)? 1 : 0);
+
+  /* (S02, S01, S00) += (S1, S0)*2^4 */ 
+  carry = (s0 >> 28) + s01;
+  s02 += (s1 >> 28) + ((carry < s01)? 1 : 0);
+  s01 = (s1 << 4) + carry;
+  s02 += ((s01 < carry)? 1 : 0);
+  s00 += (s0 << 4);
+  carry = ((s00 < (s0 << 4))? 1 : 0);
+  s01 += carry;
+  s02 += ((s01 < carry)? 1 : 0);
+
+  /* W0 += S */
+  modp256k1_add (W0, W0, S);
+
+  borrow = bn256_sub (tmp, W0, P256K1);
+  if (borrow)
+    memcpy (tmp, W0, sizeof (bn256));
+  else
+    memcpy (W0, tmp, sizeof (bn256));
+
+#undef W0
+#undef W1
+#undef W2
+#undef W3
+#undef W4
+#undef W5
+#undef W6
+#undef W7
+#undef S
+#undef s00
+#undef s01
+#undef s02
+#undef borrow
+}
+
+/**
+ * @brief  X = (A * B) mod p256k1
+ */
+void
+modp256k1_mul (bn256 *X, const bn256 *A, const bn256 *B)
+{
+  bn512 AB[1];
+
+  bn256_mul (AB, A, B);
+  modp256k1_reduce (X, AB);
+}
+
+/**
+ * @brief  X = A * A mod p256k1
+ */
+void
+modp256k1_sqr (bn256 *X, const bn256 *A)
+{
+  bn512 AA[1];
+
+  bn256_sqr (AA, A);
+  modp256k1_reduce (X, AA);
+}
+
+/**
+ * @brief  C = (1 / a)  mod p256k1
+ *
+ * Return -1 on error.
+ * Return 0 on success.
+ */
+#define MAX_N_BITS 256
+
+int
+modp256k1_inv (bn256 *C, const bn256 *a)
+{
+  bn256 u[1], v[1], tmp[1];
+  bn256 A[1] = { { { 1, 0, 0, 0, 0, 0, 0, 0 } } };
+  uint32_t carry;
+  int n = MAX_N_BITS * 3;
+
+  if (bn256_is_zero (a))
+    return -1;
+
+  memset (C, 0, sizeof (bn256));
+  memcpy (u, a, sizeof (bn256));
+  memcpy (v, P256K1, sizeof (bn256));
+
+  while (n--)
+    {
+      int c = (bn256_is_even (u) << 1) + bn256_is_even (v);
+
+      switch (c)
+	{
+	case 3:
+	  bn256_shift (u, u, -1);
+	  if (bn256_is_even (A))
+	    {
+	      bn256_add (tmp, A, P256K1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (A, A, P256K1);
+
+	  bn256_shift (A, A, -1);
+	  A->word[7] |= carry * 0x80000000;
+
+	  bn256_shift (v, v, -1);
+	  if (bn256_is_even (C))
+	    {
+	      bn256_add (tmp, C, P256K1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (C, C, P256K1);
+
+	  bn256_shift (C, C, -1);
+	  C->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (tmp, tmp))
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256k1_sub (tmp, tmp, tmp);
+	    }
+	  else
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256k1_sub (tmp, tmp, A);
+	    }
+	  break;
+
+	case 1:
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, P256K1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, P256K1);
+
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;
+
+	  bn256_shift (v, v, -1);
+	  if (bn256_is_even (C))
+	    {
+	      bn256_add (tmp, C, P256K1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (C, C, P256K1);
+
+	  bn256_shift (C, C, -1);
+	  C->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (tmp, tmp))
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256k1_sub (tmp, tmp, tmp);
+	    }
+	  else
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256k1_sub (tmp, tmp, A);
+	    }
+	  break;
+
+	case 2:
+	  bn256_shift (u, u, -1);
+	  if (bn256_is_even (A))
+	    {
+	      bn256_add (tmp, A, P256K1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (A, A, P256K1);
+
+	  bn256_shift (A, A, -1);
+	  A->word[7] |= carry * 0x80000000;
+
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, P256K1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, P256K1);
+
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (tmp, tmp))
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256k1_sub (tmp, tmp, tmp);
+	    }
+	  else
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256k1_sub (tmp, tmp, A);
+	    }
+	  break;
+
+	case 0:
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, P256K1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, P256K1);
+
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;
+
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, P256K1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, P256K1);
+
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (u, v))
+	    {
+	      bn256_sub (u, u, v);
+	      modp256k1_sub (A, A, C);
+	    }
+	  else
+	    {
+	      bn256_sub (v, v, u);
+	      modp256k1_sub (C, C, A);
+	    }
+	  break;
+	}
+    }
+
+  return 0;
+}
+
+/**
+ * @brief  X = (A << shift) mod p256k1
+ * @note   shift <= 32
+ */
+void
+modp256k1_shift (bn256 *X, const bn256 *A, int shift)
+{
+  uint32_t carry;
+  bn256 tmp[1];
+
+  carry = bn256_shift (X, A, shift);
+  if (shift < 0)
+    return;
+
+  memset (tmp, 0, sizeof (bn256));
+  tmp->word[0] = carry + (carry << 9);
+  tmp->word[1] = carry + (tmp->word[0] < (carry << 9)) + (carry >> 23);
+  tmp->word[0] = tmp->word[0] + (carry << 8);
+  tmp->word[1] = tmp->word[1] + (tmp->word[0] < (carry << 8)) + (carry >> 24);
+  tmp->word[0] = tmp->word[0] + (carry << 7);
+  tmp->word[1] = tmp->word[1] + (tmp->word[0] < (carry << 7)) + (carry >> 25);
+  tmp->word[0] = tmp->word[0] + (carry << 6);
+  tmp->word[1] = tmp->word[1] + (tmp->word[0] < (carry << 6)) + (carry >> 26);
+  tmp->word[0] = tmp->word[0] + (carry << 4);
+  tmp->word[1] = tmp->word[1] + (tmp->word[0] < (carry << 4)) + (carry >> 28);
+
+  modp256k1_add (X, X, tmp);
+}
--- a/src/modp256k1.h
+++ b/src/modp256k1.h
@@ -0,0 +1,10 @@
+extern const bn256 p256k1;
+#define P256K1 (&p256k1)
+
+void modp256k1_add (bn256 *X, const bn256 *A, const bn256 *B);
+void modp256k1_sub (bn256 *X, const bn256 *A, const bn256 *B);
+void modp256k1_reduce (bn256 *X, const bn512 *A);
+void modp256k1_mul (bn256 *X, const bn256 *A, const bn256 *B);
+void modp256k1_sqr (bn256 *X, const bn256 *A);
+void modp256k1_shift (bn256 *X, const bn256 *A, int shift);
+int modp256k1_inv (bn256 *C, const bn256 *a);
--- a/src/modp256r1.c
+++ b/src/modp256r1.c
@@ -0,0 +1,446 @@
+/*
+ * modp256r1.c -- modulo arithmetic for p256r1
+ *
+ * Copyright (C) 2011, 2013, 2014 Free Software Initiative of Japan
+ * Author: NIIBE Yutaka <gniibe@fsij.org>
+ *
+ * This file is a part of Gnuk, a GnuPG USB Token implementation.
+ *
+ * Gnuk is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Gnuk is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/*
+ * p256 =  2^256 - 2^224 + 2^192 + 2^96 - 1
+ */
+#include <stdint.h>
+#include <string.h>
+
+#include "bn.h"
+#include "modp256r1.h"
+
+/*
+256      224      192      160      128       96       64       32        0
+2^256
+  1 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+2^256 - 2^224
+  0 ffffffff 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+2^256 - 2^224 + 2^192
+  0 ffffffff 00000001 00000000 00000000 00000000 00000000 00000000 00000000
+2^256 - 2^224 + 2^192 + 2^96
+  0 ffffffff 00000001 00000000 00000000 00000001 00000000 00000000 00000000
+2^256 - 2^224 + 2^192 + 2^96 - 1
+  0 ffffffff 00000001 00000000 00000000 00000000 ffffffff ffffffff ffffffff
+*/
+const bn256 p256r1 = { {0xffffffff, 0xffffffff, 0xffffffff, 0x00000000,
+			0x00000000, 0x00000000, 0x00000001, 0xffffffff} };
+
+/**
+ * @brief  X = (A + B) mod p256r1
+ */
+void
+modp256r1_add (bn256 *X, const bn256 *A, const bn256 *B)
+{
+  uint32_t carry;
+  bn256 tmp[1];
+
+  carry = bn256_add (X, A, B);
+  if (carry)
+    bn256_sub (X, X, P256R1);
+  else
+    bn256_sub (tmp, X, P256R1);
+}
+
+/**
+ * @brief  X = (A - B) mod p256r1
+ */
+void
+modp256r1_sub (bn256 *X, const bn256 *A, const bn256 *B)
+{
+  uint32_t borrow;
+  bn256 tmp[1];
+
+  borrow = bn256_sub (X, A, B);
+  if (borrow)
+    bn256_add (X, X, P256R1);
+  else
+    bn256_add (tmp, X, P256R1);
+}
+
+/**
+ * @brief  X = A mod p256r1
+ */
+void
+modp256r1_reduce (bn256 *X, const bn512 *A)
+{
+  bn256 tmp[1];
+  uint32_t borrow;
+
+#define S1 X
+#define S2 tmp
+#define S3 tmp
+#define S4 tmp
+#define S5 tmp
+#define S6 tmp
+#define S7 tmp
+#define S8 tmp
+#define S9 tmp
+
+  S1->word[7] = A->word[7];
+  S1->word[6] = A->word[6];
+  S1->word[5] = A->word[5];
+  S1->word[4] = A->word[4];
+  S1->word[3] = A->word[3];
+  S1->word[2] = A->word[2];
+  S1->word[1] = A->word[1];
+  S1->word[0] = A->word[0];
+  /* X = S1 */
+
+  S2->word[7] = A->word[15];
+  S2->word[6] = A->word[14];
+  S2->word[5] = A->word[13];
+  S2->word[4] = A->word[12];
+  S2->word[3] = A->word[11];
+  S2->word[2] = S2->word[1] = S2->word[0] = 0;
+  /* X += 2 * S2 */
+  modp256r1_add (X, X, S2);
+  modp256r1_add (X, X, S2);
+
+  S3->word[7] = 0;
+  S3->word[6] = A->word[15];
+  S3->word[5] = A->word[14];
+  S3->word[4] = A->word[13];
+  S3->word[3] = A->word[12];
+  S3->word[2] = S3->word[1] = S3->word[0] = 0;
+  /* X += 2 * S3 */
+  modp256r1_add (X, X, S3);
+  modp256r1_add (X, X, S3);
+
+  S4->word[7] = A->word[15];
+  S4->word[6] = A->word[14];
+  S4->word[5] = S4->word[4] = S4->word[3] = 0;
+  S4->word[2] = A->word[10];
+  S4->word[1] = A->word[9];
+  S4->word[0] = A->word[8];
+  /* X += S4 */
+  modp256r1_add (X, X, S4);
+
+  S5->word[7] = A->word[8];
+  S5->word[6] = A->word[13];
+  S5->word[5] = A->word[15];
+  S5->word[4] = A->word[14];
+  S5->word[3] = A->word[13];
+  S5->word[2] = A->word[11];
+  S5->word[1] = A->word[10];
+  S5->word[0] = A->word[9];
+  /* X += S5 */
+  modp256r1_add (X, X, S5);
+
+  S6->word[7] = A->word[10];
+  S6->word[6] = A->word[8];
+  S6->word[5] = S6->word[4] = S6->word[3] = 0;
+  S6->word[2] = A->word[13];
+  S6->word[1] = A->word[12];
+  S6->word[0] = A->word[11];
+  /* X -= S6 */
+  modp256r1_sub (X, X, S6);
+
+  S7->word[7] = A->word[11];
+  S7->word[6] = A->word[9];
+  S7->word[5] = S7->word[4] = 0;
+  S7->word[3] = A->word[15];
+  S7->word[2] = A->word[14];
+  S7->word[1] = A->word[13];
+  S7->word[0] = A->word[12];
+  /* X -= S7 */
+  modp256r1_sub (X, X, S7);
+
+  S8->word[7] = A->word[12];
+  S8->word[6] = 0;
+  S8->word[5] = A->word[10];
+  S8->word[4] = A->word[9];
+  S8->word[3] = A->word[8];
+  S8->word[2] = A->word[15];
+  S8->word[1] = A->word[14];
+  S8->word[0] = A->word[13];
+  /* X -= S8 */
+  modp256r1_sub (X, X, S8);
+
+  S9->word[7] = A->word[13];
+  S9->word[6] = 0;
+  S9->word[5] = A->word[11];
+  S9->word[4] = A->word[10];
+  S9->word[3] = A->word[9];
+  S9->word[2] = 0;
+  S9->word[1] = A->word[15];
+  S9->word[0] = A->word[14];
+  /* X -= S9 */
+  modp256r1_sub (X, X, S9);
+
+  borrow = bn256_sub (tmp, X, P256R1);
+  if (borrow)
+    memcpy (tmp, X, sizeof (bn256));
+  else
+    memcpy (X, tmp, sizeof (bn256));
+
+#undef S1
+#undef S2
+#undef S3
+#undef S4
+#undef S5
+#undef S6
+#undef S7
+#undef S8
+#undef S9
+}
+
+/**
+ * @brief  X = (A * B) mod p256r1
+ */
+void
+modp256r1_mul (bn256 *X, const bn256 *A, const bn256 *B)
+{
+  bn512 AB[1];
+
+  bn256_mul (AB, A, B);
+  modp256r1_reduce (X, AB);
+}
+
+/**
+ * @brief  X = A * A mod p256r1
+ */
+void
+modp256r1_sqr (bn256 *X, const bn256 *A)
+{
+  bn512 AA[1];
+
+  bn256_sqr (AA, A);
+  modp256r1_reduce (X, AA);
+}
+
+/**
+ * @brief  C = (1 / a)  mod p256r1
+ *
+ * Return -1 on error.
+ * Return 0 on success.
+ */
+#define MAX_N_BITS 256
+
+int
+modp256r1_inv (bn256 *C, const bn256 *a)
+{
+  bn256 u[1], v[1], tmp[1];
+  bn256 A[1] = { { { 1, 0, 0, 0, 0, 0, 0, 0 } } };
+  uint32_t carry;
+  int n = MAX_N_BITS * 3;
+
+  if (bn256_is_zero (a))
+    return -1;
+
+  memset (C, 0, sizeof (bn256));
+  memcpy (u, a, sizeof (bn256));
+  memcpy (v, P256R1, sizeof (bn256));
+
+  while (n--)
+    {
+      int c = (bn256_is_even (u) << 1) + bn256_is_even (v);
+
+      switch (c)
+	{
+	case 3:
+	  bn256_shift (u, u, -1);
+	  if (bn256_is_even (A))
+	    {
+	      bn256_add (tmp, A, P256R1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (A, A, P256R1);
+
+	  bn256_shift (A, A, -1);
+	  A->word[7] |= carry * 0x80000000;
+
+	  bn256_shift (v, v, -1);
+	  if (bn256_is_even (C))
+	    {
+	      bn256_add (tmp, C, P256R1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (C, C, P256R1);
+
+	  bn256_shift (C, C, -1);
+	  C->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (tmp, tmp))
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256r1_sub (tmp, tmp, tmp);
+	    }
+	  else
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256r1_sub (tmp, tmp, A);
+	    }
+	  break;
+
+	case 1:
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, P256R1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, P256R1);
+
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;
+
+	  bn256_shift (v, v, -1);
+	  if (bn256_is_even (C))
+	    {
+	      bn256_add (tmp, C, P256R1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (C, C, P256R1);
+
+	  bn256_shift (C, C, -1);
+	  C->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (tmp, tmp))
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256r1_sub (tmp, tmp, tmp);
+	    }
+	  else
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256r1_sub (tmp, tmp, A);
+	    }
+	  break;
+
+	case 2:
+	  bn256_shift (u, u, -1);
+	  if (bn256_is_even (A))
+	    {
+	      bn256_add (tmp, A, P256R1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (A, A, P256R1);
+
+	  bn256_shift (A, A, -1);
+	  A->word[7] |= carry * 0x80000000;
+
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, P256R1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, P256R1);
+
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (tmp, tmp))
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256r1_sub (tmp, tmp, tmp);
+	    }
+	  else
+	    {
+	      bn256_sub (tmp, tmp, tmp);
+	      modp256r1_sub (tmp, tmp, A);
+	    }
+	  break;
+
+	case 0:
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, P256R1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, P256R1);
+
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;
+
+	  bn256_shift (tmp, tmp, -1);
+	  if (bn256_is_even (tmp))
+	    {
+	      bn256_add (tmp, tmp, P256R1);
+	      carry = 0;
+	    }
+	  else
+	    carry = bn256_add (tmp, tmp, P256R1);
+
+	  bn256_shift (tmp, tmp, -1);
+	  tmp->word[7] |= carry * 0x80000000;
+
+	  if (bn256_is_ge (u, v))
+	    {
+	      bn256_sub (u, u, v);
+	      modp256r1_sub (A, A, C);
+	    }
+	  else
+	    {
+	      bn256_sub (v, v, u);
+	      modp256r1_sub (C, C, A);
+	    }
+	  break;
+	}
+    }
+
+  return 0;
+}
+
+/**
+ * @brief  X = (A << shift) mod p256r1
+ * @note   shift <= 32
+ */
+void
+modp256r1_shift (bn256 *X, const bn256 *A, int shift)
+{
+  uint32_t carry;
+#define borrow carry
+  bn256 tmp[1];
+
+  carry = bn256_shift (X, A, shift);
+  if (shift < 0)
+    return;
+
+  memset (tmp, 0, sizeof (bn256));
+  tmp->word[7] = carry;
+  tmp->word[0] = carry;
+  modp256r1_add (X, X, tmp);
+
+  tmp->word[7] = 0;
+  tmp->word[0] = 0;
+  tmp->word[6] = carry;
+  tmp->word[3] = carry;
+  modp256r1_sub (X, X, tmp);
+
+  borrow = bn256_sub (tmp, X, P256R1);
+  if (borrow)
+    memcpy (tmp, X, sizeof (bn256));
+  else
+    memcpy (X, tmp, sizeof (bn256));
+#undef borrow
+}
--- a/src/modp256r1.h
+++ b/src/modp256r1.h
@@ -0,0 +1,10 @@
+extern const bn256 p256r1;
+#define P256R1 (&p256r1)
+
+void modp256r1_add (bn256 *X, const bn256 *A, const bn256 *B);
+void modp256r1_sub (bn256 *X, const bn256 *A, const bn256 *B);
+void modp256r1_reduce (bn256 *X, const bn512 *A);
+void modp256r1_mul (bn256 *X, const bn256 *A, const bn256 *B);
+void modp256r1_sqr (bn256 *X, const bn256 *A);
+void modp256r1_shift (bn256 *X, const bn256 *A, int shift);
+int modp256r1_inv (bn256 *C, const bn256 *a);
--- a/src/muladd_256.h
+++ b/src/muladd_256.h
@@ -0,0 +1,47 @@
+#define MULADD_256(s_,d_,w_,c_)   do {                   \
+ asm ( "ldmia  %[s]!, { r8, r9, r10 } \n\t"              \
+       "ldmia  %[d], { r5, r6, r7 }   \n\t"              \
+       "umull  r4, r8, %[w], r8       \n\t"              \
+       "adds   r5, r5, r4             \n\t"              \
+       "adcs   r6, r6, r8             \n\t"              \
+       "umull  r4, r8, %[w], r9       \n\t"              \
+       "adc    %[c], r8, #0           \n\t"              \
+       "adds   r6, r6, r4             \n\t"              \
+       "adcs   r7, r7, %[c]           \n\t"              \
+       "umull  r4, r8, %[w], r10      \n\t"              \
+       "adc    %[c], r8, #0           \n\t"              \
+       "adds   r7, r7, r4             \n\t"              \
+       "stmia  %[d]!, { r5, r6, r7 }  \n\t"              \
+       "ldmia  %[s]!, { r8, r9, r10 } \n\t"              \
+       "ldmia  %[d], { r5, r6, r7 }   \n\t"              \
+       "adcs   r5, r5, %[c]           \n\t"              \
+       "umull  r4, r8, %[w], r8       \n\t"              \
+       "adc    %[c], r8, #0           \n\t"              \
+       "adds   r5, r5, r4             \n\t"              \
+       "adcs   r6, r6, %[c]           \n\t"              \
+       "umull  r4, r8, %[w], r9       \n\t"              \
+       "adc    %[c], r8, #0           \n\t"              \
+       "adds   r6, r6, r4             \n\t"              \
+       "adcs   r7, r7, %[c]           \n\t"              \
+       "umull  r4, r8, %[w], r10      \n\t"              \
+       "adc    %[c], r8, #0           \n\t"              \
+       "adds   r7, r7, r4             \n\t"              \
+       "stmia  %[d]!, { r5, r6, r7 }  \n\t"              \
+       "ldmia  %[s]!, { r8, r9 }      \n\t"              \
+       "ldmia  %[d], { r5, r6 }       \n\t"              \
+       "adcs   r5, r5, %[c]           \n\t"              \
+       "umull  r4, r8, %[w], r8       \n\t"              \
+       "adc    %[c], r8, #0           \n\t"              \
+       "adds   r5, r5, r4             \n\t"              \
+       "adcs   r6, r6, %[c]           \n\t"              \
+       "umull  r4, r8, %[w], r9       \n\t"              \
+       "adc    %[c], r8, #0           \n\t"              \
+       "adds   r6, r6, r4             \n\t"              \
+       "adc    %[c], %[c], #0         \n\t"              \
+       "stmia  %[d]!, { r5, r6 }"                        \
+       : [s] "=&r" (s_), [d] "=&r" (d_), [c] "=&r" (c_)  \
+       : "[s]" (s_), "[d]" (d_), [w] "r" (w_)            \
+       : "r4", "r5", "r6", "r7", "r8", "r9", "r10",      \
+         "memory", "cc" );                               \
+  *d_ = c_;                                              \
+} while (0)
--- a/src/openpgp-do.c
+++ b/src/openpgp-do.c
@@ -1,7 +1,7 @@
 /*
 * openpgp-do.c -- OpenPGP card Data Objects (DO) handling
 *
- * Copyright (C) 2010, 2011, 2012, 2013 
+ * Copyright (C) 2010, 2011, 2012, 2013, 2014
 *               Free Software Initiative of Japan
 * Author: NIIBE Yutaka <gniibe@fsij.org>
 *
@@ -142,12 +142,18 @@ static const uint8_t algorithm_attr_rsa[] __attribute__ ((aligned (1))) = {
  0x00		      /* 0: p&q , 3: CRT with N (not yet supported) */
 };

-static const uint8_t algorithm_attr_ecdsa[] __attribute__ ((aligned (1))) = {
+static const uint8_t algorithm_attr_p256r1[] __attribute__ ((aligned (1))) = {
  9,
  0x13, /* ECDSA */
  0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 /* OID of NIST curve P-256 */
 };

+static const uint8_t algorithm_attr_p256k1[] __attribute__ ((aligned (1))) = {
+  6,
+  0x13, /* ECDSA */
+  0x2b, 0x81, 0x04, 0x00, 0x0a /* OID of curve secp256k1 */
+};
+
 /*
 * Representation of PW1_LIFETIME:
 *    0: PW1_LIEFTIME_P == NULL : PW1 is valid for single PSO:CDS command
@@ -805,10 +811,21 @@ gpg_do_write_prvkey (enum kind_of_key kk, const uint8_t *key_data, int key_len,
  /* Delete it first, if any.  */
  gpg_do_delete_prvkey (kk);

-#ifdef RSA_AUTH
+#if defined(RSA_AUTH) && defined(RSA_SIG)
  if (key_len != KEY_CONTENT_LEN)
     return -1;
-#else /* ECDSA for authentication */
+#elif defined(RSA_AUTH) && !defined(RSA_SIG)
+  /* ECDSA with p256k1 for signature */
+  if (kk != GPG_KEY_FOR_SIGNING && key_len != KEY_CONTENT_LEN)
+    return -1;
+  if (kk == GPG_KEY_FOR_SIGNING)
+    {
+      pubkey_len = key_len * 2;
+      if (key_len != 32)
+	return -1;
+    }
+#elif !defined(RSA_AUTH) && defined(RSA_SIG)
+  /* ECDSA with p256r1 for authentication */
  if (kk != GPG_KEY_FOR_AUTHENTICATION && key_len != KEY_CONTENT_LEN)
    return -1;
  if (kk == GPG_KEY_FOR_AUTHENTICATION)
@@ -817,6 +834,8 @@ gpg_do_write_prvkey (enum kind_of_key kk, const uint8_t *key_data, int key_len,
      if (key_len != 32)
 	return -1;
    }
+#else
+#error "not supported."
 #endif

  pd = (struct prvkey_data *)malloc (sizeof (struct prvkey_data));
@@ -825,13 +844,22 @@ gpg_do_write_prvkey (enum kind_of_key kk, const uint8_t *key_data, int key_len,

  if (pubkey == NULL)
    {
-#ifdef RSA_AUTH
+#if defined(RSA_AUTH) && defined(RSA_SIG)
      pubkey_allocated_here = modulus_calc (key_data, key_len);
-#else /* ECDSA for authentication */
-      if (kk == GPG_KEY_FOR_AUTHENTICATION)
-	pubkey_allocated_here = ecdsa_compute_public (key_data);
+#elif defined(RSA_AUTH) && !defined(RSA_SIG)
+      /* ECDSA with p256k1 for signature */
+      if (kk == GPG_KEY_FOR_SIGNING)
+	pubkey_allocated_here = ecdsa_compute_public_p256k1 (key_data);
      else
 	pubkey_allocated_here = modulus_calc (key_data, key_len);
+#elif !defined(RSA_AUTH) && defined(RSA_SIG)
+      /* ECDSA with p256r1 for authentication */
+      if (kk == GPG_KEY_FOR_AUTHENTICATION)
+	pubkey_allocated_here = ecdsa_compute_public_p256r1 (key_data);
+      else
+	pubkey_allocated_here = modulus_calc (key_data, key_len);
+#else
+#error "not supported."
 #endif
      if (pubkey_allocated_here == NULL)
 	{
@@ -858,9 +886,19 @@ gpg_do_write_prvkey (enum kind_of_key kk, const uint8_t *key_data, int key_len,
  DEBUG_INFO ("key_addr: ");
  DEBUG_WORD ((uint32_t)key_addr);

-#ifdef RSA_AUTH
+#if defined(RSA_AUTH) && defined(RSA_SIG)
  memcpy (kdi.data, key_data, KEY_CONTENT_LEN);
-#else /* ECDSA for authentication */
+#elif defined(RSA_AUTH) && !defined(RSA_SIG)
+  /* ECDSA with p256k1 for signature */
+  if (kk == GPG_KEY_FOR_SIGNING)
+    {
+      memcpy (kdi.data, key_data, key_len);
+      memset ((uint8_t *)kdi.data + key_len, 0, KEY_CONTENT_LEN - key_len);
+    }
+  else
+    memcpy (kdi.data, key_data, KEY_CONTENT_LEN);
+#elif !defined(RSA_AUTH) && defined(RSA_SIG)
+ /* ECDSA with p256r1 for authentication */
  if (kk == GPG_KEY_FOR_AUTHENTICATION)
    {
      memcpy (kdi.data, key_data, key_len);
@@ -868,6 +906,8 @@ gpg_do_write_prvkey (enum kind_of_key kk, const uint8_t *key_data, int key_len,
    }
  else
    memcpy (kdi.data, key_data, KEY_CONTENT_LEN);
+#else
+#error "not supported."
 #endif
  compute_key_data_checksum (&kdi, 0);

@@ -1021,9 +1061,9 @@ gpg_do_chks_prvkey (enum kind_of_key kk,
 * 4d, xx, xx, xx:    Extended Header List
 *   b6 00 (SIG) / b8 00 (DEC) / a4 00 (AUT)
 *   7f48, xx: cardholder private key template
- *       91 xx: length of E
- *       92 xx xx: length of P
- *       93 xx xx: length of Q
+ *       91 L<E>: L<E>:  91=tag of E, L<E>: length of E
+ *       92 Lh<P> Ll<P>: 92=tag of P, L<P>: length of P
+ *       93 Lh<Q> Ll<Q>: 93=tag of Q, L<Q>: length of Q
 *   5f48, xx xx xx: cardholder private key
 * <E: 4-byte>, <P: 128-byte>, <Q: 128-byte>
 *
@@ -1031,9 +1071,9 @@ gpg_do_chks_prvkey (enum kind_of_key kk,
 * 4d, xx:    Extended Header List
 *   a4 00 (AUT)
 *   7f48, xx: cardholder private key template
- *       91 xx: length of d
+ *       9x LEN: 9x=tag of private key d,  LEN=length of d
 *   5f48, xx : cardholder private key
- * <d>
+ * <d> (in the format of: 04 || X || Y )
 */
 static int
 proc_key_import (const uint8_t *data, int len)
@@ -1076,20 +1116,38 @@ proc_key_import (const uint8_t *data, int len)
      ac_reset_other ();
    }

-#ifdef RSA_AUTH
+#if defined(RSA_AUTH) && defined(RSA_SIG)
  if (len <= 22)
-#else /* ECDSA for authentication */
+#elif defined(RSA_AUTH) && !defined(RSA_SIG)
+  /* ECDSA with p256k1 for signature */
+  if ((kk != GPG_KEY_FOR_SIGNING && len <= 22)
+      || (kk == GPG_KEY_FOR_SIGNING && len <= 12))
+#elif !defined(RSA_AUTH) && defined(RSA_SIG)
+  /* ECDSA with p256r1 for authentication */
  if ((kk != GPG_KEY_FOR_AUTHENTICATION && len <= 22)
      || (kk == GPG_KEY_FOR_AUTHENTICATION && len <= 12))
+#else
+#error "not supported."
 #endif
    {					    /* Deletion of the key */
      gpg_do_delete_prvkey (kk);
      return 1;
    }

-#ifdef RSA_AUTH
+#if defined(RSA_AUTH) && defined(RSA_SIG)
  r = gpg_do_write_prvkey (kk, &data[26], len - 26, keystring_admin, NULL);
-#else /* ECDSA for authentication */
+#elif defined(RSA_AUTH) && !defined(RSA_SIG)
+  /* ECDSA with p256k1 for signature */
+  if (kk != GPG_KEY_FOR_SIGNING)
+    {			   /* RSA */
+      /* It should starts with 00 01 00 01 (E) */
+      /* Skip E, 4-byte */
+      r = gpg_do_write_prvkey (kk, &data[26], len - 26, keystring_admin, NULL);
+    }
+  else
+    r = gpg_do_write_prvkey (kk, &data[12], len - 12, keystring_admin, NULL);
+#elif !defined(RSA_AUTH) && defined(RSA_SIG)
+  /* ECDSA with p256r1 for authentication */
  if (kk != GPG_KEY_FOR_AUTHENTICATION)
    {			   /* RSA */
      /* It should starts with 00 01 00 01 (E) */
@@ -1098,6 +1156,8 @@ proc_key_import (const uint8_t *data, int len)
    }
  else
    r = gpg_do_write_prvkey (kk, &data[12], len - 12, keystring_admin, NULL);
+#else
+#error "not supported."
 #endif

  if (r < 0)
@@ -1161,12 +1221,16 @@ gpg_do_table[] = {
    rw_pw_status },
  /* Fixed data */
  { GPG_DO_EXTCAP, DO_FIXED, AC_ALWAYS, AC_NEVER, extended_capabilities },
+#ifdef RSA_SIG
  { GPG_DO_ALG_SIG, DO_FIXED, AC_ALWAYS, AC_NEVER, algorithm_attr_rsa },
+#else
+  { GPG_DO_ALG_SIG, DO_FIXED, AC_ALWAYS, AC_NEVER, algorithm_attr_p256k1 },
+#endif
  { GPG_DO_ALG_DEC, DO_FIXED, AC_ALWAYS, AC_NEVER, algorithm_attr_rsa },
 #ifdef RSA_AUTH
  { GPG_DO_ALG_AUT, DO_FIXED, AC_ALWAYS, AC_NEVER, algorithm_attr_rsa },
 #else
-  { GPG_DO_ALG_AUT, DO_FIXED, AC_ALWAYS, AC_NEVER, algorithm_attr_ecdsa },
+  { GPG_DO_ALG_AUT, DO_FIXED, AC_ALWAYS, AC_NEVER, algorithm_attr_p256r1 },
 #endif
  /* Compound data: Read access only */
  { GPG_DO_CH_DATA, DO_CMP_READ, AC_ALWAYS, AC_NEVER, cmp_ch_data },
@@ -1610,27 +1674,30 @@ gpg_do_public_key (uint8_t kk_byte)
  /* TAG */
  *res_p++ = 0x7f; *res_p++ = 0x49;

-#ifndef RSA_AUTH /* ECDSA for authentication */
+#if defined(RSA_AUTH) && defined(RSA_SIG)
+  if (0)
+#elif defined(RSA_AUTH) && !defined(RSA_SIG)
+  /* ECDSA with p256k1 for signature */
+  if (kk_byte == 0xb6)
+#elif !defined(RSA_AUTH) && defined(RSA_SIG)
+  /* ECDSA with p256r1 for authentication */
  if (kk_byte == 0xa4)
+#else
+#error "not supported."
+#endif
    {				/* ECDSA */
      /* LEN */
-      *res_p++ = 2 + 8 + 2 + 1 + 64;
+      *res_p++ = 2 + 1 + 64;
      {
-	/*TAG*/          /* LEN = 8 */
-	*res_p++ = 0x06; *res_p++ = 0x08;
-	memcpy (res_p, algorithm_attr_ecdsa+2, 8);
-	res_p += 8;
-
 	/*TAG*/          /* LEN = 1+64 */
 	*res_p++ = 0x86; *res_p++ = 0x41;
 	*res_p++ = 0x04; 	/* No compression of EC point.  */
-	/* 64-byte binary (big endian) */
+	/* 64-byte binary (big endian): X || Y */
 	memcpy (res_p, key_addr + KEY_CONTENT_LEN, 64);
 	res_p += 64;
      }
    }
  else
-#endif
    {				/* RSA */
      /* LEN = 9+256 */
      *res_p++ = 0x82; *res_p++ = 0x01; *res_p++ = 0x09;
--- a/src/openpgp.c
+++ b/src/openpgp.c
@@ -1,7 +1,7 @@
 /*
 * openpgp.c -- OpenPGP card protocol support
 *
- * Copyright (C) 2010, 2011, 2012, 2013
+ * Copyright (C) 2010, 2011, 2012, 2013, 2014
 *               Free Software Initiative of Japan
 * Author: NIIBE Yutaka <gniibe@fsij.org>
 *
@@ -805,6 +805,9 @@ cmd_get_data (void)
  gpg_do_get_data (tag, 0);
 }

+#define ECDSA_HASH_LEN 32
+#define ECDSA_SIGNATURE_LENGTH 64
+
 static void
 cmd_pso (void)
 {
@@ -824,6 +827,7 @@ cmd_pso (void)
 	  return;
 	}

+#ifdef RSA_SIG
      /* Check size of digestInfo */
      if (len != 34		/* MD5 */
 	  && len != 35		/* SHA1 / RIPEMD-160 */
@@ -852,6 +856,30 @@ cmd_pso (void)
 	    /* Success */
 	    gpg_increment_digital_signature_counter ();
 	}
+#else
+      /* ECDSA with p256k1 for signature */
+      if (len != ECDSA_HASH_LEN)
+	{
+	  DEBUG_INFO (" wrong length: ");
+	  GPG_CONDITION_NOT_SATISFIED ();
+	}
+      else
+	{
+	  DEBUG_SHORT (len);
+
+	  res_APDU_size = ECDSA_SIGNATURE_LENGTH;
+	  r = ecdsa_sign_p256k1 (apdu.cmd_apdu_data, res_APDU,
+				 kd[GPG_KEY_FOR_SIGNING].data);
+	  if (r < 0)
+	    {
+	      ac_reset_pso_cds ();
+	      GPG_ERROR ();
+	    }
+	  else
+	    /* Success */
+	    gpg_increment_digital_signature_counter ();
+	}
+#endif
    }
  else if (P1 (apdu) == 0x80 && P2 (apdu) == 0x86)
    {
@@ -935,9 +963,6 @@ cmd_internal_authenticate (void)
  DEBUG_INFO ("INTERNAL AUTHENTICATE done.\r\n");
 }
 #else
-#define ECDSA_P256_HASH_LEN 32
-#define ECDSA_SIGNATURE_LENGTH 64
-
 static void
 cmd_internal_authenticate (void)
 {
@@ -957,7 +982,7 @@ cmd_internal_authenticate (void)
 	  return;
 	}

-      if (len != ECDSA_P256_HASH_LEN)
+      if (len != ECDSA_HASH_LEN)
 	{
 	  DEBUG_INFO ("wrong hash length.");
 	  GPG_CONDITION_NOT_SATISFIED ();
@@ -965,8 +990,8 @@ cmd_internal_authenticate (void)
 	}

      res_APDU_size = ECDSA_SIGNATURE_LENGTH;
-      r = ecdsa_sign (apdu.cmd_apdu_data, res_APDU,
-		      &kd[GPG_KEY_FOR_AUTHENTICATION]);
+      r = ecdsa_sign_p256r1 (apdu.cmd_apdu_data, res_APDU,
+			     kd[GPG_KEY_FOR_AUTHENTICATION].data);
      if (r < 0)
 	GPG_ERROR ();
    }
--- a/src/sha256.c
+++ b/src/sha256.c
@@ -52,13 +52,17 @@

 #define SHA256_MASK (SHA256_BLOCK_SIZE - 1)

-static void memcpy_bswap32 (void *dst, const uint32_t *p, int n)
+static void memcpy_output_bswap32 (unsigned char *dst, const uint32_t *p)
 {
-  uint32_t *q = (uint32_t *)dst;
+  int i;
+  uint32_t q = 0;

-  n >>= 2;
-  while (n--)
-    q[n] = __builtin_bswap32 (p[n]); /* bswap32 is GCC extention */
+  for (i = 0; i < 32; i++)
+    {
+      if ((i & 3) == 0)
+	q = __builtin_bswap32 (p[i >> 2]); /* bswap32 is GCC extention */
+      dst[i] = q >> ((i & 3) * 8);
+    }
 }

 #define rotr32(x,n)   (((x) >> n) | ((x) << (32 - n)))
@@ -193,11 +197,11 @@ sha256_finish (sha256_context *ctx, unsigned char output[32])
  ctx->wbuf[15] = __builtin_bswap32 (ctx->total[0] << 3);
  sha256_process (ctx);

-  memcpy_bswap32 (output, ctx->state, SHA256_DIGEST_SIZE);
+  memcpy_output_bswap32 (output, ctx->state);
  memset (ctx, 0, sizeof (sha256_context));
 }

-const uint32_t initial_state[8] =
+static const uint32_t initial_state[8] =
 {
  0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
  0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
--- a/src/sha512.c
+++ b/src/sha512.c
@@ -0,0 +1,216 @@
+/*
+ * sha512.c -- Compute SHA-512 hash (for little endian architecture).
+ *
+ * This module is written by gniibe, following the API of sha256.c. 
+ *
+ * Copyright (C) 2014 Free Software Initiative of Japan
+ * Author: NIIBE Yutaka <gniibe@fsij.org>
+ *
+ * This file is a part of Gnuk, a GnuPG USB Token implementation.
+ *
+ * Gnuk is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Gnuk is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/*
+ * Reference:
+ *
+ * [1] FIPS PUB 180-4: Secure hash Standard (SHS), March, 2012.
+ *
+ */
+
+#include <string.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include "sha512.h"
+
+#define SHA512_MASK (SHA512_BLOCK_SIZE - 1)
+
+static void memcpy_output_bswap64 (unsigned char dst[64], const uint64_t *p)
+{
+  int i;
+  uint64_t q = 0;
+
+  for (i = 0; i < 64; i++)
+    {
+      if ((i & 7) == 0)
+	q = __builtin_bswap64 (p[i >> 3]); /* bswap64 is GCC extention */
+      dst[i] = q >> ((i & 7) * 8);
+    }
+}
+
+#define rotr64(x,n)   (((x) >> n) | ((x) << (64 - n)))
+
+#define ch(x,y,z)       ((z) ^ ((x) & ((y) ^ (z))))
+#define maj(x,y,z)      (((x) & (y)) | ((z) & ((x) ^ (y))))
+
+/* round transforms for SHA512 compression functions */
+#define vf(n,i) v[(n - i) & 7]
+
+#define hf(i) (p[i & 15] += \
+    g_1(p[(i + 14) & 15]) + p[(i + 9) & 15] + g_0(p[(i + 1) & 15]))
+
+#define v_cycle0(i)                                 \
+    p[i] = __builtin_bswap64 (p[i]);                \
+    vf(7,i) += p[i] + k_0[i]                        \
+    + s_1(vf(4,i)) + ch(vf(4,i),vf(5,i),vf(6,i));   \
+    vf(3,i) += vf(7,i);                             \
+    vf(7,i) += s_0(vf(0,i))+ maj(vf(0,i),vf(1,i),vf(2,i))
+
+#define v_cycle(i, j)                               \
+    vf(7,i) += hf(i) + k_0[i+j]                     \
+    + s_1(vf(4,i)) + ch(vf(4,i),vf(5,i),vf(6,i));   \
+    vf(3,i) += vf(7,i);                             \
+    vf(7,i) += s_0(vf(0,i))+ maj(vf(0,i),vf(1,i),vf(2,i))
+
+#define s_0(x)  (rotr64((x), 28) ^ rotr64((x), 34) ^ rotr64((x), 39))
+#define s_1(x)  (rotr64((x), 14) ^ rotr64((x), 18) ^ rotr64((x), 41))
+#define g_0(x)  (rotr64((x),  1) ^ rotr64((x),  8) ^ ((x) >>  7))
+#define g_1(x)  (rotr64((x), 19) ^ rotr64((x), 61) ^ ((x) >>  6))
+#define k_0     k512
+
+/* Taken from section 4.2.3 of [1].  */
+static const uint64_t k512[80] = {
+0x428a2f98d728ae22, 0x7137449123ef65cd, 0xb5c0fbcfec4d3b2f, 0xe9b5dba58189dbbc,
+0x3956c25bf348b538, 0x59f111f1b605d019, 0x923f82a4af194f9b, 0xab1c5ed5da6d8118,
+0xd807aa98a3030242, 0x12835b0145706fbe, 0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2,
+0x72be5d74f27b896f, 0x80deb1fe3b1696b1, 0x9bdc06a725c71235, 0xc19bf174cf692694,
+0xe49b69c19ef14ad2, 0xefbe4786384f25e3, 0x0fc19dc68b8cd5b5, 0x240ca1cc77ac9c65,
+0x2de92c6f592b0275, 0x4a7484aa6ea6e483, 0x5cb0a9dcbd41fbd4, 0x76f988da831153b5,
+0x983e5152ee66dfab, 0xa831c66d2db43210, 0xb00327c898fb213f, 0xbf597fc7beef0ee4,
+0xc6e00bf33da88fc2, 0xd5a79147930aa725, 0x06ca6351e003826f, 0x142929670a0e6e70,
+0x27b70a8546d22ffc, 0x2e1b21385c26c926, 0x4d2c6dfc5ac42aed, 0x53380d139d95b3df,
+0x650a73548baf63de, 0x766a0abb3c77b2a8, 0x81c2c92e47edaee6, 0x92722c851482353b,
+0xa2bfe8a14cf10364, 0xa81a664bbc423001, 0xc24b8b70d0f89791, 0xc76c51a30654be30,
+0xd192e819d6ef5218, 0xd69906245565a910, 0xf40e35855771202a, 0x106aa07032bbd1b8,
+0x19a4c116b8d2d0c8, 0x1e376c085141ab53, 0x2748774cdf8eeb99, 0x34b0bcb5e19b48a8,
+0x391c0cb3c5c95a63, 0x4ed8aa4ae3418acb, 0x5b9cca4f7763e373, 0x682e6ff3d6b2b8a3,
+0x748f82ee5defb2fc, 0x78a5636f43172f60, 0x84c87814a1f0ab72, 0x8cc702081a6439ec,
+0x90befffa23631e28, 0xa4506cebde82bde9, 0xbef9a3f7b2c67915, 0xc67178f2e372532b,
+0xca273eceea26619c, 0xd186b8c721c0c207, 0xeada7dd6cde0eb1e, 0xf57d4f7fee6ed178,
+0x06f067aa72176fba, 0x0a637dc5a2c898a6, 0x113f9804bef90dae, 0x1b710b35131c471b,
+0x28db77f523047d84, 0x32caab7b40c72493, 0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c,
+0x4cc5d4becb3e42b6, 0x597f299cfc657e2a, 0x5fcb6fab3ad6faec, 0x6c44198c4a475817
+};
+
+void
+sha512_process (sha512_context *ctx)
+{
+  uint32_t i;
+  uint64_t *p = ctx->wbuf;
+  uint64_t v[8];
+
+  memcpy (v, ctx->state, 8 * sizeof (uint64_t));
+
+  v_cycle0 ( 0); v_cycle0 ( 1); v_cycle0 ( 2); v_cycle0 ( 3);
+  v_cycle0 ( 4); v_cycle0 ( 5); v_cycle0 ( 6); v_cycle0 ( 7);
+  v_cycle0 ( 8); v_cycle0 ( 9); v_cycle0 (10); v_cycle0 (11);
+  v_cycle0 (12); v_cycle0 (13); v_cycle0 (14); v_cycle0 (15);
+
+  for (i = 16; i < 80; i += 16)
+    {
+      v_cycle ( 0, i); v_cycle ( 1, i); v_cycle ( 2, i); v_cycle ( 3, i);
+      v_cycle ( 4, i); v_cycle ( 5, i); v_cycle ( 6, i); v_cycle ( 7, i);
+      v_cycle ( 8, i); v_cycle ( 9, i); v_cycle (10, i); v_cycle (11, i);
+      v_cycle (12, i); v_cycle (13, i); v_cycle (14, i); v_cycle (15, i);
+    }
+
+  ctx->state[0] += v[0];
+  ctx->state[1] += v[1];
+  ctx->state[2] += v[2];
+  ctx->state[3] += v[3];
+  ctx->state[4] += v[4];
+  ctx->state[5] += v[5];
+  ctx->state[6] += v[6];
+  ctx->state[7] += v[7];
+}
+
+void
+sha512_update (sha512_context *ctx, const unsigned char *input,
+               unsigned int ilen)
+{
+  uint32_t left = (ctx->total[0] & SHA512_MASK);
+  uint32_t fill = SHA512_BLOCK_SIZE - left;
+
+  ctx->total[0] += ilen;
+  if (ctx->total[0] < ilen)
+    ctx->total[1]++;
+
+  while (ilen >= fill)
+    {
+      memcpy (((unsigned char*)ctx->wbuf) + left, input, fill);
+      sha512_process (ctx);
+      input += fill;
+      ilen -= fill;
+      left = 0;
+      fill = SHA512_BLOCK_SIZE;
+    }
+
+  memcpy (((unsigned char*)ctx->wbuf) + left, input, ilen);
+}
+
+void
+sha512_finish (sha512_context *ctx, unsigned char output[64])
+{
+  uint32_t last = (ctx->total[0] & SHA512_MASK);
+
+  ctx->wbuf[last >> 3] = __builtin_bswap64 (ctx->wbuf[last >> 3]);
+  ctx->wbuf[last >> 3] &= 0xffffffffffffff80LL << (8 * (~last & 7));
+  ctx->wbuf[last >> 3] |= 0x0000000000000080LL << (8 * (~last & 7));
+  ctx->wbuf[last >> 3] = __builtin_bswap64 (ctx->wbuf[last >> 3]);
+
+  if (last > SHA512_BLOCK_SIZE - 17)
+    {
+      if (last < 120)
+        ctx->wbuf[15] = 0;
+      sha512_process (ctx);
+      last = 0;
+    }
+  else
+    last = (last >> 3) + 1;
+
+  while (last < 14)
+    ctx->wbuf[last++] = 0;
+
+  ctx->wbuf[14] = __builtin_bswap64 ((ctx->total[0] >> 61) | (ctx->total[1] << 3));
+  ctx->wbuf[15] = __builtin_bswap64 (ctx->total[0] << 3);
+  sha512_process (ctx);
+
+  memcpy_output_bswap64 (output, ctx->state);
+  memset (ctx, 0, sizeof (sha512_context));
+}
+
+/* Taken from section 5.3.5 of [1].  */
+static const uint64_t initial_state[8] = {
+0x6a09e667f3bcc908, 0xbb67ae8584caa73b, 0x3c6ef372fe94f82b, 0xa54ff53a5f1d36f1,
+0x510e527fade682d1, 0x9b05688c2b3e6c1f, 0x1f83d9abfb41bd6b, 0x5be0cd19137e2179
+};
+
+void
+sha512_start (sha512_context *ctx)
+{
+  ctx->total[0] = ctx->total[1] = 0;
+  memcpy (ctx->state, initial_state, 8 * sizeof(uint64_t));
+}
+
+void
+sha512 (const unsigned char *input, unsigned int ilen,
+        unsigned char output[64])
+{
+  sha512_context ctx;
+
+  sha512_start (&ctx);
+  sha512_update (&ctx, input, ilen);
+  sha512_finish (&ctx, output);
+}
--- a/src/sha512.h
+++ b/src/sha512.h
@@ -0,0 +1,17 @@
+#define SHA512_DIGEST_SIZE  64
+#define SHA512_BLOCK_SIZE   128
+
+typedef struct
+{
+  uint64_t total[2];
+  uint64_t state[8];
+  uint64_t wbuf[16];
+} sha512_context;
+
+void sha512 (const unsigned char *input, unsigned int ilen,
+	     unsigned char output[64]);
+void sha512_start (sha512_context *ctx);
+void sha512_finish (sha512_context *ctx, unsigned char output[64]);
+void sha512_update (sha512_context *ctx, const unsigned char *input,
+		    unsigned int ilen);
+void sha512_process (sha512_context *ctx);
--- a/tool/calc_precompute_table_ecc.py
+++ b/tool/calc_precompute_table_ecc.py
@@ -0,0 +1,28 @@
+from ecdsa import curves, ecdsa
+G = ecdsa.generator_secp256k1
+# G = ecdsa.generator_256
+
+def print_nG(n):
+   nG = n*G
+   nGx_str = "%064x" % nG.x()
+   nGy_str = "%064x" % nG.y()
+   print256(nGx_str)
+   print256(nGy_str)
+   print
+
+def print256(s):
+   print("0x%s, 0x%s, 0x%s, 0x%s," % (s[56:64], s[48:56], s[40:48], s[32:40]))
+   print("0x%s, 0x%s, 0x%s, 0x%s" %  (s[24:32], s[16:24], s[8:16], s[0:8]))
+   print
+
+
+for i in range(1,16):
+  n = (i & 1) + (i & 2) * 0x8000000000000000L + (i & 4) * 0x40000000000000000000000000000000L + (i & 8) * 0x200000000000000000000000000000000000000000000000L
+  print "%064x" % n
+  print_nG(n)
+
+for i in range(1,16):
+  n = (i & 1) + (i & 2) * 0x8000000000000000L + (i & 4) * 0x40000000000000000000000000000000L + (i & 8) * 0x200000000000000000000000000000000000000000000000L
+  n = n * 0x100000000L
+  print "%064x" % n
+  print_nG(n)
--- a/tool/dfuse.py
+++ b/tool/dfuse.py
@@ -111,7 +111,7 @@ class DFU_STM32(object):
        self.__devhandle = device.open()
        self.__devhandle.setConfiguration(configuration)
        self.__devhandle.claimInterface(interface)
-        self.__devhandle.setAltInterface(interface)
+        self.__devhandle.setAltInterface(0)

        self.__intf = interface.interfaceNumber
        self.__alt = interface.alternateSetting
--- a/tool/gnuk_token.py
+++ b/tool/gnuk_token.py
@@ -73,7 +73,7 @@ class gnuk_token(object):
        except:
            pass
        self.__devhandle.claimInterface(interface)
-        self.__devhandle.setAltInterface(interface)
+        self.__devhandle.setAltInterface(0)

        self.__intf = interface.interfaceNumber
        self.__alt = interface.alternateSetting
@@ -481,7 +481,7 @@ class regnual(object):
        except:
            pass
        self.__devhandle.claimInterface(intf)
-        self.__devhandle.setAltInterface(intf)
+        self.__devhandle.setAltInterface(0)

    def mem_info(self):
        mem = self.__devhandle.controlMsg(requestType = 0xc0, request = 0,
--- a/tool/gnuk_upgrade.py
+++ b/tool/gnuk_upgrade.py
@@ -59,7 +59,7 @@ class regnual(object):
        except:
            pass
        self.__devhandle.claimInterface(intf)
-        self.__devhandle.setAltInterface(intf)
+        self.__devhandle.setAltInterface(0)

    def mem_info(self):
        mem = self.__devhandle.controlMsg(requestType = 0xc0, request = 0,
@@ -172,7 +172,7 @@ class gnuk_token(object):
        except:
            pass
        self.__devhandle.claimInterface(interface)
-        self.__devhandle.setAltInterface(interface)
+        self.__devhandle.setAltInterface(0)

        self.__intf = interface.interfaceNumber
        self.__alt = interface.alternateSetting
--- a/tool/stlinkv2.py
+++ b/tool/stlinkv2.py
@@ -146,7 +146,7 @@ class stlinkv2(object):
        except:
            pass
        self.__devhandle.claimInterface(intf)
-        # self.__devhandle.setAltInterface(intf)  # This is not good for libusb-win32
+        # self.__devhandle.setAltInterface(0)  # This was not good for libusb-win32 with wrong arg intf, new correct value 0 would be OK

    def shutdown(self):
        self.__devhandle.releaseInterface()
--- a/tool/upgrade_by_passwd.py
+++ b/tool/upgrade_by_passwd.py
@@ -94,7 +94,6 @@ if __name__ == '__main__':

    passwd = DEFAULT_PW3
    keyno = 0
-    print sys.argv
    while len(sys.argv) > 3:
        option = sys.argv[1]
        sys.argv.pop(1)
Author	SHA1	Message	Date
NIIBE Yutaka	fb8cb58c5c	version 1.1.2	2014-03-07 15:43:05 +09:00
NIIBE Yutaka	db2187835c	don't put OID for public key info.	2014-02-25 11:06:11 +09:00
NIIBE Yutaka	653868c00b	fix configure for certdo	2014-02-25 09:25:49 +09:00
NIIBE Yutaka	ede98fbe7e	bug fixes for secp256k1	2014-02-21 17:24:19 +09:00
NIIBE Yutaka	2accc339e2	fix modp256k1_shift	2014-02-21 11:36:15 +09:00
NIIBE Yutaka	9feeeb308b	Add RSA_SIG (disable to use p256k1)	2014-02-20 12:02:44 +09:00
NIIBE Yutaka	01806c2e5e	authentication with ecdsa p256r1	2014-02-20 10:58:51 +09:00
NIIBE Yutaka	a32f577dfa	add call-ec_p256k1	2014-02-20 10:55:20 +09:00
NIIBE Yutaka	deaf340687	add ec_p256k1	2014-02-19 14:51:09 +09:00
NIIBE Yutaka	f5e8e94bf7	fix ec_p256r1	2014-02-19 11:36:27 +09:00
NIIBE Yutaka	df4e8c5481	Use CPP for jpc_p256[kr]1	2014-02-18 15:54:28 +09:00
NIIBE Yutaka	888eb2aa31	minor fix	2014-02-18 14:07:25 +09:00
NIIBE Yutaka	1436223320	sha256 bug fix	2014-02-18 14:01:57 +09:00
NIIBE Yutaka	13a52a0862	minor fixes	2014-02-18 14:01:34 +09:00
NIIBE Yutaka	ea73e1ee7e	bugfic for modp256k1	2014-02-18 14:01:04 +09:00
NIIBE Yutaka	8ca0416be8	Add modp256k1.[ch]	2014-02-18 12:07:33 +09:00
NIIBE Yutaka	d42eba5cb0	Use P256R1	2014-02-18 11:00:28 +09:00
NIIBE Yutaka	60820f5a5f	name change p256 -> p256r1	2014-02-17 13:49:35 +09:00
NIIBE Yutaka	2c8f1cb0ce	sha improvement	2014-02-05 16:33:21 +09:00
NIIBE Yutaka	2e80472f1c	Add sha512	2014-02-05 16:20:26 +09:00
NIIBE Yutaka	8f60b1568f	fix sha256	2014-02-05 13:33:58 +09:00
NIIBE Yutaka	91ca2d9827	Assembler MUL/SQR	2014-01-28 11:31:52 +09:00
NIIBE Yutaka	6d2f9f8df1	bug fix for compute_kP	2014-01-28 09:59:26 +09:00
NIIBE Yutaka	42251eea8e	Fix for constant time: compute_kP (for ECDH in future)	2014-01-27 16:27:51 +09:00
NIIBE Yutaka	fc5df5019f	clean up	2014-01-27 11:26:58 +09:00
NIIBE Yutaka	e18df3af6b	clean up	2014-01-27 11:17:10 +09:00
NIIBE Yutaka	4b65ed1a5b	simplify compute_kP	2014-01-24 16:16:41 +09:00
NIIBE Yutaka	f4e10311c7	Fix for constant time (step 10): ECDSA done	2014-01-24 14:49:38 +09:00
NIIBE Yutaka	78ffb4179e	Fix for constant time (step 9)	2014-01-24 11:05:49 +09:00
NIIBE Yutaka	36541838f9	bug fix	2014-01-23 14:59:55 +09:00
NIIBE Yutaka	29e76d0ba7	cosmetic change	2014-01-22 16:57:19 +09:00
NIIBE Yutaka	c29bd10555	bug fix	2014-01-22 15:53:13 +09:00
NIIBE Yutaka	5c01e92c20	bug fix for ecdsa	2014-01-22 14:34:46 +09:00
NIIBE Yutaka	94508ae5d9	Fix for constant time (step 8)	2014-01-22 14:33:40 +09:00
NIIBE Yutaka	251760d5da	Fix for constant time (step 7)	2014-01-22 14:26:41 +09:00
NIIBE Yutaka	6a69c31c3b	Fix for constant time (step 6)	2014-01-22 14:09:55 +09:00
NIIBE Yutaka	486f20bfd4	more fix on ecc	2014-01-22 10:02:08 +09:00
NIIBE Yutaka	8d05addc87	bug fix for inf check	2014-01-22 09:58:59 +09:00
NIIBE Yutaka	9f0e2eabd1	bug fix for mod.c change	2014-01-21 21:02:03 +09:00
NIIBE Yutaka	f21a89588c	Fix for constant time (step 5)	2014-01-21 14:40:58 +09:00
NIIBE Yutaka	af66c5fa08	format	2014-01-21 14:26:31 +09:00
NIIBE Yutaka	0e7078bacb	Fix for constant time (step 4)	2014-01-21 14:14:39 +09:00
NIIBE Yutaka	df8434db59	Fix for constant time (step 3)	2014-01-21 13:58:01 +09:00
NIIBE Yutaka	80d935d913	Fix for constant time (step 2)	2014-01-21 13:31:23 +09:00
NIIBE Yutaka	007eada502	Fix for constant time (step 1)	2014-01-21 13:25:30 +09:00
NIIBE Yutaka	3bb3c6e9d8	member name change	2014-01-21 13:07:20 +09:00
NIIBE Yutaka	4f154cc61d	add fe25519	2014-01-20 16:14:10 +09:00
NIIBE Yutaka	38f8b91335	bn.c: constant time	2014-01-15 22:05:18 +09:00
NIIBE Yutaka	b35765d58b	version 1.1.1	2013-12-25 13:05:43 +09:00
NIIBE Yutaka	932e6acd40	Support PyUSB 1.0, too	2013-12-25 11:33:00 +09:00
NIIBE Yutaka	62863d52b2	more minor change for bignum	2013-12-25 10:04:10 +09:00
NIIBE Yutaka	26db39b1b7	don't use r10	2013-12-24 21:21:44 +09:00
NIIBE Yutaka	1774563184	use r12 and more tweak	2013-12-24 20:50:21 +09:00
NIIBE Yutaka	a89ae40e89	improve a bit	2013-12-24 15:21:07 +09:00
NIIBE Yutaka	4427227284	more tweak	2013-12-24 13:46:22 +09:00
NIIBE Yutaka	141d345cfe	more improvement of mpi_montsqr and multiply.	2013-12-24 12:22:54 +09:00
NIIBE Yutaka	cc7221e5cb	merge	2013-12-23 17:55:46 +09:00
NIIBE Yutaka	34fe062548	more tweak of API	2013-12-23 17:51:04 +09:00
NIIBE Yutaka	72e67d81a3	more tweak of API	2013-12-23 16:42:53 +09:00
NIIBE Yutaka	e8896ecb4d	mpi_exp_mod: Use stack instead of malloc	2013-12-23 16:17:20 +09:00
NIIBE Yutaka	cce282b3d7	more constant-time computation	2013-12-23 10:13:04 +09:00