bend-osdev-gf
Releases (3)
Definitions (522)
check.bend
- def show
- def tab.countThe table path against the reference over every pair of bytes (and every inverse): the number of disagreements.
- def tab.row
- def tab.all
- def tab.inv
- def tab.snd
- def tab.check
- def gcm_h
- def gcm_c
- def main
gf.bend
- type Gf8Field
- def Gf8.aesAES (FIPS 197): x^8 + x^4 + x^3 + x + 1 (0x11B), generator x + 1 (3)
- def Gf8.rsReed-Solomon and RAID-6: x^8 + x^4 + x^3 + x^2 + 1 (0x11D), generator x (2)
- def Gf8.raid6
- def Gf8.poly
- def Gf8.gen
- type Gf8Bits
- def Gf8Bits.ofthe low 8 bits of a
- def Gf8Bits.to
- def Gf8Bits.zero
- def Gf8Bits.xor
- def Gf8Bits.sela if t, else zero
- def Gf8Bits.xa times x, where p holds the low 8 bits of the polynomial: shift up one place, and if the coefficient of x^8 was set, add p (x^8 = p in the field)
- def Gf8Bits.stepone step of Horner's rule: x * acc + t * b
- def Gf8Bits.hornerHorner's rule over the bits ts, most significant first
- def Gf8Bits.topthe bits of a, most significant first
- def Gf8Bits.mul
- def Gf8.eltthe element a: its low 8 bits
- def Gf8Bits.is_zerowhether a is the zero element (its low 8 bits are all 0)
- def Gf8.is_zero
- def Gf8.add
- def Gf8.subsubtraction is addition in characteristic 2
- def Gf8.mul
- def Gf8.xtimea times x (FIPS 197's xtime)
- def Gf8.powa^n, with a^0 = 1 (also for a = 0)
- def Gf8.invthe inverse a^254 (a^255 = 1 for a nonzero); the inverse of 0 is 0, as in the AES S-box
- def Gf8.diva / b = a * b^-1 (and a / 0 = 0)
- def Gf8.expgen^i
- def Gf8.log.gothe least i with gen^i = a (searching i = 0 to 254); 0 for a = 0, or when gen does not generate a
- def Gf8.log
gf128.bend
- type Gf128
- type Gf128Error
- def Gf128.zero
- def Gf128.of_words
- def Gf128.words
- def Gf128.xor
- def Gf128.is_eq
- def gf128.word
- def gf128.of_list.go
- def gf128.of_list.pick
- def Gf128.of_octetsthe block of 16 bytes (any other length is refused)
- def Gf128.to_octets
- def Gf128.hex
- def gf128.maskall ones if the low bit of b is set, else 0
- def Gf128.and_mask
- def Gf128.mul_x_gcmGCM's order: shift right one bit; bit 127 falling off adds 0xE1 to byte 0
- def Gf128.double_bebig-endian (CMAC's doubling, LRW): shift left one bit; a carry adds 0x87 to byte 15
- def gf128.le.shifteach byte of w shifted left, with the carries between w's own bytes
- def gf128.le.carrythe carry out of w's last byte, into the first byte of the next word
- def Gf128.double_le
- def gf128.gcm.bit
- def gf128.gcm.wordthe 32 bits of the word x, from its top bit
- def gf128.fst
- def Gf128.mul_gcm
- def Gf128.ghash_updateGHASH (SP 800-38D, 6.4): Y = (Y + X_i) * H for each block X_i
- def Gf128.ghash.go
- def Gf128.ghash
- def gf128.be.word
- def Gf128.mul_be
gfm.bend
- type GfmField
- def Gfm.gf16x^4 + x + 1
- def Gfm.gf32x^5 + x^2 + 1
- def Gfm.bch13x^13 + x^4 + x^3 + x + 1 (0x201B), for BCH over 8191-bit codewords
- def Gfm.bch14x^14 + x^10 + x^6 + x + 1 (0x4443)
- def Gfm.m
- def Gfm.mask2^m - 1, and the number of nonzero elements
- def Gfm.elt
- def Gfm.add
- def gfm.maskall ones if the low bit of b is set, else 0
- def gfm.xa * x for a below 2^m: shift, and reduce if x^m appeared
PROOF.bend
- def fixm_nz
- def inv16.s
- def inv16.bits
- def inv16.core
- def inv16.lift
- def inv32.s1
- def inv32.s0
- def inv32.bits
- def inv32.core
- def inv32.lift
- def tl.zero_la product with a factor whose table zero test is true is 0
- def tl.mul_elt
- def tl.nzboth factors nonzero: the exp table's entry at log a + log b is the product, for a field f whose log list l gives log a and log b
- def tl.nzpickboth factors nonzero: the table's product, through its three reads
- def tl.loga logarithm through the table
- def tl.expan exponential through the table
- def tl.pickthe product through the table, by whether each factor is zero
- def tl.mula product through the table
- def tl.hl8_aes
- def tl.hl8_rs