module edwards25519

import sync

struct BasepointTablePrecomp {
mut:
    table    []AffineLookupTable
    initonce sync.Once
}

// basepoint_table is a set of 32 affineLookupTables, where table i is generated
// from 256i * basepoint. It is precomputed the first time it's used.
fn basepoint_table() []AffineLookupTable {
    mut bpt := &BasepointTablePrecomp{
        table:    []AffineLookupTable{len: 32}
        initonce: sync.new_once()
    }

    // replaced to use do_with_param on newest sync lib
    /*
    bpt.initonce.do(fn [mut bpt] () {
        mut p := new_generator_point()
        for i := 0; i < 32; i++ {
            bpt.table[i].from_p3(p)
            for j := 0; j < 8; j++ {
                p.add(p, p)
            }
        }
    })*/
    bpt.initonce.do_with_param(fn (mut o BasepointTablePrecomp) {
        mut p := new_generator_point()
        for i := 0; i < 32; i++ {
            o.table[i].from_p3(p)
            for j := 0; j < 8; j++ {
                p.add(p, p)
            }
        }
    }, bpt)
    return bpt.table
}

// scalar_base_mult sets v = x * B, where B is the canonical generator, and
// returns v.
//
// The scalar multiplication is done in constant time.
pub fn (mut v Point) scalar_base_mult(mut x Scalar) Point {
    mut bpt_table := basepoint_table()

    // Write x = sum(x_i * 16^i) so  x*B = sum( B*x_i*16^i )
    // as described in the Ed25519 paper
    //
    // Group even and odd coefficients
    // x*B     = x_0*16^0*B + x_2*16^2*B + ... + x_62*16^62*B
    //         + x_1*16^1*B + x_3*16^3*B + ... + x_63*16^63*B
    // x*B     = x_0*16^0*B + x_2*16^2*B + ... + x_62*16^62*B
    //    + 16*( x_1*16^0*B + x_3*16^2*B + ... + x_63*16^62*B)
    //
    // We use a lookup table for each i to get x_i*16^(2*i)*B
    // and do four doublings to multiply by 16.
    digits := x.signed_radix16()

    mut multiple := AffineCached{}
    mut tmp1 := ProjectiveP1{}
    mut tmp2 := ProjectiveP2{}

    // Accumulate the odd components first
    v.set(new_identity_point())
    for i := 1; i < 64; i += 2 {
        bpt_table[i / 2].select_into(mut multiple, digits[i])
        tmp1.add_affine(v, multiple)
        v.from_p1(tmp1)
    }

    // Multiply by 16
    tmp2.from_p3(v) // tmp2 =    v in P2 coords
    tmp1.double(tmp2) // tmp1 =  2*v in P1xP1 coords
    tmp2.from_p1(tmp1) // tmp2 =  2*v in P2 coords
    tmp1.double(tmp2) // tmp1 =  4*v in P1xP1 coords
    tmp2.from_p1(tmp1) // tmp2 =  4*v in P2 coords
    tmp1.double(tmp2) // tmp1 =  8*v in P1xP1 coords
    tmp2.from_p1(tmp1) // tmp2 =  8*v in P2 coords
    tmp1.double(tmp2) // tmp1 = 16*v in P1xP1 coords
    v.from_p1(tmp1) // now v = 16*(odd components)

    // Accumulate the even components
    for j := 0; j < 64; j += 2 {
        bpt_table[j / 2].select_into(mut multiple, digits[j])
        tmp1.add_affine(v, multiple)
        v.from_p1(tmp1)
    }

    return v
}

// scalar_mult sets v = x * q, and returns v.
//
// The scalar multiplication is done in constant time.
pub fn (mut v Point) scalar_mult(mut x Scalar, q Point) Point {
    check_initialized(q)

    mut table := ProjLookupTable{}
    table.from_p3(q)

    // Write x = sum(x_i * 16^i)
    // so  x*Q = sum( Q*x_i*16^i )
    //         = Q*x_0 + 16*(Q*x_1 + 16*( ... + Q*x_63) ... )
    //           <------compute inside out---------
    //
    // We use the lookup table to get the x_i*Q values
    // and do four doublings to compute 16*Q
    digits := x.signed_radix16()

    // Unwrap first loop iteration to save computing 16*identity
    mut multiple := ProjectiveCached{}
    mut tmp1 := ProjectiveP1{}
    mut tmp2 := ProjectiveP2{}
    table.select_into(mut multiple, digits[63])

    v.set(new_identity_point())
    tmp1.add(v, multiple) // tmp1 = x_63*Q in P1xP1 coords
    for i := 62; i >= 0; i-- {
        tmp2.from_p1(tmp1) // tmp2 =    (prev) in P2 coords
        tmp1.double(tmp2) // tmp1 =  2*(prev) in P1xP1 coords
        tmp2.from_p1(tmp1) // tmp2 =  2*(prev) in P2 coords
        tmp1.double(tmp2) // tmp1 =  4*(prev) in P1xP1 coords
        tmp2.from_p1(tmp1) // tmp2 =  4*(prev) in P2 coords
        tmp1.double(tmp2) // tmp1 =  8*(prev) in P1xP1 coords
        tmp2.from_p1(tmp1) // tmp2 =  8*(prev) in P2 coords
        tmp1.double(tmp2) // tmp1 = 16*(prev) in P1xP1 coords
        v.from_p1(tmp1) //    v = 16*(prev) in P3 coords
        table.select_into(mut multiple, digits[i])
        tmp1.add(v, multiple) // tmp1 = x_i*Q + 16*(prev) in P1xP1 coords
    }
    v.from_p1(tmp1)
    return v
}

struct BasepointNaftablePrecomp {
mut:
    table    NafLookupTable8
    initonce sync.Once
}

fn basepoint_naf_table() NafLookupTable8 {
    mut bnft := &BasepointNaftablePrecomp{}
    bnft.initonce.do_with_param(fn (mut o BasepointNaftablePrecomp) {
        o.table.from_p3(new_generator_point())
    }, bnft)
    return bnft.table
}

// vartime_double_scalar_base_mult sets v = a * A + b * B, where B is the canonical
// generator, and returns v.
//
// Execution time depends on the inputs.
pub fn (mut v Point) vartime_double_scalar_base_mult(xa Scalar, aa Point, xb Scalar) Point {
    check_initialized(aa)

    // Similarly to the single variable-base approach, we compute
    // digits and use them with a lookup table.  However, because
    // we are allowed to do variable-time operations, we don't
    // need constant-time lookups or constant-time digit
    // computations.
    //
    // So we use a non-adjacent form of some width w instead of
    // radix 16.  This is like a binary representation (one digit
    // for each binary place) but we allow the digits to grow in
    // magnitude up to 2^{w-1} so that the nonzero digits are as
    // sparse as possible.  Intuitively, this "condenses" the
    // "mass" of the scalar onto sparse coefficients (meaning
    // fewer additions).

    mut bp_naftable := basepoint_naf_table()
    mut atable := NafLookupTable5{}
    atable.from_p3(aa)
    // Because the basepoint is fixed, we can use a wider NAF
    // corresponding to a bigger table.
    mut a := xa
    mut b := xb
    anaf := a.non_adjacent_form(5)
    bnaf := b.non_adjacent_form(8)

    // Find the first nonzero coefficient.
    mut i := 255
    for j := i; j >= 0; j-- {
        if anaf[j] != 0 || bnaf[j] != 0 {
            break
        }
    }

    mut multa := ProjectiveCached{}
    mut multb := AffineCached{}
    mut tmp1 := ProjectiveP1{}
    mut tmp2 := ProjectiveP2{}
    tmp2.zero()

    // Move from high to low bits, doubling the accumulator
    // at each iteration and checking whether there is a nonzero
    // coefficient to look up a multiple of.
    for ; i >= 0; i-- {
        tmp1.double(tmp2)

        // Only update v if we have a nonzero coeff to add in.
        if anaf[i] > 0 {
            v.from_p1(tmp1)
            atable.select_into(mut multa, anaf[i])
            tmp1.add(v, multa)
        } else if anaf[i] < 0 {
            v.from_p1(tmp1)
            atable.select_into(mut multa, -anaf[i])
            tmp1.sub(v, multa)
        }

        if bnaf[i] > 0 {
            v.from_p1(tmp1)
            bp_naftable.select_into(mut multb, bnaf[i])
            tmp1.add_affine(v, multb)
        } else if bnaf[i] < 0 {
            v.from_p1(tmp1)
            bp_naftable.select_into(mut multb, -bnaf[i])
            tmp1.sub_affine(v, multb)
        }

        tmp2.from_p1(tmp1)
    }

    v.from_p2(tmp2)
    return v
}