8208648: ECC Field Arithmetic Enhancements

Summary: internal library enhancements to support ECC implementatation
Reviewed-by: jnimeh, andrew
Contributed-by: NDavid Alvarez <alvdavi@amazon.com>

src/share/classes/sun/security/util/ArrayUtil.java

+/*
+ * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package sun.security.util;
+
+/**
+ * This class holds the various utility methods for array range checks.
+ */
+
+public final class ArrayUtil {
+
+    private static void swap(byte[] arr, int i, int j) {
+        byte tmp = arr[i];
+        arr[i] = arr[j];
+        arr[j] = tmp;
+    }
+
+    public static void reverse(byte [] arr) {
+        int i = 0;
+        int j = arr.length - 1;
+
+        while (i < j) {
+            swap(arr, i, j);
+            i++;
+            j--;
+        }
+    }
+}
+

src/share/classes/sun/security/util/math/MutableIntegerModuloP.java

@@ -40,6 +40,18 @@ import java.nio.ByteBuffer;
 
 public interface MutableIntegerModuloP extends IntegerModuloP {
 
+    /**
+     * Set this value to the value of b when set has the value 1.
+     * No change is made to this element when set has the value 0. The
+     * result is undefined when set has a value other than 0 or 1. The set
+     * parameter is an int (rather than boolean) to allow the implementation
+     * to perform the assignment using branch-free integer arithmetic.
+     *
+     * @param b the element to conditionally swap with
+     * @param set an int that determines whether to set
+     */
+    void conditionalSet(IntegerModuloP b, int set);
+
     /**
      * Swap the value of this with the value of b when swap has the value 1.
      * No change is made to either element when swap has the value 0. The
@@ -131,5 +143,20 @@ public interface MutableIntegerModuloP extends IntegerModuloP {
      * @return this
      */
     MutableIntegerModuloP setProduct(SmallValue v);
+
+    /**
+     * Set the value of this element equal to 0 - this.
+     *
+     * @return this
+     */
+    MutableIntegerModuloP setAdditiveInverse();
+
+    /**
+     * Some implementations required reduction operations to be requested
+     * by the client at certain times. This method reduces the representation.
+     *
+     * @return this
+     */
+    MutableIntegerModuloP setReduced();
 }
 

src/share/classes/sun/security/util/math/intpoly/IntegerPolynomial.java

@@ -69,14 +69,25 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
     private final BigInteger modulus;
     protected final int bitsPerLimb;
     private final long[] posModLimbs;
+    private final int maxAdds;
+
+    /**
+     * Reduce an IntegerPolynomial representation (a) and store the result
+     * in a. Requires that a.length == numLimbs.
+     */
+    protected abstract void reduce(long[] a);
 
     /**
      * Multiply an IntegerPolynomial representation (a) with a long (b) and
-     * store the result in an IntegerPolynomial representation (r). Requires
-     * that a.length == r.length == numLimbs. It is allowed for a and r to be
-     * the same array.
+     * store the result in an IntegerPolynomial representation in a. Requires
+     * that a.length == numLimbs.
      */
-    protected abstract void multByInt(long[] a, long b, long[] r);
+    protected void multByInt(long[] a, long b) {
+        for (int i = 0; i < a.length; i++) {
+            a[i] *= b;
+        }
+        reduce(a);
+    }
 
     /**
      * Multiply two IntegerPolynomial representations (a and b) and store the
@@ -96,12 +107,14 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
 
     IntegerPolynomial(int bitsPerLimb,
                       int numLimbs,
+                      int maxAdds,
                       BigInteger modulus) {
 
 
         this.numLimbs = numLimbs;
         this.modulus = modulus;
         this.bitsPerLimb = bitsPerLimb;
+        this.maxAdds = maxAdds;
 
         posModLimbs = setPosModLimbs();
     }
@@ -116,6 +129,10 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
         return numLimbs;
     }
 
+    public int getMaxAdds() {
+        return maxAdds;
+    }
+
     @Override
     public BigInteger getSize() {
         return modulus;
@@ -155,12 +172,22 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
      */
     protected void encode(ByteBuffer buf, int length, byte highByte,
                           long[] result) {
+
         int numHighBits = 32 - Integer.numberOfLeadingZeros(highByte);
         int numBits = 8 * length + numHighBits;
-        int maxBits = bitsPerLimb * result.length;
-        if (numBits > maxBits) {
-            throw new ArithmeticException("Value is too large.");
+        int requiredLimbs = (numBits + bitsPerLimb - 1) / bitsPerLimb;
+        if (requiredLimbs > numLimbs) {
+            long[] temp = new long[requiredLimbs];
+            encodeSmall(buf, length, highByte, temp);
+            // encode does a full carry/reduce
+            System.arraycopy(temp, 0, result, 0, result.length);
+        } else {
+            encodeSmall(buf, length, highByte, result);
         }
+    }
+
+    protected void encodeSmall(ByteBuffer buf, int length, byte highByte,
+                               long[] result) {
 
         int limbIndex = 0;
         long curLimbValue = 0;
@@ -195,10 +222,10 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
             }
         }
 
-        if (limbIndex < numLimbs) {
+        if (limbIndex < result.length) {
             result[limbIndex++] = curLimbValue;
         }
-        Arrays.fill(result, limbIndex, numLimbs, 0);
+        Arrays.fill(result, limbIndex, result.length, 0);
 
         postEncodeCarry(result);
     }
@@ -211,8 +238,10 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
         encode(buf, length, highByte, result);
     }
 
+    // Encode does not produce compressed limbs. A simplified carry/reduce
+    // operation can be used to compress the limbs.
     protected void postEncodeCarry(long[] v) {
-        carry(v);
+        reduce(v);
     }
 
     public ImmutableElement getElement(byte[] v, int offset, int length,
@@ -222,7 +251,7 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
 
         encode(v, offset, length, highByte, result);
 
-        return new ImmutableElement(result, true);
+        return new ImmutableElement(result, 0);
     }
 
     protected BigInteger evaluate(long[] limbs) {
@@ -386,6 +415,20 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
         }
     }
 
+    /**
+     * Branch-free conditional assignment of b to a. Requires that set is 0 or
+     * 1, and that a.length == b.length. If set==0, then the values of a and b
+     * will be unchanged. If set==1, then the values of b will be assigned to a.
+     * The behavior is undefined if swap has any value other than 0 or 1.
+     */
+    protected static void conditionalAssign(int set, long[] a, long[] b) {
+        int maskValue = 0 - set;
+        for (int i = 0; i < a.length; i++) {
+            long dummyLimbs = maskValue & (a[i] ^ b[i]);
+            a[i] = dummyLimbs ^ a[i];
+        }
+    }
+
     /**
      * Branch-free conditional swap of a and b. Requires that swap is 0 or 1,
      * and that a.length == b.length. If swap==0, then the values of a and b
@@ -442,7 +485,7 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
     private abstract class Element implements IntegerModuloP {
 
         protected long[] limbs;
-        protected boolean summand = false;
+        protected int numAdds;
 
         public Element(BigInteger v) {
             limbs = new long[numLimbs];
@@ -450,19 +493,19 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
         }
 
         public Element(boolean v) {
-            limbs = new long[numLimbs];
-            limbs[0] = v ? 1l : 0l;
-            summand = true;
+            this.limbs = new long[numLimbs];
+            this.limbs[0] = v ? 1l : 0l;
+            this.numAdds = 0;
         }
 
-        private Element(long[] limbs, boolean summand) {
+        private Element(long[] limbs, int numAdds) {
             this.limbs = limbs;
-            this.summand = summand;
+            this.numAdds = numAdds;
         }
 
         private void setValue(BigInteger v) {
             setLimbsValue(v, limbs);
-            summand = true;
+            this.numAdds = 0;
         }
 
         @Override
@@ -477,14 +520,18 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
 
         @Override
         public MutableElement mutable() {
-            return new MutableElement(limbs.clone(), summand);
+            return new MutableElement(limbs.clone(), numAdds);
+        }
+
+        protected boolean isSummand() {
+            return numAdds < maxAdds;
         }
 
         @Override
         public ImmutableElement add(IntegerModuloP genB) {
 
             Element b = (Element) genB;
-            if (!(summand && b.summand)) {
+            if (!(isSummand() && b.isSummand())) {
                 throw new ArithmeticException("Not a valid summand");
             }
 
@@ -493,7 +540,8 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
                 newLimbs[i] = limbs[i] + b.limbs[i];
             }
 
-            return new ImmutableElement(newLimbs, false);
+            int newNumAdds = Math.max(numAdds, b.numAdds) + 1;
+            return new ImmutableElement(newLimbs, newNumAdds);
         }
 
         @Override
@@ -504,7 +552,7 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
                 newLimbs[i] = -limbs[i];
             }
 
-            ImmutableElement result = new ImmutableElement(newLimbs, summand);
+            ImmutableElement result = new ImmutableElement(newLimbs, numAdds);
             return result;
         }
 
@@ -524,43 +572,52 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
 
             long[] newLimbs = new long[limbs.length];
             mult(limbs, b.limbs, newLimbs);
-            return new ImmutableElement(newLimbs, true);
+            return new ImmutableElement(newLimbs, 0);
         }
 
         @Override
         public ImmutableElement square() {
             long[] newLimbs = new long[limbs.length];
             IntegerPolynomial.this.square(limbs, newLimbs);
-            return new ImmutableElement(newLimbs, true);
+            return new ImmutableElement(newLimbs, 0);
         }
 
         public void addModPowerTwo(IntegerModuloP arg, byte[] result) {
 
             Element other = (Element) arg;
-            if (!(summand && other.summand)) {
+            if (!(isSummand() && other.isSummand())) {
                 throw new ArithmeticException("Not a valid summand");
             }
             addLimbsModPowerTwo(limbs, other.limbs, result);
         }
 
         public void asByteArray(byte[] result) {
-            if (!summand) {
+            if (!isSummand()) {
                 throw new ArithmeticException("Not a valid summand");
             }
             limbsToByteArray(limbs, result);
         }
     }
 
-    private class MutableElement extends Element
+    protected class MutableElement extends Element
         implements MutableIntegerModuloP {
 
-        protected MutableElement(long[] limbs, boolean summand) {
-            super(limbs, summand);
+        protected MutableElement(long[] limbs, int numAdds) {
+            super(limbs, numAdds);
         }
 
         @Override
         public ImmutableElement fixed() {
-            return new ImmutableElement(limbs.clone(), summand);
+            return new ImmutableElement(limbs.clone(), numAdds);
+        }
+
+        @Override
+        public void conditionalSet(IntegerModuloP b, int set) {
+
+            Element other = (Element) b;
+
+            conditionalAssign(set, limbs, other.limbs);
+            numAdds = other.numAdds;
         }
 
         @Override
@@ -569,9 +626,9 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
             MutableElement other = (MutableElement) b;
 
             conditionalSwap(swap, limbs, other.limbs);
-            boolean summandTemp = summand;
-            summand = other.summand;
-            other.summand = summandTemp;
+            int numAddsTemp = numAdds;
+            numAdds = other.numAdds;
+            other.numAdds = numAddsTemp;
         }
 
 
@@ -580,7 +637,7 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
             Element other = (Element) v;
 
             System.arraycopy(other.limbs, 0, limbs, 0, other.limbs.length);
-            summand = other.summand;
+            numAdds = other.numAdds;
             return this;
         }
 
@@ -589,7 +646,7 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
                                        int length, byte highByte) {
 
             encode(arr, offset, length, highByte, limbs);
-            summand = true;
+            this.numAdds = 0;
 
             return this;
         }
@@ -599,7 +656,7 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
                                        byte highByte) {
 
             encode(buf, length, highByte, limbs);
-            summand = true;
+            numAdds = 0;
 
             return this;
         }
@@ -608,15 +665,15 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
         public MutableElement setProduct(IntegerModuloP genB) {
             Element b = (Element) genB;
             mult(limbs, b.limbs, limbs);
-            summand = true;
+            numAdds = 0;
             return this;
         }
 
         @Override
         public MutableElement setProduct(SmallValue v) {
             int value = ((Limb) v).value;
-            multByInt(limbs, value, limbs);
-            summand = true;
+            multByInt(limbs, value);
+            numAdds = 0;
             return this;
         }
 
@@ -624,7 +681,7 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
         public MutableElement setSum(IntegerModuloP genB) {
 
             Element b = (Element) genB;
-            if (!(summand && b.summand)) {
+            if (!(isSummand() && b.isSummand())) {
                 throw new ArithmeticException("Not a valid summand");
             }
 
@@ -632,7 +689,7 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
                 limbs[i] = limbs[i] + b.limbs[i];
             }
 
-            summand = false;
+            numAdds = Math.max(numAdds, b.numAdds) + 1;
             return this;
         }
 
@@ -640,7 +697,7 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
         public MutableElement setDifference(IntegerModuloP genB) {
 
             Element b = (Element) genB;
-            if (!(summand && b.summand)) {
+            if (!(isSummand() && b.isSummand())) {
                 throw new ArithmeticException("Not a valid summand");
             }
 
@@ -648,16 +705,33 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
                 limbs[i] = limbs[i] - b.limbs[i];
             }
 
+            numAdds = Math.max(numAdds, b.numAdds) + 1;
             return this;
         }
 
         @Override
         public MutableElement setSquare() {
             IntegerPolynomial.this.square(limbs, limbs);
-            summand = true;
+            numAdds = 0;
             return this;
         }
 
+        @Override
+        public MutableElement setAdditiveInverse() {
+
+            for (int i = 0; i < limbs.length; i++) {
+                limbs[i] = -limbs[i];
+            }
+            return this;
+        }
+
+        @Override
+        public MutableElement setReduced() {
+
+            reduce(limbs);
+            numAdds = 0;
+            return this;
+        }
     }
 
     class ImmutableElement extends Element implements ImmutableIntegerModuloP {
@@ -670,8 +744,8 @@ public abstract class IntegerPolynomial implements IntegerFieldModuloP {
             super(v);
         }
 
-        protected ImmutableElement(long[] limbs, boolean summand) {
-            super(limbs, summand);
+        protected ImmutableElement(long[] limbs, int numAdds) {
+            super(limbs, numAdds);
         }
 
         @Override

src/share/classes/sun/security/util/math/intpoly/IntegerPolynomial1305.java

@@ -44,7 +44,7 @@ public class IntegerPolynomial1305 extends IntegerPolynomial {
         = TWO.pow(POWER).subtract(BigInteger.valueOf(SUBTRAHEND));
 
     public IntegerPolynomial1305() {
-        super(BITS_PER_LIMB, NUM_LIMBS, MODULUS);
+        super(BITS_PER_LIMB, NUM_LIMBS, 1, MODULUS);
     }
 
     protected void mult(long[] a, long[] b, long[] r) {
@@ -95,15 +95,6 @@ public class IntegerPolynomial1305 extends IntegerPolynomial {
         carry(r);
     }
 
-    protected void multByInt(long[] a, long b, long[] r) {
-
-        for (int i = 0; i < a.length; i++) {
-            r[i] = a[i] * b;
-        }
-
-        reduce(r);
-    }
-
     @Override
     protected void square(long[] a, long[] r) {
         // Use grade-school multiplication with a simple squaring optimization.
@@ -197,7 +188,12 @@ public class IntegerPolynomial1305 extends IntegerPolynomial {
         return x >> BITS_PER_LIMB;
     }
 
+    @Override
+    protected void postEncodeCarry(long[] v) {
+        // not needed because carry is unsigned
+    }
 
+    @Override
     protected void reduce(long[] limbs) {
         long carry3 = carryOut(limbs, 3);
         long new4 = carry3 + limbs[4];

src/share/classes/sun/security/util/math/intpoly/IntegerPolynomial25519.java

@@ -48,7 +48,7 @@ public class IntegerPolynomial25519 extends IntegerPolynomial {
     private static final int RIGHT_BIT_OFFSET = BITS_PER_LIMB - BIT_OFFSET;
 
     public IntegerPolynomial25519() {
-        super(BITS_PER_LIMB, NUM_LIMBS, MODULUS);
+        super(BITS_PER_LIMB, NUM_LIMBS, 1, MODULUS);
     }
 
     @Override
@@ -59,6 +59,26 @@ public class IntegerPolynomial25519 extends IntegerPolynomial {
         limbs[0] += reducedValue * SUBTRAHEND;
     }
 
+    @Override
+    protected void reduce(long[] a) {
+
+        // carry(8, 2)
+        long carry8 = carryValue(a[8]);
+        a[8] -= (carry8 << BITS_PER_LIMB);
+        a[9] += carry8;
+
+        long carry9 = carryValue(a[9]);
+        a[9] -= (carry9 << BITS_PER_LIMB);
+
+        // reduce(0, 1)
+        long reducedValue10 = (carry9 * SUBTRAHEND);
+        a[0] += ((reducedValue10 << BIT_OFFSET) & LIMB_MASK);
+        a[1] += reducedValue10 >> RIGHT_BIT_OFFSET;
+
+        // carry(0, 9)
+        carry(a, 0, 9);
+    }
+
     @Override
     protected void mult(long[] a, long[] b, long[] r) {
 
@@ -153,28 +173,6 @@ public class IntegerPolynomial25519 extends IntegerPolynomial {
         carry(r, 0, 9);
     }
 
-    protected void multByInt(long[] a, long b, long[] r) {
-        for (int i = 0; i < a.length; i++) {
-            r[i] = a[i] * b;
-        }
-
-        // carry(8, 2)
-        long carry8 = carryValue(r[8]);
-        r[8] -= (carry8 << BITS_PER_LIMB);
-        r[9] += carry8;
-
-        long carry9 = carryValue(r[9]);
-        r[9] -= (carry9 << BITS_PER_LIMB);
-
-        // reduce(0, 1)
-        long reducedValue10 = (carry9 * SUBTRAHEND);
-        r[0] += ((reducedValue10 << BIT_OFFSET) & LIMB_MASK);
-        r[1] += reducedValue10 >> RIGHT_BIT_OFFSET;
-
-        // carry(0, 9)
-        carry(r, 0, 9);
-    }
-
     @Override
     protected void square(long[] a, long[] r) {
 

src/share/classes/sun/security/util/math/intpoly/IntegerPolynomial448.java

@@ -42,7 +42,7 @@ public class IntegerPolynomial448 extends IntegerPolynomial {
             .subtract(BigInteger.valueOf(1));
 
     public IntegerPolynomial448() {
-        super(BITS_PER_LIMB, NUM_LIMBS, MODULUS);
+        super(BITS_PER_LIMB, NUM_LIMBS, 1, MODULUS);
     }
 
     private void modReduceIn(long[] limbs, int index, long x) {
@@ -57,6 +57,25 @@ public class IntegerPolynomial448 extends IntegerPolynomial {
         modReduceIn(limbs, numLimbs, carry);
     }
 
+    @Override
+    protected void reduce(long[] a) {
+
+        // carry(14, 2)
+        long carry14 = carryValue(a[14]);
+        a[14] -= (carry14 << BITS_PER_LIMB);
+        a[15] += carry14;
+
+        long carry15 = carryValue(a[15]);
+        a[15] -= (carry15 << BITS_PER_LIMB);
+
+        // reduce(0, 1)
+        a[0] += carry15;
+        a[8] += carry15;
+
+        // carry(0, 15)
+        carry(a, 0, 15);
+    }
+
     @Override
     protected void mult(long[] a, long[] b, long[] r) {
 
@@ -176,27 +195,6 @@ public class IntegerPolynomial448 extends IntegerPolynomial {
         carry(r, 0, 15);
     }
 
-    protected void multByInt(long[] a, long b, long[] r) {
-        for (int i = 0; i < a.length; i++) {
-            r[i] = a[i] * b;
-        }
-
-        // carry(14, 2)
-        long carry14 = carryValue(r[14]);
-        r[14] -= (carry14 << BITS_PER_LIMB);
-        r[15] += carry14;
-
-        long carry15 = carryValue(r[15]);
-        r[15] -= (carry15 << BITS_PER_LIMB);
-
-        // reduce(0, 1)
-        r[0] += carry15;
-        r[8] += carry15;
-
-        // carry(0, 15)
-        carry(r, 0, 15);
-    }
-
     @Override
     protected void square(long[] a, long[] r) {
 

src/share/classes/sun/security/util/math/intpoly/IntegerPolynomialP256.java

+/*
+ * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * This file is generated by FieldGen.jsh. Do not modify it directly.
+ */
+
+package sun.security.util.math.intpoly;
+
+import java.math.BigInteger;
+public class IntegerPolynomialP256 extends IntegerPolynomial {
+    private static final int BITS_PER_LIMB = 26;
+    private static final int NUM_LIMBS = 10;
+    private static final int MAX_ADDS = 2;
+    public static final BigInteger MODULUS = evaluateModulus();
+    private static final long CARRY_ADD = 1 << 25;
+    private static final int LIMB_MASK = -1 >>> (64 - BITS_PER_LIMB);
+    public IntegerPolynomialP256() {
+
+        super(BITS_PER_LIMB, NUM_LIMBS, MAX_ADDS, MODULUS);
+
+    }
+    private static BigInteger evaluateModulus() {
+        BigInteger result = BigInteger.valueOf(2).pow(256);
+        result = result.subtract(BigInteger.valueOf(2).pow(224));
+        result = result.add(BigInteger.valueOf(2).pow(192));
+        result = result.add(BigInteger.valueOf(2).pow(96));
+        result = result.subtract(BigInteger.valueOf(1));
+        return result;
+    }
+    @Override
+    protected void finalCarryReduceLast(long[] limbs) {
+        long c = limbs[9] >> 22;
+        limbs[9] -= c << 22;
+        limbs[8] += (c << 16) & LIMB_MASK;
+        limbs[9] += c >> 10;
+        limbs[7] -= (c << 10) & LIMB_MASK;
+        limbs[8] -= c >> 16;
+        limbs[3] -= (c << 18) & LIMB_MASK;
+        limbs[4] -= c >> 8;
+        limbs[0] += c;
+    }
+    private void carryReduce(long[] r, long c0, long c1, long c2, long c3, long c4, long c5, long c6, long c7, long c8, long c9, long c10, long c11, long c12, long c13, long c14, long c15, long c16, long c17, long c18) {
+        long c19 = 0;
+        //reduce from position 18
+        c16 += (c18 << 20) & LIMB_MASK;
+        c17 += c18 >> 6;
+        c15 -= (c18 << 14) & LIMB_MASK;
+        c16 -= c18 >> 12;
+        c11 -= (c18 << 22) & LIMB_MASK;
+        c12 -= c18 >> 4;
+        c8 += (c18 << 4) & LIMB_MASK;
+        c9 += c18 >> 22;
+        //reduce from position 17
+        c15 += (c17 << 20) & LIMB_MASK;
+        c16 += c17 >> 6;
+        c14 -= (c17 << 14) & LIMB_MASK;
+        c15 -= c17 >> 12;
+        c10 -= (c17 << 22) & LIMB_MASK;
+        c11 -= c17 >> 4;
+        c7 += (c17 << 4) & LIMB_MASK;
+        c8 += c17 >> 22;
+        //reduce from position 16
+        c14 += (c16 << 20) & LIMB_MASK;
+        c15 += c16 >> 6;
+        c13 -= (c16 << 14) & LIMB_MASK;
+        c14 -= c16 >> 12;
+        c9 -= (c16 << 22) & LIMB_MASK;
+        c10 -= c16 >> 4;
+        c6 += (c16 << 4) & LIMB_MASK;
+        c7 += c16 >> 22;
+        //reduce from position 15
+        c13 += (c15 << 20) & LIMB_MASK;
+        c14 += c15 >> 6;
+        c12 -= (c15 << 14) & LIMB_MASK;
+        c13 -= c15 >> 12;
+        c8 -= (c15 << 22) & LIMB_MASK;
+        c9 -= c15 >> 4;
+        c5 += (c15 << 4) & LIMB_MASK;
+        c6 += c15 >> 22;
+        //reduce from position 14
+        c12 += (c14 << 20) & LIMB_MASK;
+        c13 += c14 >> 6;
+        c11 -= (c14 << 14) & LIMB_MASK;
+        c12 -= c14 >> 12;
+        c7 -= (c14 << 22) & LIMB_MASK;
+        c8 -= c14 >> 4;
+        c4 += (c14 << 4) & LIMB_MASK;
+        c5 += c14 >> 22;
+        //reduce from position 13
+        c11 += (c13 << 20) & LIMB_MASK;
+        c12 += c13 >> 6;
+        c10 -= (c13 << 14) & LIMB_MASK;
+        c11 -= c13 >> 12;
+        c6 -= (c13 << 22) & LIMB_MASK;
+        c7 -= c13 >> 4;
+        c3 += (c13 << 4) & LIMB_MASK;
+        c4 += c13 >> 22;
+        //reduce from position 12
+        c10 += (c12 << 20) & LIMB_MASK;
+        c11 += c12 >> 6;
+        c9 -= (c12 << 14) & LIMB_MASK;
+        c10 -= c12 >> 12;
+        c5 -= (c12 << 22) & LIMB_MASK;
+        c6 -= c12 >> 4;
+        c2 += (c12 << 4) & LIMB_MASK;
+        c3 += c12 >> 22;
+        //reduce from position 11
+        c9 += (c11 << 20) & LIMB_MASK;
+        c10 += c11 >> 6;
+        c8 -= (c11 << 14) & LIMB_MASK;
+        c9 -= c11 >> 12;
+        c4 -= (c11 << 22) & LIMB_MASK;
+        c5 -= c11 >> 4;
+        c1 += (c11 << 4) & LIMB_MASK;
+        c2 += c11 >> 22;
+        //reduce from position 10
+        c8 += (c10 << 20) & LIMB_MASK;
+        c9 += c10 >> 6;
+        c7 -= (c10 << 14) & LIMB_MASK;
+        c8 -= c10 >> 12;
+        c3 -= (c10 << 22) & LIMB_MASK;
+        c4 -= c10 >> 4;
+        c0 += (c10 << 4) & LIMB_MASK;
+        c1 += c10 >> 22;
+        c10 = 0;
+
+        carryReduce0(r, c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19);
+    }
+    void carryReduce0(long[] r, long c0, long c1, long c2, long c3, long c4, long c5, long c6, long c7, long c8, long c9, long c10, long c11, long c12, long c13, long c14, long c15, long c16, long c17, long c18, long c19) {
+
+        //carry from position 8
+        long t0 = (c8 + CARRY_ADD) >> 26;
+        c8 -= (t0 << 26);
+        c9 += t0;
+        //carry from position 9
+        t0 = (c9 + CARRY_ADD) >> 26;
+        c9 -= (t0 << 26);
+        c10 += t0;
+        //reduce from position 10
+        c8 += (c10 << 20) & LIMB_MASK;
+        c9 += c10 >> 6;
+        c7 -= (c10 << 14) & LIMB_MASK;
+        c8 -= c10 >> 12;
+        c3 -= (c10 << 22) & LIMB_MASK;
+        c4 -= c10 >> 4;
+        c0 += (c10 << 4) & LIMB_MASK;
+        c1 += c10 >> 22;
+        //carry from position 0
+        t0 = (c0 + CARRY_ADD) >> 26;
+        c0 -= (t0 << 26);
+        c1 += t0;
+        //carry from position 1
+        t0 = (c1 + CARRY_ADD) >> 26;
+        c1 -= (t0 << 26);
+        c2 += t0;
+        //carry from position 2
+        t0 = (c2 + CARRY_ADD) >> 26;
+        c2 -= (t0 << 26);
+        c3 += t0;
+        //carry from position 3
+        t0 = (c3 + CARRY_ADD) >> 26;
+        c3 -= (t0 << 26);
+        c4 += t0;
+        //carry from position 4
+        t0 = (c4 + CARRY_ADD) >> 26;
+        c4 -= (t0 << 26);
+        c5 += t0;
+        //carry from position 5
+        t0 = (c5 + CARRY_ADD) >> 26;
+        c5 -= (t0 << 26);
+        c6 += t0;
+        //carry from position 6
+        t0 = (c6 + CARRY_ADD) >> 26;
+        c6 -= (t0 << 26);
+        c7 += t0;
+        //carry from position 7
+        t0 = (c7 + CARRY_ADD) >> 26;
+        c7 -= (t0 << 26);
+        c8 += t0;
+        //carry from position 8
+        t0 = (c8 + CARRY_ADD) >> 26;
+        c8 -= (t0 << 26);
+        c9 += t0;
+
+        r[0] = c0;
+        r[1] = c1;
+        r[2] = c2;
+        r[3] = c3;
+        r[4] = c4;
+        r[5] = c5;
+        r[6] = c6;
+        r[7] = c7;
+        r[8] = c8;
+        r[9] = c9;
+    }
+    private void carryReduce(long[] r, long c0, long c1, long c2, long c3, long c4, long c5, long c6, long c7, long c8, long c9) {
+        long c10 = 0;
+        //carry from position 8
+        long t0 = (c8 + CARRY_ADD) >> 26;
+        c8 -= (t0 << 26);
+        c9 += t0;
+        //carry from position 9
+        t0 = (c9 + CARRY_ADD) >> 26;
+        c9 -= (t0 << 26);
+        c10 += t0;
+        //reduce from position 10
+        c8 += (c10 << 20) & LIMB_MASK;
+        c9 += c10 >> 6;
+        c7 -= (c10 << 14) & LIMB_MASK;
+        c8 -= c10 >> 12;
+        c3 -= (c10 << 22) & LIMB_MASK;
+        c4 -= c10 >> 4;
+        c0 += (c10 << 4) & LIMB_MASK;
+        c1 += c10 >> 22;
+        //carry from position 0
+        t0 = (c0 + CARRY_ADD) >> 26;
+        c0 -= (t0 << 26);
+        c1 += t0;
+        //carry from position 1
+        t0 = (c1 + CARRY_ADD) >> 26;
+        c1 -= (t0 << 26);
+        c2 += t0;
+        //carry from position 2
+        t0 = (c2 + CARRY_ADD) >> 26;
+        c2 -= (t0 << 26);
+        c3 += t0;
+        //carry from position 3
+        t0 = (c3 + CARRY_ADD) >> 26;
+        c3 -= (t0 << 26);
+        c4 += t0;
+        //carry from position 4
+        t0 = (c4 + CARRY_ADD) >> 26;
+        c4 -= (t0 << 26);
+        c5 += t0;
+        //carry from position 5
+        t0 = (c5 + CARRY_ADD) >> 26;
+        c5 -= (t0 << 26);
+        c6 += t0;
+        //carry from position 6
+        t0 = (c6 + CARRY_ADD) >> 26;
+        c6 -= (t0 << 26);
+        c7 += t0;
+        //carry from position 7
+        t0 = (c7 + CARRY_ADD) >> 26;
+        c7 -= (t0 << 26);
+        c8 += t0;
+        //carry from position 8
+        t0 = (c8 + CARRY_ADD) >> 26;
+        c8 -= (t0 << 26);
+        c9 += t0;
+
+        r[0] = c0;
+        r[1] = c1;
+        r[2] = c2;
+        r[3] = c3;
+        r[4] = c4;
+        r[5] = c5;
+        r[6] = c6;
+        r[7] = c7;
+        r[8] = c8;
+        r[9] = c9;
+    }
+    @Override
+    protected void mult(long[] a, long[] b, long[] r) {
+        long c0 = (a[0] * b[0]);
+        long c1 = (a[0] * b[1]) + (a[1] * b[0]);
+        long c2 = (a[0] * b[2]) + (a[1] * b[1]) + (a[2] * b[0]);
+        long c3 = (a[0] * b[3]) + (a[1] * b[2]) + (a[2] * b[1]) + (a[3] * b[0]);
+        long c4 = (a[0] * b[4]) + (a[1] * b[3]) + (a[2] * b[2]) + (a[3] * b[1]) + (a[4] * b[0]);
+        long c5 = (a[0] * b[5]) + (a[1] * b[4]) + (a[2] * b[3]) + (a[3] * b[2]) + (a[4] * b[1]) + (a[5] * b[0]);
+        long c6 = (a[0] * b[6]) + (a[1] * b[5]) + (a[2] * b[4]) + (a[3] * b[3]) + (a[4] * b[2]) + (a[5] * b[1]) + (a[6] * b[0]);
+        long c7 = (a[0] * b[7]) + (a[1] * b[6]) + (a[2] * b[5]) + (a[3] * b[4]) + (a[4] * b[3]) + (a[5] * b[2]) + (a[6] * b[1]) + (a[7] * b[0]);
+        long c8 = (a[0] * b[8]) + (a[1] * b[7]) + (a[2] * b[6]) + (a[3] * b[5]) + (a[4] * b[4]) + (a[5] * b[3]) + (a[6] * b[2]) + (a[7] * b[1]) + (a[8] * b[0]);
+        long c9 = (a[0] * b[9]) + (a[1] * b[8]) + (a[2] * b[7]) + (a[3] * b[6]) + (a[4] * b[5]) + (a[5] * b[4]) + (a[6] * b[3]) + (a[7] * b[2]) + (a[8] * b[1]) + (a[9] * b[0]);
+        long c10 = (a[1] * b[9]) + (a[2] * b[8]) + (a[3] * b[7]) + (a[4] * b[6]) + (a[5] * b[5]) + (a[6] * b[4]) + (a[7] * b[3]) + (a[8] * b[2]) + (a[9] * b[1]);
+        long c11 = (a[2] * b[9]) + (a[3] * b[8]) + (a[4] * b[7]) + (a[5] * b[6]) + (a[6] * b[5]) + (a[7] * b[4]) + (a[8] * b[3]) + (a[9] * b[2]);
+        long c12 = (a[3] * b[9]) + (a[4] * b[8]) + (a[5] * b[7]) + (a[6] * b[6]) + (a[7] * b[5]) + (a[8] * b[4]) + (a[9] * b[3]);
+        long c13 = (a[4] * b[9]) + (a[5] * b[8]) + (a[6] * b[7]) + (a[7] * b[6]) + (a[8] * b[5]) + (a[9] * b[4]);
+        long c14 = (a[5] * b[9]) + (a[6] * b[8]) + (a[7] * b[7]) + (a[8] * b[6]) + (a[9] * b[5]);
+        long c15 = (a[6] * b[9]) + (a[7] * b[8]) + (a[8] * b[7]) + (a[9] * b[6]);
+        long c16 = (a[7] * b[9]) + (a[8] * b[8]) + (a[9] * b[7]);
+        long c17 = (a[8] * b[9]) + (a[9] * b[8]);
+        long c18 = (a[9] * b[9]);
+
+        carryReduce(r, c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18);
+    }
+    @Override
+    protected void reduce(long[] a) {
+        carryReduce(a, a[0], a[1], a[2], a[3], a[4], a[5], a[6], a[7], a[8], a[9]);
+    }
+    @Override
+    protected void square(long[] a, long[] r) {
+        long c0 = (a[0] * a[0]);
+        long c1 = 2 * ((a[0] * a[1]));
+        long c2 = 2 * ((a[0] * a[2])) + (a[1] * a[1]);
+        long c3 = 2 * ((a[0] * a[3]) + (a[1] * a[2]));
+        long c4 = 2 * ((a[0] * a[4]) + (a[1] * a[3])) + (a[2] * a[2]);
+        long c5 = 2 * ((a[0] * a[5]) + (a[1] * a[4]) + (a[2] * a[3]));
+        long c6 = 2 * ((a[0] * a[6]) + (a[1] * a[5]) + (a[2] * a[4])) + (a[3] * a[3]);
+        long c7 = 2 * ((a[0] * a[7]) + (a[1] * a[6]) + (a[2] * a[5]) + (a[3] * a[4]));
+        long c8 = 2 * ((a[0] * a[8]) + (a[1] * a[7]) + (a[2] * a[6]) + (a[3] * a[5])) + (a[4] * a[4]);
+        long c9 = 2 * ((a[0] * a[9]) + (a[1] * a[8]) + (a[2] * a[7]) + (a[3] * a[6]) + (a[4] * a[5]));
+        long c10 = 2 * ((a[1] * a[9]) + (a[2] * a[8]) + (a[3] * a[7]) + (a[4] * a[6])) + (a[5] * a[5]);
+        long c11 = 2 * ((a[2] * a[9]) + (a[3] * a[8]) + (a[4] * a[7]) + (a[5] * a[6]));
+        long c12 = 2 * ((a[3] * a[9]) + (a[4] * a[8]) + (a[5] * a[7])) + (a[6] * a[6]);
+        long c13 = 2 * ((a[4] * a[9]) + (a[5] * a[8]) + (a[6] * a[7]));
+        long c14 = 2 * ((a[5] * a[9]) + (a[6] * a[8])) + (a[7] * a[7]);
+        long c15 = 2 * ((a[6] * a[9]) + (a[7] * a[8]));
+        long c16 = 2 * ((a[7] * a[9])) + (a[8] * a[8]);
+        long c17 = 2 * ((a[8] * a[9]));
+        long c18 = (a[9] * a[9]);
+
+        carryReduce(r, c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18);
+    }
+}
+

src/share/classes/sun/security/util/math/intpoly/IntegerPolynomialP384.java

+/*
+ * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * This file is generated by FieldGen.jsh. Do not modify it directly.
+ */
+
+package sun.security.util.math.intpoly;
+
+import java.math.BigInteger;
+public class IntegerPolynomialP384 extends IntegerPolynomial {
+    private static final int BITS_PER_LIMB = 28;
+    private static final int NUM_LIMBS = 14;
+    private static final int MAX_ADDS = 2;
+    public static final BigInteger MODULUS = evaluateModulus();
+    private static final long CARRY_ADD = 1 << 27;
+    private static final int LIMB_MASK = -1 >>> (64 - BITS_PER_LIMB);
+    public IntegerPolynomialP384() {
+
+        super(BITS_PER_LIMB, NUM_LIMBS, MAX_ADDS, MODULUS);
+
+    }
+    private static BigInteger evaluateModulus() {
+        BigInteger result = BigInteger.valueOf(2).pow(384);
+        result = result.subtract(BigInteger.valueOf(2).pow(128));
+        result = result.subtract(BigInteger.valueOf(2).pow(96));
+        result = result.add(BigInteger.valueOf(2).pow(32));
+        result = result.subtract(BigInteger.valueOf(1));
+        return result;
+    }
+    @Override
+    protected void finalCarryReduceLast(long[] limbs) {
+        long c = limbs[13] >> 20;
+        limbs[13] -= c << 20;
+        limbs[4] += (c << 16) & LIMB_MASK;
+        limbs[5] += c >> 12;
+        limbs[3] += (c << 12) & LIMB_MASK;
+        limbs[4] += c >> 16;
+        limbs[1] -= (c << 4) & LIMB_MASK;
+        limbs[2] -= c >> 24;
+        limbs[0] += c;
+    }
+    private void carryReduce(long[] r, long c0, long c1, long c2, long c3, long c4, long c5, long c6, long c7, long c8, long c9, long c10, long c11, long c12, long c13, long c14, long c15, long c16, long c17, long c18, long c19, long c20, long c21, long c22, long c23, long c24, long c25, long c26) {
+        long c27 = 0;
+        //reduce from position 26
+        c16 += (c26 << 24) & LIMB_MASK;
+        c17 += c26 >> 4;
+        c15 += (c26 << 20) & LIMB_MASK;
+        c16 += c26 >> 8;
+        c13 -= (c26 << 12) & LIMB_MASK;
+        c14 -= c26 >> 16;
+        c12 += (c26 << 8) & LIMB_MASK;
+        c13 += c26 >> 20;
+        //reduce from position 25
+        c15 += (c25 << 24) & LIMB_MASK;
+        c16 += c25 >> 4;
+        c14 += (c25 << 20) & LIMB_MASK;
+        c15 += c25 >> 8;
+        c12 -= (c25 << 12) & LIMB_MASK;
+        c13 -= c25 >> 16;
+        c11 += (c25 << 8) & LIMB_MASK;
+        c12 += c25 >> 20;
+        //reduce from position 24
+        c14 += (c24 << 24) & LIMB_MASK;
+        c15 += c24 >> 4;
+        c13 += (c24 << 20) & LIMB_MASK;
+        c14 += c24 >> 8;
+        c11 -= (c24 << 12) & LIMB_MASK;
+        c12 -= c24 >> 16;
+        c10 += (c24 << 8) & LIMB_MASK;
+        c11 += c24 >> 20;
+        //reduce from position 23
+        c13 += (c23 << 24) & LIMB_MASK;
+        c14 += c23 >> 4;
+        c12 += (c23 << 20) & LIMB_MASK;
+        c13 += c23 >> 8;
+        c10 -= (c23 << 12) & LIMB_MASK;
+        c11 -= c23 >> 16;
+        c9 += (c23 << 8) & LIMB_MASK;
+        c10 += c23 >> 20;
+        //reduce from position 22
+        c12 += (c22 << 24) & LIMB_MASK;
+        c13 += c22 >> 4;
+        c11 += (c22 << 20) & LIMB_MASK;
+        c12 += c22 >> 8;
+        c9 -= (c22 << 12) & LIMB_MASK;
+        c10 -= c22 >> 16;
+        c8 += (c22 << 8) & LIMB_MASK;
+        c9 += c22 >> 20;
+        //reduce from position 21
+        c11 += (c21 << 24) & LIMB_MASK;
+        c12 += c21 >> 4;
+        c10 += (c21 << 20) & LIMB_MASK;
+        c11 += c21 >> 8;
+        c8 -= (c21 << 12) & LIMB_MASK;
+        c9 -= c21 >> 16;
+        c7 += (c21 << 8) & LIMB_MASK;
+        c8 += c21 >> 20;
+        //reduce from position 20
+        c10 += (c20 << 24) & LIMB_MASK;
+        c11 += c20 >> 4;
+        c9 += (c20 << 20) & LIMB_MASK;
+        c10 += c20 >> 8;
+        c7 -= (c20 << 12) & LIMB_MASK;
+        c8 -= c20 >> 16;
+        c6 += (c20 << 8) & LIMB_MASK;
+        c7 += c20 >> 20;
+        //reduce from position 19
+        c9 += (c19 << 24) & LIMB_MASK;
+        c10 += c19 >> 4;
+        c8 += (c19 << 20) & LIMB_MASK;
+        c9 += c19 >> 8;
+        c6 -= (c19 << 12) & LIMB_MASK;
+        c7 -= c19 >> 16;
+        c5 += (c19 << 8) & LIMB_MASK;
+        c6 += c19 >> 20;
+        //reduce from position 18
+        c8 += (c18 << 24) & LIMB_MASK;
+        c9 += c18 >> 4;
+        c7 += (c18 << 20) & LIMB_MASK;
+        c8 += c18 >> 8;
+        c5 -= (c18 << 12) & LIMB_MASK;
+        c6 -= c18 >> 16;
+        c4 += (c18 << 8) & LIMB_MASK;
+        c5 += c18 >> 20;
+        //reduce from position 17
+        c7 += (c17 << 24) & LIMB_MASK;
+        c8 += c17 >> 4;
+        c6 += (c17 << 20) & LIMB_MASK;
+        c7 += c17 >> 8;
+        c4 -= (c17 << 12) & LIMB_MASK;
+        c5 -= c17 >> 16;
+        c3 += (c17 << 8) & LIMB_MASK;
+        c4 += c17 >> 20;
+        //reduce from position 16
+        c6 += (c16 << 24) & LIMB_MASK;
+        c7 += c16 >> 4;
+        c5 += (c16 << 20) & LIMB_MASK;
+        c6 += c16 >> 8;
+        c3 -= (c16 << 12) & LIMB_MASK;
+        c4 -= c16 >> 16;
+        c2 += (c16 << 8) & LIMB_MASK;
+        c3 += c16 >> 20;
+        //reduce from position 15
+        c5 += (c15 << 24) & LIMB_MASK;
+        c6 += c15 >> 4;
+        c4 += (c15 << 20) & LIMB_MASK;
+        c5 += c15 >> 8;
+        c2 -= (c15 << 12) & LIMB_MASK;
+        c3 -= c15 >> 16;
+        c1 += (c15 << 8) & LIMB_MASK;
+        c2 += c15 >> 20;
+        //reduce from position 14
+        c4 += (c14 << 24) & LIMB_MASK;
+        c5 += c14 >> 4;
+        c3 += (c14 << 20) & LIMB_MASK;
+        c4 += c14 >> 8;
+        c1 -= (c14 << 12) & LIMB_MASK;
+        c2 -= c14 >> 16;
+        c0 += (c14 << 8) & LIMB_MASK;
+        c1 += c14 >> 20;
+        c14 = 0;
+
+        carryReduce0(r, c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27);
+    }
+    void carryReduce0(long[] r, long c0, long c1, long c2, long c3, long c4, long c5, long c6, long c7, long c8, long c9, long c10, long c11, long c12, long c13, long c14, long c15, long c16, long c17, long c18, long c19, long c20, long c21, long c22, long c23, long c24, long c25, long c26, long c27) {
+
+        //carry from position 12
+        long t0 = (c12 + CARRY_ADD) >> 28;
+        c12 -= (t0 << 28);
+        c13 += t0;
+        //carry from position 13
+        t0 = (c13 + CARRY_ADD) >> 28;
+        c13 -= (t0 << 28);
+        c14 += t0;
+        //reduce from position 14
+        c4 += (c14 << 24) & LIMB_MASK;
+        c5 += c14 >> 4;
+        c3 += (c14 << 20) & LIMB_MASK;
+        c4 += c14 >> 8;
+        c1 -= (c14 << 12) & LIMB_MASK;
+        c2 -= c14 >> 16;
+        c0 += (c14 << 8) & LIMB_MASK;
+        c1 += c14 >> 20;
+        //carry from position 0
+        t0 = (c0 + CARRY_ADD) >> 28;
+        c0 -= (t0 << 28);
+        c1 += t0;
+        //carry from position 1
+        t0 = (c1 + CARRY_ADD) >> 28;
+        c1 -= (t0 << 28);
+        c2 += t0;
+        //carry from position 2
+        t0 = (c2 + CARRY_ADD) >> 28;
+        c2 -= (t0 << 28);
+        c3 += t0;
+        //carry from position 3
+        t0 = (c3 + CARRY_ADD) >> 28;
+        c3 -= (t0 << 28);
+        c4 += t0;
+        //carry from position 4
+        t0 = (c4 + CARRY_ADD) >> 28;
+        c4 -= (t0 << 28);
+        c5 += t0;
+        //carry from position 5
+        t0 = (c5 + CARRY_ADD) >> 28;
+        c5 -= (t0 << 28);
+        c6 += t0;
+        //carry from position 6
+        t0 = (c6 + CARRY_ADD) >> 28;
+        c6 -= (t0 << 28);
+        c7 += t0;
+        //carry from position 7
+        t0 = (c7 + CARRY_ADD) >> 28;
+        c7 -= (t0 << 28);
+        c8 += t0;
+        //carry from position 8
+        t0 = (c8 + CARRY_ADD) >> 28;
+        c8 -= (t0 << 28);
+        c9 += t0;
+        //carry from position 9
+        t0 = (c9 + CARRY_ADD) >> 28;
+        c9 -= (t0 << 28);
+        c10 += t0;
+        //carry from position 10
+        t0 = (c10 + CARRY_ADD) >> 28;
+        c10 -= (t0 << 28);
+        c11 += t0;
+        //carry from position 11
+        t0 = (c11 + CARRY_ADD) >> 28;
+        c11 -= (t0 << 28);
+        c12 += t0;
+        //carry from position 12
+        t0 = (c12 + CARRY_ADD) >> 28;
+        c12 -= (t0 << 28);
+        c13 += t0;
+
+        r[0] = c0;
+        r[1] = c1;
+        r[2] = c2;
+        r[3] = c3;
+        r[4] = c4;
+        r[5] = c5;
+        r[6] = c6;
+        r[7] = c7;
+        r[8] = c8;
+        r[9] = c9;
+        r[10] = c10;
+        r[11] = c11;
+        r[12] = c12;
+        r[13] = c13;
+    }
+    private void carryReduce(long[] r, long c0, long c1, long c2, long c3, long c4, long c5, long c6, long c7, long c8, long c9, long c10, long c11, long c12, long c13) {
+        long c14 = 0;
+        //carry from position 12
+        long t0 = (c12 + CARRY_ADD) >> 28;
+        c12 -= (t0 << 28);
+        c13 += t0;
+        //carry from position 13
+        t0 = (c13 + CARRY_ADD) >> 28;
+        c13 -= (t0 << 28);
+        c14 += t0;
+        //reduce from position 14
+        c4 += (c14 << 24) & LIMB_MASK;
+        c5 += c14 >> 4;
+        c3 += (c14 << 20) & LIMB_MASK;
+        c4 += c14 >> 8;
+        c1 -= (c14 << 12) & LIMB_MASK;
+        c2 -= c14 >> 16;
+        c0 += (c14 << 8) & LIMB_MASK;
+        c1 += c14 >> 20;
+        //carry from position 0
+        t0 = (c0 + CARRY_ADD) >> 28;
+        c0 -= (t0 << 28);
+        c1 += t0;
+        //carry from position 1
+        t0 = (c1 + CARRY_ADD) >> 28;
+        c1 -= (t0 << 28);
+        c2 += t0;
+        //carry from position 2
+        t0 = (c2 + CARRY_ADD) >> 28;
+        c2 -= (t0 << 28);
+        c3 += t0;
+        //carry from position 3
+        t0 = (c3 + CARRY_ADD) >> 28;
+        c3 -= (t0 << 28);
+        c4 += t0;
+        //carry from position 4
+        t0 = (c4 + CARRY_ADD) >> 28;
+        c4 -= (t0 << 28);
+        c5 += t0;
+        //carry from position 5
+        t0 = (c5 + CARRY_ADD) >> 28;
+        c5 -= (t0 << 28);
+        c6 += t0;
+        //carry from position 6
+        t0 = (c6 + CARRY_ADD) >> 28;
+        c6 -= (t0 << 28);
+        c7 += t0;
+        //carry from position 7
+        t0 = (c7 + CARRY_ADD) >> 28;
+        c7 -= (t0 << 28);
+        c8 += t0;
+        //carry from position 8
+        t0 = (c8 + CARRY_ADD) >> 28;
+        c8 -= (t0 << 28);
+        c9 += t0;
+        //carry from position 9
+        t0 = (c9 + CARRY_ADD) >> 28;
+        c9 -= (t0 << 28);
+        c10 += t0;
+        //carry from position 10
+        t0 = (c10 + CARRY_ADD) >> 28;
+        c10 -= (t0 << 28);
+        c11 += t0;
+        //carry from position 11
+        t0 = (c11 + CARRY_ADD) >> 28;
+        c11 -= (t0 << 28);
+        c12 += t0;
+        //carry from position 12
+        t0 = (c12 + CARRY_ADD) >> 28;
+        c12 -= (t0 << 28);
+        c13 += t0;
+
+        r[0] = c0;
+        r[1] = c1;
+        r[2] = c2;
+        r[3] = c3;
+        r[4] = c4;
+        r[5] = c5;
+        r[6] = c6;
+        r[7] = c7;
+        r[8] = c8;
+        r[9] = c9;
+        r[10] = c10;
+        r[11] = c11;
+        r[12] = c12;
+        r[13] = c13;
+    }
+    @Override
+    protected void mult(long[] a, long[] b, long[] r) {
+        long c0 = (a[0] * b[0]);
+        long c1 = (a[0] * b[1]) + (a[1] * b[0]);
+        long c2 = (a[0] * b[2]) + (a[1] * b[1]) + (a[2] * b[0]);
+        long c3 = (a[0] * b[3]) + (a[1] * b[2]) + (a[2] * b[1]) + (a[3] * b[0]);
+        long c4 = (a[0] * b[4]) + (a[1] * b[3]) + (a[2] * b[2]) + (a[3] * b[1]) + (a[4] * b[0]);
+        long c5 = (a[0] * b[5]) + (a[1] * b[4]) + (a[2] * b[3]) + (a[3] * b[2]) + (a[4] * b[1]) + (a[5] * b[0]);
+        long c6 = (a[0] * b[6]) + (a[1] * b[5]) + (a[2] * b[4]) + (a[3] * b[3]) + (a[4] * b[2]) + (a[5] * b[1]) + (a[6] * b[0]);
+        long c7 = (a[0] * b[7]) + (a[1] * b[6]) + (a[2] * b[5]) + (a[3] * b[4]) + (a[4] * b[3]) + (a[5] * b[2]) + (a[6] * b[1]) + (a[7] * b[0]);
+        long c8 = (a[0] * b[8]) + (a[1] * b[7]) + (a[2] * b[6]) + (a[3] * b[5]) + (a[4] * b[4]) + (a[5] * b[3]) + (a[6] * b[2]) + (a[7] * b[1]) + (a[8] * b[0]);
+        long c9 = (a[0] * b[9]) + (a[1] * b[8]) + (a[2] * b[7]) + (a[3] * b[6]) + (a[4] * b[5]) + (a[5] * b[4]) + (a[6] * b[3]) + (a[7] * b[2]) + (a[8] * b[1]) + (a[9] * b[0]);
+        long c10 = (a[0] * b[10]) + (a[1] * b[9]) + (a[2] * b[8]) + (a[3] * b[7]) + (a[4] * b[6]) + (a[5] * b[5]) + (a[6] * b[4]) + (a[7] * b[3]) + (a[8] * b[2]) + (a[9] * b[1]) + (a[10] * b[0]);
+        long c11 = (a[0] * b[11]) + (a[1] * b[10]) + (a[2] * b[9]) + (a[3] * b[8]) + (a[4] * b[7]) + (a[5] * b[6]) + (a[6] * b[5]) + (a[7] * b[4]) + (a[8] * b[3]) + (a[9] * b[2]) + (a[10] * b[1]) + (a[11] * b[0]);
+        long c12 = (a[0] * b[12]) + (a[1] * b[11]) + (a[2] * b[10]) + (a[3] * b[9]) + (a[4] * b[8]) + (a[5] * b[7]) + (a[6] * b[6]) + (a[7] * b[5]) + (a[8] * b[4]) + (a[9] * b[3]) + (a[10] * b[2]) + (a[11] * b[1]) + (a[12] * b[0]);
+        long c13 = (a[0] * b[13]) + (a[1] * b[12]) + (a[2] * b[11]) + (a[3] * b[10]) + (a[4] * b[9]) + (a[5] * b[8]) + (a[6] * b[7]) + (a[7] * b[6]) + (a[8] * b[5]) + (a[9] * b[4]) + (a[10] * b[3]) + (a[11] * b[2]) + (a[12] * b[1]) + (a[13] * b[0]);
+        long c14 = (a[1] * b[13]) + (a[2] * b[12]) + (a[3] * b[11]) + (a[4] * b[10]) + (a[5] * b[9]) + (a[6] * b[8]) + (a[7] * b[7]) + (a[8] * b[6]) + (a[9] * b[5]) + (a[10] * b[4]) + (a[11] * b[3]) + (a[12] * b[2]) + (a[13] * b[1]);
+        long c15 = (a[2] * b[13]) + (a[3] * b[12]) + (a[4] * b[11]) + (a[5] * b[10]) + (a[6] * b[9]) + (a[7] * b[8]) + (a[8] * b[7]) + (a[9] * b[6]) + (a[10] * b[5]) + (a[11] * b[4]) + (a[12] * b[3]) + (a[13] * b[2]);
+        long c16 = (a[3] * b[13]) + (a[4] * b[12]) + (a[5] * b[11]) + (a[6] * b[10]) + (a[7] * b[9]) + (a[8] * b[8]) + (a[9] * b[7]) + (a[10] * b[6]) + (a[11] * b[5]) + (a[12] * b[4]) + (a[13] * b[3]);
+        long c17 = (a[4] * b[13]) + (a[5] * b[12]) + (a[6] * b[11]) + (a[7] * b[10]) + (a[8] * b[9]) + (a[9] * b[8]) + (a[10] * b[7]) + (a[11] * b[6]) + (a[12] * b[5]) + (a[13] * b[4]);
+        long c18 = (a[5] * b[13]) + (a[6] * b[12]) + (a[7] * b[11]) + (a[8] * b[10]) + (a[9] * b[9]) + (a[10] * b[8]) + (a[11] * b[7]) + (a[12] * b[6]) + (a[13] * b[5]);
+        long c19 = (a[6] * b[13]) + (a[7] * b[12]) + (a[8] * b[11]) + (a[9] * b[10]) + (a[10] * b[9]) + (a[11] * b[8]) + (a[12] * b[7]) + (a[13] * b[6]);
+        long c20 = (a[7] * b[13]) + (a[8] * b[12]) + (a[9] * b[11]) + (a[10] * b[10]) + (a[11] * b[9]) + (a[12] * b[8]) + (a[13] * b[7]);
+        long c21 = (a[8] * b[13]) + (a[9] * b[12]) + (a[10] * b[11]) + (a[11] * b[10]) + (a[12] * b[9]) + (a[13] * b[8]);
+        long c22 = (a[9] * b[13]) + (a[10] * b[12]) + (a[11] * b[11]) + (a[12] * b[10]) + (a[13] * b[9]);
+        long c23 = (a[10] * b[13]) + (a[11] * b[12]) + (a[12] * b[11]) + (a[13] * b[10]);
+        long c24 = (a[11] * b[13]) + (a[12] * b[12]) + (a[13] * b[11]);
+        long c25 = (a[12] * b[13]) + (a[13] * b[12]);
+        long c26 = (a[13] * b[13]);
+
+        carryReduce(r, c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26);
+    }
+    @Override
+    protected void reduce(long[] a) {
+        carryReduce(a, a[0], a[1], a[2], a[3], a[4], a[5], a[6], a[7], a[8], a[9], a[10], a[11], a[12], a[13]);
+    }
+    @Override
+    protected void square(long[] a, long[] r) {
+        long c0 = (a[0] * a[0]);
+        long c1 = 2 * ((a[0] * a[1]));
+        long c2 = 2 * ((a[0] * a[2])) + (a[1] * a[1]);
+        long c3 = 2 * ((a[0] * a[3]) + (a[1] * a[2]));
+        long c4 = 2 * ((a[0] * a[4]) + (a[1] * a[3])) + (a[2] * a[2]);
+        long c5 = 2 * ((a[0] * a[5]) + (a[1] * a[4]) + (a[2] * a[3]));
+        long c6 = 2 * ((a[0] * a[6]) + (a[1] * a[5]) + (a[2] * a[4])) + (a[3] * a[3]);
+        long c7 = 2 * ((a[0] * a[7]) + (a[1] * a[6]) + (a[2] * a[5]) + (a[3] * a[4]));
+        long c8 = 2 * ((a[0] * a[8]) + (a[1] * a[7]) + (a[2] * a[6]) + (a[3] * a[5])) + (a[4] * a[4]);
+        long c9 = 2 * ((a[0] * a[9]) + (a[1] * a[8]) + (a[2] * a[7]) + (a[3] * a[6]) + (a[4] * a[5]));
+        long c10 = 2 * ((a[0] * a[10]) + (a[1] * a[9]) + (a[2] * a[8]) + (a[3] * a[7]) + (a[4] * a[6])) + (a[5] * a[5]);
+        long c11 = 2 * ((a[0] * a[11]) + (a[1] * a[10]) + (a[2] * a[9]) + (a[3] * a[8]) + (a[4] * a[7]) + (a[5] * a[6]));
+        long c12 = 2 * ((a[0] * a[12]) + (a[1] * a[11]) + (a[2] * a[10]) + (a[3] * a[9]) + (a[4] * a[8]) + (a[5] * a[7])) + (a[6] * a[6]);
+        long c13 = 2 * ((a[0] * a[13]) + (a[1] * a[12]) + (a[2] * a[11]) + (a[3] * a[10]) + (a[4] * a[9]) + (a[5] * a[8]) + (a[6] * a[7]));
+        long c14 = 2 * ((a[1] * a[13]) + (a[2] * a[12]) + (a[3] * a[11]) + (a[4] * a[10]) + (a[5] * a[9]) + (a[6] * a[8])) + (a[7] * a[7]);
+        long c15 = 2 * ((a[2] * a[13]) + (a[3] * a[12]) + (a[4] * a[11]) + (a[5] * a[10]) + (a[6] * a[9]) + (a[7] * a[8]));
+        long c16 = 2 * ((a[3] * a[13]) + (a[4] * a[12]) + (a[5] * a[11]) + (a[6] * a[10]) + (a[7] * a[9])) + (a[8] * a[8]);
+        long c17 = 2 * ((a[4] * a[13]) + (a[5] * a[12]) + (a[6] * a[11]) + (a[7] * a[10]) + (a[8] * a[9]));
+        long c18 = 2 * ((a[5] * a[13]) + (a[6] * a[12]) + (a[7] * a[11]) + (a[8] * a[10])) + (a[9] * a[9]);
+        long c19 = 2 * ((a[6] * a[13]) + (a[7] * a[12]) + (a[8] * a[11]) + (a[9] * a[10]));
+        long c20 = 2 * ((a[7] * a[13]) + (a[8] * a[12]) + (a[9] * a[11])) + (a[10] * a[10]);
+        long c21 = 2 * ((a[8] * a[13]) + (a[9] * a[12]) + (a[10] * a[11]));
+        long c22 = 2 * ((a[9] * a[13]) + (a[10] * a[12])) + (a[11] * a[11]);
+        long c23 = 2 * ((a[10] * a[13]) + (a[11] * a[12]));
+        long c24 = 2 * ((a[11] * a[13])) + (a[12] * a[12]);
+        long c25 = 2 * ((a[12] * a[13]));
+        long c26 = (a[13] * a[13]);
+
+        carryReduce(r, c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26);
+    }
+}
+

src/share/classes/sun/security/util/math/intpoly/header.txt

+/*
+ * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * This file is generated by FieldGen.jsh. Do not modify it directly.
+ */

test/sun/security/util/math/BigIntegerModuloP.java

@@ -27,6 +27,8 @@ import sun.security.util.math.*;
 
 import java.math.BigInteger;
 import java.nio.ByteBuffer;
+import java.util.Arrays;
+import java.util.Optional;
 
 /**
  * Arithmetic in the field of integers modulo a prime value implemented using
@@ -170,6 +172,13 @@ public class BigIntegerModuloP implements IntegerFieldModuloP {
             super(v);
         }
 
+        @Override
+        public void conditionalSet(IntegerModuloP b, int set) {
+            if (set == 1) {
+                v = b.asBigInteger();
+            }
+        }
+
         @Override
         public void conditionalSwapWith(MutableIntegerModuloP b, int swap) {
             if (swap == 1) {
@@ -244,6 +253,18 @@ public class BigIntegerModuloP implements IntegerFieldModuloP {
             return this;
         }
 
+        @Override
+        public MutableElement setAdditiveInverse() {
+            v = BigInteger.ZERO.subtract(v);
+            return this;
+        }
+
+        @Override
+        public MutableElement setReduced() {
+            // do nothing
+            return this;
+        }
+
     }
 
     private class SmallElement extends ImmutableElement implements SmallValue {

test/sun/security/util/math/TestIntegerModuloP.java

@@ -23,16 +23,23 @@
 
 /*
  * @test
- * @bug 8181594
+ * @bug 8181594 8208648
  * @summary Test proper operation of integer field arithmetic
  * @modules java.base/sun.security.util java.base/sun.security.util.math java.base/sun.security.util.math.intpoly
  * @build BigIntegerModuloP
  * @run main TestIntegerModuloP sun.security.util.math.intpoly.IntegerPolynomial25519 32 0
  * @run main TestIntegerModuloP sun.security.util.math.intpoly.IntegerPolynomial448 56 1
  * @run main TestIntegerModuloP sun.security.util.math.intpoly.IntegerPolynomial1305 16 2
+ * @run main TestIntegerModuloP sun.security.util.math.intpoly.IntegerPolynomialP256 32 5
+ * @run main TestIntegerModuloP sun.security.util.math.intpoly.IntegerPolynomialP384 48 6
+ * @run main TestIntegerModuloP sun.security.util.math.intpoly.IntegerPolynomialP521 66 7
+ * @run main TestIntegerModuloP sun.security.util.math.intpoly.P256OrderField 32 8
+ * @run main TestIntegerModuloP sun.security.util.math.intpoly.P384OrderField 48 9
+ * @run main TestIntegerModuloP sun.security.util.math.intpoly.P521OrderField 66 10
  */
 
 import sun.security.util.math.*;
+import sun.security.util.math.intpoly.*;
 import java.util.function.*;
 
 import java.util.*;
@@ -124,11 +131,9 @@ public class TestIntegerModuloP {
         } catch (Exception ex) {
             throw new RuntimeException(ex);
         }
-
         System.out.println("All tests passed");
     }
 
-
     static void assertEqual(IntegerModuloP e1, IntegerModuloP e2) {
 
         if (!e1.asBigInteger().equals(e2.asBigInteger())) {
@@ -302,6 +307,17 @@ public class TestIntegerModuloP {
             TestPair<IntegerModuloP> result2 =
                 applyAndCheck(addFunc2, left, right);
 
+            if (elem.test.getField() instanceof IntegerPolynomial) {
+                IntegerPolynomial field =
+                    (IntegerPolynomial) elem.test.getField();
+                int numAdds = field.getMaxAdds();
+                for (int j = 1; j < numAdds; j++) {
+                    ElemFunction addFunc3 = ADD_FUNCTIONS.
+                        get(random.nextInt(ADD_FUNCTIONS.size()));
+                    result2 = applyAndCheck(addFunc3, left, right);
+                }
+            }
+
             ElemFunction multFunc2 =
                 MULT_FUNCTIONS.get(random.nextInt(MULT_FUNCTIONS.size()));
             TestPair<MutableIntegerModuloP> multResult =