initial commit

LICENSE.md

@@ -671,4 +671,4 @@ into proprietary programs.  If your program is a subroutine library, you
 may consider it more useful to permit linking proprietary applications with
 the library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.

README.md

@@ -0,0 +1,9 @@
+### ninty-233
+
+ninty-233 is a library for [ECC](https://en.wikipedia.org/wiki/Elliptic-curve_cryptography) operations using sect233r1 / NIST B-233, the curve used in the iQue Player and Nintendo Wii.  
+
+It can be used for ECDH (used to create some encryption keys on the iQue Player) and ECDSA signing/verification (used to sign game saves on both consoles and to sign recrypt.sys on the iQue Player).  
+
+Arbitrary-precision arithmetic is done using the public domain [C++ Big Integer Library](https://mattmccutchen.net/bigint/) by Matt McCutchen.  
+
+SHA1 implementation is from the public domain [WjCryptLib](https://github.com/WaterJuice/WjCryptLib) by [WaterJuice](https://github.com/WaterJuice).  

src/bigint/include/BigInteger.hpp

@@ -0,0 +1,215 @@
+#ifndef BIGINTEGER_H
+#define BIGINTEGER_H
+
+#include "BigUnsigned.hpp"
+
+/* A BigInteger object represents a signed integer of size limited only by
+ * available memory.  BigUnsigneds support most mathematical operators and can
+ * be converted to and from most primitive integer types.
+ *
+ * A BigInteger is just an aggregate of a BigUnsigned and a sign.  (It is no
+ * longer derived from BigUnsigned because that led to harmful implicit
+ * conversions.) */
+class BigInteger {
+
+public:
+	typedef BigUnsigned::Blk Blk;
+	typedef BigUnsigned::Index Index;
+	typedef BigUnsigned::CmpRes CmpRes;
+	static const CmpRes
+		less    = BigUnsigned::less   ,
+		equal   = BigUnsigned::equal  ,
+		greater = BigUnsigned::greater;
+	// Enumeration for the sign of a BigInteger.
+	enum Sign { negative = -1, zero = 0, positive = 1 };
+
+protected:
+	Sign sign;
+	BigUnsigned mag;
+
+public:
+	// Constructs zero.
+	BigInteger() : sign(zero), mag() {}
+
+	// Copy constructor
+	BigInteger(const BigInteger &x) : sign(x.sign), mag(x.mag) {};
+
+	// Assignment operator
+	void operator=(const BigInteger &x);
+
+	// Constructor that copies from a given array of blocks with a sign.
+	BigInteger(const Blk *b, Index blen, Sign s);
+
+	// Nonnegative constructor that copies from a given array of blocks.
+	BigInteger(const Blk *b, Index blen) : mag(b, blen) {
+		sign = mag.isZero() ? zero : positive;
+	}
+
+	// Constructor from a BigUnsigned and a sign
+	BigInteger(const BigUnsigned &x, Sign s);
+
+	// Nonnegative constructor from a BigUnsigned
+	BigInteger(const BigUnsigned &x) : mag(x) {
+		sign = mag.isZero() ? zero : positive;
+	}
+
+	// Constructors from primitive integer types
+	BigInteger(unsigned long  x);
+	BigInteger(         long  x);
+	BigInteger(unsigned int   x);
+	BigInteger(         int   x);
+	BigInteger(unsigned short x);
+	BigInteger(         short x);
+
+	/* Converters to primitive integer types
+	 * The implicit conversion operators caused trouble, so these are now
+	 * named. */
+	unsigned long  toUnsignedLong () const;
+	long           toLong         () const;
+	unsigned int   toUnsignedInt  () const;
+	int            toInt          () const;
+	unsigned short toUnsignedShort() const;
+	short          toShort        () const;
+protected:
+	// Helper
+	template <class X> X convertToUnsignedPrimitive() const;
+	template <class X, class UX> X convertToSignedPrimitive() const;
+public:
+
+	// ACCESSORS
+	Sign getSign() const { return sign; }
+	/* The client can't do any harm by holding a read-only reference to the
+	 * magnitude. */
+	const BigUnsigned &getMagnitude() const { return mag; }
+
+	// Some accessors that go through to the magnitude
+	Index getLength() const { return mag.getLength(); }
+	Index getCapacity() const { return mag.getCapacity(); }
+	Blk getBlock(Index i) const { return mag.getBlock(i); }
+	bool isZero() const { return sign == zero; } // A bit special
+
+	// COMPARISONS
+
+	// Compares this to x like Perl's <=>
+	CmpRes compareTo(const BigInteger &x) const;
+
+	// Ordinary comparison operators
+	bool operator ==(const BigInteger &x) const {
+		return sign == x.sign && mag == x.mag;
+	}
+	bool operator !=(const BigInteger &x) const { return !operator ==(x); };
+	bool operator < (const BigInteger &x) const { return compareTo(x) == less   ; }
+	bool operator <=(const BigInteger &x) const { return compareTo(x) != greater; }
+	bool operator >=(const BigInteger &x) const { return compareTo(x) != less   ; }
+	bool operator > (const BigInteger &x) const { return compareTo(x) == greater; }
+
+	// OPERATORS -- See the discussion in BigUnsigned.hh.
+	void add     (const BigInteger &a, const BigInteger &b);
+	void subtract(const BigInteger &a, const BigInteger &b);
+	void multiply(const BigInteger &a, const BigInteger &b);
+	/* See the comment on BigUnsigned::divideWithRemainder.  Semantics
+	 * differ from those of primitive integers when negatives and/or zeros
+	 * are involved. */
+	void divideWithRemainder(const BigInteger &b, BigInteger &q);
+	void negate(const BigInteger &a);
+	
+	/* Bitwise operators are not provided for BigIntegers.  Use
+	 * getMagnitude to get the magnitude and operate on that instead. */
+
+	BigInteger operator +(const BigInteger &x) const;
+	BigInteger operator -(const BigInteger &x) const;
+	BigInteger operator *(const BigInteger &x) const;
+	BigInteger operator /(const BigInteger &x) const;
+	BigInteger operator %(const BigInteger &x) const;
+	BigInteger operator -() const;
+
+	void operator +=(const BigInteger &x);
+	void operator -=(const BigInteger &x);
+	void operator *=(const BigInteger &x);
+	void operator /=(const BigInteger &x);
+	void operator %=(const BigInteger &x);
+	void flipSign();
+
+	// INCREMENT/DECREMENT OPERATORS
+	void operator ++(   );
+	void operator ++(int);
+	void operator --(   );
+	void operator --(int);
+};
+
+// NORMAL OPERATORS
+/* These create an object to hold the result and invoke
+ * the appropriate put-here operation on it, passing
+ * this and x.  The new object is then returned. */
+inline BigInteger BigInteger::operator +(const BigInteger &x) const {
+	BigInteger ans;
+	ans.add(*this, x);
+	return ans;
+}
+inline BigInteger BigInteger::operator -(const BigInteger &x) const {
+	BigInteger ans;
+	ans.subtract(*this, x);
+	return ans;
+}
+inline BigInteger BigInteger::operator *(const BigInteger &x) const {
+	BigInteger ans;
+	ans.multiply(*this, x);
+	return ans;
+}
+inline BigInteger BigInteger::operator /(const BigInteger &x) const {
+	if (x.isZero()) throw "BigInteger::operator /: division by zero";
+	BigInteger q, r;
+	r = *this;
+	r.divideWithRemainder(x, q);
+	return q;
+}
+inline BigInteger BigInteger::operator %(const BigInteger &x) const {
+	if (x.isZero()) throw "BigInteger::operator %: division by zero";
+	BigInteger q, r;
+	r = *this;
+	r.divideWithRemainder(x, q);
+	return r;
+}
+inline BigInteger BigInteger::operator -() const {
+	BigInteger ans;
+	ans.negate(*this);
+	return ans;
+}
+
+/*
+ * ASSIGNMENT OPERATORS
+ * 
+ * Now the responsibility for making a temporary copy if necessary
+ * belongs to the put-here operations.  See Assignment Operators in
+ * BigUnsigned.hh.
+ */
+inline void BigInteger::operator +=(const BigInteger &x) {
+	add(*this, x);
+}
+inline void BigInteger::operator -=(const BigInteger &x) {
+	subtract(*this, x);
+}
+inline void BigInteger::operator *=(const BigInteger &x) {
+	multiply(*this, x);
+}
+inline void BigInteger::operator /=(const BigInteger &x) {
+	if (x.isZero()) throw "BigInteger::operator /=: division by zero";
+	/* The following technique is slightly faster than copying *this first
+	 * when x is large. */
+	BigInteger q;
+	divideWithRemainder(x, q);
+	// *this contains the remainder, but we overwrite it with the quotient.
+	*this = q;
+}
+inline void BigInteger::operator %=(const BigInteger &x) {
+	if (x.isZero()) throw "BigInteger::operator %=: division by zero";
+	BigInteger q;
+	// Mods *this by x.  Don't care about quotient left in q.
+	divideWithRemainder(x, q);
+}
+// This one is trivial
+inline void BigInteger::flipSign() {
+	sign = Sign(-sign);
+}
+
+#endif

src/bigint/include/BigIntegerAlgorithms.hpp

@@ -0,0 +1,25 @@
+#ifndef BIGINTEGERALGORITHMS_H
+#define BIGINTEGERALGORITHMS_H
+
+#include "BigInteger.hpp"
+
+/* Some mathematical algorithms for big integers.
+ * This code is new and, as such, experimental. */
+
+// Returns the greatest common divisor of a and b.
+BigUnsigned gcd(BigUnsigned a, BigUnsigned b);
+
+/* Extended Euclidean algorithm.
+ * Given m and n, finds gcd g and numbers r, s such that r*m + s*n == g. */
+void extendedEuclidean(BigInteger m, BigInteger n,
+		BigInteger &g, BigInteger &r, BigInteger &s);
+
+/* Returns the multiplicative inverse of x modulo n, or throws an exception if
+ * they have a common factor. */
+BigUnsigned modinv(const BigInteger &x, const BigUnsigned &n);
+
+// Returns (base ^ exponent) % modulus.
+BigUnsigned modexp(const BigInteger &base, const BigUnsigned &exponent,
+		const BigUnsigned &modulus);
+
+#endif

src/bigint/include/BigIntegerLibrary.hpp

@@ -0,0 +1,8 @@
+// This header file includes all of the library header files.
+
+#include "NumberlikeArray.hpp"
+#include "BigUnsigned.hpp"
+#include "BigInteger.hpp"
+#include "BigIntegerAlgorithms.hpp"
+#include "BigUnsignedInABase.hpp"
+#include "BigIntegerUtils.hpp"

src/bigint/include/BigIntegerUtils.hpp

@@ -0,0 +1,72 @@
+#ifndef BIGINTEGERUTILS_H
+#define BIGINTEGERUTILS_H
+
+#include "BigInteger.hpp"
+#include <string>
+#include <iostream>
+
+/* This file provides:
+ * - Convenient std::string <-> BigUnsigned/BigInteger conversion routines
+ * - std::ostream << operators for BigUnsigned/BigInteger */
+
+// std::string conversion routines.  Base 10 only.
+std::string bigUnsignedToString(const BigUnsigned &x);
+std::string bigIntegerToString(const BigInteger &x);
+BigUnsigned stringToBigUnsigned(const std::string &s);
+BigInteger stringToBigInteger(const std::string &s);
+
+// Creates a BigInteger from data such as `char's; read below for details.
+template <class T>
+BigInteger dataToBigInteger(const T* data, BigInteger::Index length, BigInteger::Sign sign);
+
+// Outputs x to os, obeying the flags `dec', `hex', `bin', and `showbase'.
+std::ostream &operator <<(std::ostream &os, const BigUnsigned &x);
+
+// Outputs x to os, obeying the flags `dec', `hex', `bin', and `showbase'.
+// My somewhat arbitrary policy: a negative sign comes before a base indicator (like -0xFF).
+std::ostream &operator <<(std::ostream &os, const BigInteger &x);
+
+// BEGIN TEMPLATE DEFINITIONS.
+
+/*
+ * Converts binary data to a BigInteger.
+ * Pass an array `data', its length, and the desired sign.
+ *
+ * Elements of `data' may be of any type `T' that has the following
+ * two properties (this includes almost all integral types):
+ *
+ * (1) `sizeof(T)' correctly gives the amount of binary data in one
+ * value of `T' and is a factor of `sizeof(Blk)'.
+ *
+ * (2) When a value of `T' is casted to a `Blk', the low bytes of
+ * the result contain the desired binary data.
+ */
+template <class T>
+BigInteger dataToBigInteger(const T* data, BigInteger::Index length, BigInteger::Sign sign) {
+	// really ceiling(numBytes / sizeof(BigInteger::Blk))
+	unsigned int pieceSizeInBits = 8 * sizeof(T);
+	unsigned int piecesPerBlock = sizeof(BigInteger::Blk) / sizeof(T);
+	unsigned int numBlocks = (length + piecesPerBlock - 1) / piecesPerBlock;
+
+	// Allocate our block array
+	BigInteger::Blk *blocks = new BigInteger::Blk[numBlocks];
+
+	BigInteger::Index blockNum, pieceNum, pieceNumHere;
+
+	// Convert
+	for (blockNum = 0, pieceNum = 0; blockNum < numBlocks; blockNum++) {
+		BigInteger::Blk curBlock = 0;
+		for (pieceNumHere = 0; pieceNumHere < piecesPerBlock && pieceNum < length;
+			pieceNumHere++, pieceNum++)
+			curBlock |= (BigInteger::Blk(data[pieceNum]) << (pieceSizeInBits * pieceNumHere));
+		blocks[blockNum] = curBlock;
+	}
+
+	// Create the BigInteger.
+	BigInteger x(blocks, numBlocks, sign);
+
+	delete [] blocks;
+	return x;
+}
+
+#endif

src/bigint/include/BigUnsigned.hpp

@@ -0,0 +1,418 @@
+#ifndef BIGUNSIGNED_H
+#define BIGUNSIGNED_H
+
+#include "NumberlikeArray.hpp"
+
+/* A BigUnsigned object represents a nonnegative integer of size limited only by
+ * available memory.  BigUnsigneds support most mathematical operators and can
+ * be converted to and from most primitive integer types.
+ *
+ * The number is stored as a NumberlikeArray of unsigned longs as if it were
+ * written in base 256^sizeof(unsigned long).  The least significant block is
+ * first, and the length is such that the most significant block is nonzero. */
+class BigUnsigned : protected NumberlikeArray<unsigned long> {
+
+public:
+	// Enumeration for the result of a comparison.
+	enum CmpRes { less = -1, equal = 0, greater = 1 };
+
+	// BigUnsigneds are built with a Blk type of unsigned long.
+	typedef unsigned long Blk;
+
+	typedef NumberlikeArray<Blk>::Index Index;
+	NumberlikeArray<Blk>::N;
+
+protected:
+	// Creates a BigUnsigned with a capacity; for internal use.
+	BigUnsigned(int, Index c) : NumberlikeArray<Blk>(0, c) {}
+
+	// Decreases len to eliminate any leading zero blocks.
+	void zapLeadingZeros() { 
+		while (len > 0 && blk[len - 1] == 0)
+			len--;
+	}
+
+public:
+	// Constructs zero.
+	BigUnsigned() : NumberlikeArray<Blk>() {}
+
+	// Copy constructor
+	BigUnsigned(const BigUnsigned &x) : NumberlikeArray<Blk>(x) {}
+
+	// Assignment operator
+	void operator=(const BigUnsigned &x) {
+		NumberlikeArray<Blk>::operator =(x);
+	}
+
+	// Constructor that copies from a given array of blocks.
+	BigUnsigned(const Blk *b, Index blen) : NumberlikeArray<Blk>(b, blen) {
+		// Eliminate any leading zeros we may have been passed.
+		zapLeadingZeros();
+	}
+
+	// Destructor.  NumberlikeArray does the delete for us.
+	~BigUnsigned() {}
+	
+	// Constructors from primitive integer types
+	BigUnsigned(unsigned long  x);
+	BigUnsigned(         long  x);
+	BigUnsigned(unsigned int   x);
+	BigUnsigned(         int   x);
+	BigUnsigned(unsigned short x);
+	BigUnsigned(         short x);
+protected:
+	// Helpers
+	template <class X> void initFromPrimitive      (X x);
+	template <class X> void initFromSignedPrimitive(X x);
+public:
+
+	/* Converters to primitive integer types
+	 * The implicit conversion operators caused trouble, so these are now
+	 * named. */
+	unsigned long  toUnsignedLong () const;
+	long           toLong         () const;
+	unsigned int   toUnsignedInt  () const;
+	int            toInt          () const;
+	unsigned short toUnsignedShort() const;
+	short          toShort        () const;
+protected:
+	// Helpers
+	template <class X> X convertToSignedPrimitive() const;
+	template <class X> X convertToPrimitive      () const;
+public:
+
+	// BIT/BLOCK ACCESSORS
+
+	// Expose these from NumberlikeArray directly.
+	NumberlikeArray<Blk>::getCapacity;
+	NumberlikeArray<Blk>::getLength;
+
+	/* Returns the requested block, or 0 if it is beyond the length (as if
+	 * the number had 0s infinitely to the left). */
+	Blk getBlock(Index i) const { return i >= len ? 0 : blk[i]; }
+	/* Sets the requested block.  The number grows or shrinks as necessary. */
+	void setBlock(Index i, Blk newBlock);
+
+	// The number is zero if and only if the canonical length is zero.
+	bool isZero() const { return NumberlikeArray<Blk>::isEmpty(); }
+
+	/* Returns the length of the number in bits, i.e., zero if the number
+	 * is zero and otherwise one more than the largest value of bi for
+	 * which getBit(bi) returns true. */
+	Index bitLength() const;
+	/* Get the state of bit bi, which has value 2^bi.  Bits beyond the
+	 * number's length are considered to be 0. */
+	bool getBit(Index bi) const {
+		return (getBlock(bi / N) & (Blk(1) << (bi % N))) != 0;
+	}
+	/* Sets the state of bit bi to newBit.  The number grows or shrinks as
+	 * necessary. */
+	void setBit(Index bi, bool newBit);
+
+	// COMPARISONS
+
+	// Compares this to x like Perl's <=>
+	CmpRes compareTo(const BigUnsigned &x) const;
+
+	// Ordinary comparison operators
+	bool operator ==(const BigUnsigned &x) const {
+		return NumberlikeArray<Blk>::operator ==(x);
+	}
+	bool operator !=(const BigUnsigned &x) const {
+		return NumberlikeArray<Blk>::operator !=(x);
+	}
+	bool operator < (const BigUnsigned &x) const { return compareTo(x) == less   ; }
+	bool operator <=(const BigUnsigned &x) const { return compareTo(x) != greater; }
+	bool operator >=(const BigUnsigned &x) const { return compareTo(x) != less   ; }
+	bool operator > (const BigUnsigned &x) const { return compareTo(x) == greater; }
+
+	/*
+	 * BigUnsigned and BigInteger both provide three kinds of operators.
+	 * Here ``big-integer'' refers to BigInteger or BigUnsigned.
+	 *
+	 * (1) Overloaded ``return-by-value'' operators:
+	 *     +, -, *, /, %, unary -, &, |, ^, <<, >>.
+	 * Big-integer code using these operators looks identical to code using
+	 * the primitive integer types.  These operators take one or two
+	 * big-integer inputs and return a big-integer result, which can then
+	 * be assigned to a BigInteger variable or used in an expression.
+	 * Example:
+	 *     BigInteger a(1), b = 1;
+	 *     BigInteger c = a + b;
+	 *
+	 * (2) Overloaded assignment operators:
+	 *     +=, -=, *=, /=, %=, flipSign, &=, |=, ^=, <<=, >>=, ++, --.
+	 * Again, these are used on big integers just like on ints.  They take
+	 * one writable big integer that both provides an operand and receives a
+	 * result.  Most also take a second read-only operand.
+	 * Example:
+	 *     BigInteger a(1), b(1);
+	 *     a += b;
+	 *
+	 * (3) Copy-less operations: `add', `subtract', etc.
+	 * These named methods take operands as arguments and store the result
+	 * in the receiver (*this), avoiding unnecessary copies and allocations.
+	 * `divideWithRemainder' is special: it both takes the dividend from and
+	 * stores the remainder into the receiver, and it takes a separate
+	 * object in which to store the quotient.  NOTE: If you are wondering
+	 * why these don't return a value, you probably mean to use the
+	 * overloaded return-by-value operators instead.
+	 * 
+	 * Examples:
+	 *     BigInteger a(43), b(7), c, d;
+	 *
+	 *     c = a + b;   // Now c == 50.
+	 *     c.add(a, b); // Same effect but without the two copies.
+	 *
+	 *     c.divideWithRemainder(b, d);
+	 *     // 50 / 7; now d == 7 (quotient) and c == 1 (remainder).
+	 *
+	 *     // ``Aliased'' calls now do the right thing using a temporary
+	 *     // copy, but see note on `divideWithRemainder'.
+	 *     a.add(a, b); 
+	 */
+
+	// COPY-LESS OPERATIONS
+
+	// These 8: Arguments are read-only operands, result is saved in *this.
+	void add(const BigUnsigned &a, const BigUnsigned &b);
+	void subtract(const BigUnsigned &a, const BigUnsigned &b);
+	void multiply(const BigUnsigned &a, const BigUnsigned &b);
+	void bitAnd(const BigUnsigned &a, const BigUnsigned &b);
+	void bitOr(const BigUnsigned &a, const BigUnsigned &b);
+	void bitXor(const BigUnsigned &a, const BigUnsigned &b);
+	/* Negative shift amounts translate to opposite-direction shifts,
+	 * except for -2^(8*sizeof(int)-1) which is unimplemented. */
+	void bitShiftLeft(const BigUnsigned &a, int b);
+	void bitShiftRight(const BigUnsigned &a, int b);
+
+	/* `a.divideWithRemainder(b, q)' is like `q = a / b, a %= b'.
+	 * / and % use semantics similar to Knuth's, which differ from the
+	 * primitive integer semantics under division by zero.  See the
+	 * implementation in BigUnsigned.cc for details.
+	 * `a.divideWithRemainder(b, a)' throws an exception: it doesn't make
+	 * sense to write quotient and remainder into the same variable. */
+	void divideWithRemainder(const BigUnsigned &b, BigUnsigned &q);
+
+	/* `divide' and `modulo' are no longer offered.  Use
+	 * `divideWithRemainder' instead. */
+
+	// OVERLOADED RETURN-BY-VALUE OPERATORS
+	BigUnsigned operator +(const BigUnsigned &x) const;
+	BigUnsigned operator -(const BigUnsigned &x) const;
+	BigUnsigned operator *(const BigUnsigned &x) const;
+	BigUnsigned operator /(const BigUnsigned &x) const;
+	BigUnsigned operator %(const BigUnsigned &x) const;
+	/* OK, maybe unary minus could succeed in one case, but it really
+	 * shouldn't be used, so it isn't provided. */
+	BigUnsigned operator &(const BigUnsigned &x) const;
+	BigUnsigned operator |(const BigUnsigned &x) const;
+	BigUnsigned operator ^(const BigUnsigned &x) const;
+	BigUnsigned operator <<(int b) const;
+	BigUnsigned operator >>(int b) const;
+
+	// OVERLOADED ASSIGNMENT OPERATORS
+	void operator +=(const BigUnsigned &x);
+	void operator -=(const BigUnsigned &x);
+	void operator *=(const BigUnsigned &x);
+	void operator /=(const BigUnsigned &x);
+	void operator %=(const BigUnsigned &x);
+	void operator &=(const BigUnsigned &x);
+	void operator |=(const BigUnsigned &x);
+	void operator ^=(const BigUnsigned &x);
+	void operator <<=(int b);
+	void operator >>=(int b);
+
+	/* INCREMENT/DECREMENT OPERATORS
+	 * To discourage messy coding, these do not return *this, so prefix
+	 * and postfix behave the same. */
+	void operator ++(   );
+	void operator ++(int);
+	void operator --(   );
+	void operator --(int);
+
+	// Helper function that needs access to BigUnsigned internals
+	friend Blk getShiftedBlock(const BigUnsigned &num, Index x,
+			unsigned int y);
+
+	// See BigInteger.cc.
+	template <class X>
+	friend X convertBigUnsignedToPrimitiveAccess(const BigUnsigned &a);
+};
+
+/* Implementing the return-by-value and assignment operators in terms of the
+ * copy-less operations.  The copy-less operations are responsible for making
+ * any necessary temporary copies to work around aliasing. */
+
+inline BigUnsigned BigUnsigned::operator +(const BigUnsigned &x) const {
+	BigUnsigned ans;
+	ans.add(*this, x);
+	return ans;
+}
+inline BigUnsigned BigUnsigned::operator -(const BigUnsigned &x) const {
+	BigUnsigned ans;
+	ans.subtract(*this, x);
+	return ans;
+}
+inline BigUnsigned BigUnsigned::operator *(const BigUnsigned &x) const {
+	BigUnsigned ans;
+	ans.multiply(*this, x);
+	return ans;
+}
+inline BigUnsigned BigUnsigned::operator /(const BigUnsigned &x) const {
+	if (x.isZero()) throw "BigUnsigned::operator /: division by zero";
+	BigUnsigned q, r;
+	r = *this;
+	r.divideWithRemainder(x, q);
+	return q;
+}
+inline BigUnsigned BigUnsigned::operator %(const BigUnsigned &x) const {
+	if (x.isZero()) throw "BigUnsigned::operator %: division by zero";
+	BigUnsigned q, r;
+	r = *this;
+	r.divideWithRemainder(x, q);
+	return r;
+}
+inline BigUnsigned BigUnsigned::operator &(const BigUnsigned &x) const {
+	BigUnsigned ans;
+	ans.bitAnd(*this, x);
+	return ans;
+}
+inline BigUnsigned BigUnsigned::operator |(const BigUnsigned &x) const {
+	BigUnsigned ans;
+	ans.bitOr(*this, x);
+	return ans;
+}
+inline BigUnsigned BigUnsigned::operator ^(const BigUnsigned &x) const {
+	BigUnsigned ans;
+	ans.bitXor(*this, x);
+	return ans;
+}
+inline BigUnsigned BigUnsigned::operator <<(int b) const {
+	BigUnsigned ans;
+	ans.bitShiftLeft(*this, b);
+	return ans;
+}
+inline BigUnsigned BigUnsigned::operator >>(int b) const {
+	BigUnsigned ans;
+	ans.bitShiftRight(*this, b);
+	return ans;
+}
+
+inline void BigUnsigned::operator +=(const BigUnsigned &x) {
+	add(*this, x);
+}
+inline void BigUnsigned::operator -=(const BigUnsigned &x) {
+	subtract(*this, x);
+}
+inline void BigUnsigned::operator *=(const BigUnsigned &x) {
+	multiply(*this, x);
+}
+inline void BigUnsigned::operator /=(const BigUnsigned &x) {
+	if (x.isZero()) throw "BigUnsigned::operator /=: division by zero";
+	/* The following technique is slightly faster than copying *this first
+	 * when x is large. */
+	BigUnsigned q;
+	divideWithRemainder(x, q);
+	// *this contains the remainder, but we overwrite it with the quotient.
+	*this = q;
+}
+inline void BigUnsigned::operator %=(const BigUnsigned &x) {
+	if (x.isZero()) throw "BigUnsigned::operator %=: division by zero";
+	BigUnsigned q;
+	// Mods *this by x.  Don't care about quotient left in q.
+	divideWithRemainder(x, q);
+}
+inline void BigUnsigned::operator &=(const BigUnsigned &x) {
+	bitAnd(*this, x);
+}
+inline void BigUnsigned::operator |=(const BigUnsigned &x) {
+	bitOr(*this, x);
+}
+inline void BigUnsigned::operator ^=(const BigUnsigned &x) {
+	bitXor(*this, x);
+}
+inline void BigUnsigned::operator <<=(int b) {
+	bitShiftLeft(*this, b);
+}
+inline void BigUnsigned::operator >>=(int b) {
+	bitShiftRight(*this, b);
+}
+
+/* Templates for conversions of BigUnsigned to and from primitive integers.
+ * BigInteger.cc needs to instantiate convertToPrimitive, and the uses in
+ * BigUnsigned.cc didn't do the trick; I think g++ inlined convertToPrimitive
+ * instead of generating linkable instantiations.  So for consistency, I put
+ * all the templates here. */
+
+// CONSTRUCTION FROM PRIMITIVE INTEGERS
+
+/* Initialize this BigUnsigned from the given primitive integer.  The same
+ * pattern works for all primitive integer types, so I put it into a template to
+ * reduce code duplication.  (Don't worry: this is protected and we instantiate
+ * it only with primitive integer types.)  Type X could be signed, but x is
+ * known to be nonnegative. */
+template <class X>
+void BigUnsigned::initFromPrimitive(X x) {
+	if (x == 0)
+		; // NumberlikeArray already initialized us to zero.
+	else {
+		// Create a single block.  blk is NULL; no need to delete it.
+		cap = 1;
+		blk = new Blk[1];
+		len = 1;
+		blk[0] = Blk(x);
+	}
+}
+
+/* Ditto, but first check that x is nonnegative.  I could have put the check in
+ * initFromPrimitive and let the compiler optimize it out for unsigned-type
+ * instantiations, but I wanted to avoid the warning stupidly issued by g++ for
+ * a condition that is constant in *any* instantiation, even if not in all. */
+template <class X>
+void BigUnsigned::initFromSignedPrimitive(X x) {
+	if (x < 0)
+		throw "BigUnsigned constructor: "
+			"Cannot construct a BigUnsigned from a negative number";
+	else
+		initFromPrimitive(x);
+}
+
+// CONVERSION TO PRIMITIVE INTEGERS
+
+/* Template with the same idea as initFromPrimitive.  This might be slightly
+ * slower than the previous version with the masks, but it's much shorter and
+ * clearer, which is the library's stated goal. */
+template <class X>
+X BigUnsigned::convertToPrimitive() const {
+	if (len == 0)
+		// The number is zero; return zero.
+		return 0;
+	else if (len == 1) {
+		// The single block might fit in an X.  Try the conversion.
+		X x = X(blk[0]);
+		// Make sure the result accurately represents the block.
+		if (Blk(x) == blk[0])
+			// Successful conversion.
+			return x;
+		// Otherwise fall through.
+	}
+	throw "BigUnsigned::to<Primitive>: "
+		"Value is too big to fit in the requested type";
+}
+
+/* Wrap the above in an x >= 0 test to make sure we got a nonnegative result,
+ * not a negative one that happened to convert back into the correct nonnegative
+ * one.  (E.g., catch incorrect conversion of 2^31 to the long -2^31.)  Again,
+ * separated to avoid a g++ warning. */
+template <class X>
+X BigUnsigned::convertToSignedPrimitive() const {
+	X x = convertToPrimitive<X>();
+	if (x >= 0)
+		return x;
+	else
+		throw "BigUnsigned::to(Primitive): "
+			"Value is too big to fit in the requested type";
+}
+
+#endif

src/bigint/include/BigUnsignedInABase.hpp

@@ -0,0 +1,122 @@
+#ifndef BIGUNSIGNEDINABASE_H
+#define BIGUNSIGNEDINABASE_H
+
+#include "NumberlikeArray.hpp"
+#include "BigUnsigned.hpp"
+#include <string>
+
+/*
+ * A BigUnsignedInABase object represents a nonnegative integer of size limited
+ * only by available memory, represented in a user-specified base that can fit
+ * in an `unsigned short' (most can, and this saves memory).
+ *
+ * BigUnsignedInABase is intended as an intermediary class with little
+ * functionality of its own.  BigUnsignedInABase objects can be constructed
+ * from, and converted to, BigUnsigneds (requiring multiplication, mods, etc.)
+ * and `std::string's (by switching digit values for appropriate characters).
+ *
+ * BigUnsignedInABase is similar to BigUnsigned.  Note the following:
+ *
+ * (1) They represent the number in exactly the same way, except that
+ * BigUnsignedInABase uses ``digits'' (or Digit) where BigUnsigned uses
+ * ``blocks'' (or Blk).
+ *
+ * (2) Both use the management features of NumberlikeArray.  (In fact, my desire
+ * to add a BigUnsignedInABase class without duplicating a lot of code led me to
+ * introduce NumberlikeArray.)
+ *
+ * (3) The only arithmetic operation supported by BigUnsignedInABase is an
+ * equality test.  Use BigUnsigned for arithmetic.
+ */
+
+class BigUnsignedInABase : protected NumberlikeArray<unsigned short> {
+
+public:
+	// The digits of a BigUnsignedInABase are unsigned shorts.
+	typedef unsigned short Digit;
+	// That's also the type of a base.
+	typedef Digit Base;
+
+protected:
+	// The base in which this BigUnsignedInABase is expressed
+	Base base;
+
+	// Creates a BigUnsignedInABase with a capacity; for internal use.
+	BigUnsignedInABase(int, Index c) : NumberlikeArray<Digit>(0, c) {}
+
+	// Decreases len to eliminate any leading zero digits.
+	void zapLeadingZeros() { 
+		while (len > 0 && blk[len - 1] == 0)
+			len--;
+	}
+
+public:
+	// Constructs zero in base 2.
+	BigUnsignedInABase() : NumberlikeArray<Digit>(), base(2) {}
+
+	// Copy constructor
+	BigUnsignedInABase(const BigUnsignedInABase &x) : NumberlikeArray<Digit>(x), base(x.base) {}
+
+	// Assignment operator
+	void operator =(const BigUnsignedInABase &x) {
+		NumberlikeArray<Digit>::operator =(x);
+		base = x.base;
+	}
+
+	// Constructor that copies from a given array of digits.
+	BigUnsignedInABase(const Digit *d, Index l, Base base);
+
+	// Destructor.  NumberlikeArray does the delete for us.
+	~BigUnsignedInABase() {}
+
+	// LINKS TO BIGUNSIGNED
+	BigUnsignedInABase(const BigUnsigned &x, Base base);
+	operator BigUnsigned() const;
+
+	/* LINKS TO STRINGS
+	 *
+	 * These use the symbols ``0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'' to
+	 * represent digits of 0 through 35.  When parsing strings, lowercase is
+	 * also accepted.
+	 *
+	 * All string representations are big-endian (big-place-value digits
+	 * first).  (Computer scientists have adopted zero-based counting; why
+	 * can't they tolerate little-endian numbers?)
+	 *
+	 * No string representation has a ``base indicator'' like ``0x''.
+	 *
+	 * An exception is made for zero: it is converted to ``0'' and not the
+	 * empty string.
+	 *
+	 * If you want different conventions, write your own routines to go
+	 * between BigUnsignedInABase and strings.  It's not hard.
+	 */
+	operator std::string() const;
+	BigUnsignedInABase(const std::string &s, Base base);
+
+public:
+
+	// ACCESSORS
+	Base getBase() const { return base; }
+
+	// Expose these from NumberlikeArray directly.
+	NumberlikeArray<Digit>::getCapacity;
+	NumberlikeArray<Digit>::getLength;
+
+	/* Returns the requested digit, or 0 if it is beyond the length (as if
+	 * the number had 0s infinitely to the left). */
+	Digit getDigit(Index i) const { return i >= len ? 0 : blk[i]; }
+
+	// The number is zero if and only if the canonical length is zero.
+	bool isZero() const { return NumberlikeArray<Digit>::isEmpty(); }
+
+	/* Equality test.  For the purposes of this test, two BigUnsignedInABase
+	 * values must have the same base to be equal. */ 
+	bool operator ==(const BigUnsignedInABase &x) const {
+		return base == x.base && NumberlikeArray<Digit>::operator ==(x);
+	}
+	bool operator !=(const BigUnsignedInABase &x) const { return !operator ==(x); }
+
+};
+
+#endif

src/bigint/include/NumberlikeArray.hpp

@@ -0,0 +1,177 @@
+#ifndef NUMBERLIKEARRAY_H
+#define NUMBERLIKEARRAY_H
+
+// Make sure we have NULL.
+#ifndef NULL
+#define NULL 0
+#endif
+
+/* A NumberlikeArray<Blk> object holds a heap-allocated array of Blk with a
+ * length and a capacity and provides basic memory management features.
+ * BigUnsigned and BigUnsignedInABase both subclass it.
+ *
+ * NumberlikeArray provides no information hiding.  Subclasses should use
+ * nonpublic inheritance and manually expose members as desired using
+ * declarations like this:
+ *
+ * public:
+ *     NumberlikeArray< the-type-argument >::getLength;
+ */
+template <class Blk>
+class NumberlikeArray {
+public:
+
+	// Type for the index of a block in the array
+	typedef unsigned int Index;
+	// The number of bits in a block, defined below.
+	static const unsigned int N;
+
+	// The current allocated capacity of this NumberlikeArray (in blocks)
+	Index cap;
+	// The actual length of the value stored in this NumberlikeArray (in blocks)
+	Index len;
+	// Heap-allocated array of the blocks (can be NULL if len == 0)
+	Blk *blk;
+
+	// Constructs a ``zero'' NumberlikeArray with the given capacity.
+	NumberlikeArray(Index c) : cap(c), len(0) { 
+		blk = (cap > 0) ? (new Blk[cap]) : NULL;
+	}
+
+	/* Constructs a zero NumberlikeArray without allocating a backing array.
+	 * A subclass that doesn't know the needed capacity at initialization
+	 * time can use this constructor and then overwrite blk without first
+	 * deleting it. */
+	NumberlikeArray() : cap(0), len(0) {
+		blk = NULL;
+	}
+
+	// Destructor.  Note that `delete NULL' is a no-op.
+	~NumberlikeArray() {
+		delete [] blk;
+	}
+
+	/* Ensures that the array has at least the requested capacity; may
+	 * destroy the contents. */
+	void allocate(Index c);
+
+	/* Ensures that the array has at least the requested capacity; does not
+	 * destroy the contents. */
+	void allocateAndCopy(Index c);
+
+	// Copy constructor
+	NumberlikeArray(const NumberlikeArray<Blk> &x);
+
+	// Assignment operator
+	void operator=(const NumberlikeArray<Blk> &x);
+
+	// Constructor that copies from a given array of blocks
+	NumberlikeArray(const Blk *b, Index blen);
+
+	// ACCESSORS
+	Index getCapacity()     const { return cap;      }
+	Index getLength()       const { return len;      }
+	Blk   getBlock(Index i) const { return blk[i];   }
+	bool  isEmpty()         const { return len == 0; }
+
+	/* Equality comparison: checks if both objects have the same length and
+	 * equal (==) array elements to that length.  Subclasses may wish to
+	 * override. */
+	bool operator ==(const NumberlikeArray<Blk> &x) const;
+
+	bool operator !=(const NumberlikeArray<Blk> &x) const {
+		return !operator ==(x);
+	}
+};
+
+/* BEGIN TEMPLATE DEFINITIONS.  They are present here so that source files that
+ * include this header file can generate the necessary real definitions. */
+
+template <class Blk>
+const unsigned int NumberlikeArray<Blk>::N = 8 * sizeof(Blk);
+
+template <class Blk>
+void NumberlikeArray<Blk>::allocate(Index c) {
+	// If the requested capacity is more than the current capacity...
+	if (c > cap) {
+		// Delete the old number array
+		delete [] blk;
+		// Allocate the new array
+		cap = c;
+		blk = new Blk[cap];
+	}
+}
+
+template <class Blk>
+void NumberlikeArray<Blk>::allocateAndCopy(Index c) {
+	// If the requested capacity is more than the current capacity...
+	if (c > cap) {
+		Blk *oldBlk = blk;
+		// Allocate the new number array
+		cap = c;
+		blk = new Blk[cap];
+		// Copy number blocks
+		Index i;
+		for (i = 0; i < len; i++)
+			blk[i] = oldBlk[i];
+		// Delete the old array
+		delete [] oldBlk;
+	}
+}
+
+template <class Blk>
+NumberlikeArray<Blk>::NumberlikeArray(const NumberlikeArray<Blk> &x)
+		: len(x.len) {
+	// Create array
+	cap = len;
+	blk = new Blk[cap];
+	// Copy blocks
+	Index i;
+	for (i = 0; i < len; i++)
+		blk[i] = x.blk[i];
+}
+
+template <class Blk>
+void NumberlikeArray<Blk>::operator=(const NumberlikeArray<Blk> &x) {
+	/* Calls like a = a have no effect; catch them before the aliasing
+	 * causes a problem */
+	if (this == &x)
+		return;
+	// Copy length
+	len = x.len;
+	// Expand array if necessary
+	allocate(len);
+	// Copy number blocks
+	Index i;
+	for (i = 0; i < len; i++)
+		blk[i] = x.blk[i];
+}
+
+template <class Blk>
+NumberlikeArray<Blk>::NumberlikeArray(const Blk *b, Index blen)
+		: cap(blen), len(blen) {
+	// Create array
+	blk = new Blk[cap];
+	// Copy blocks
+	Index i;
+	for (i = 0; i < len; i++)
+		blk[i] = b[i];
+}
+
+template <class Blk>
+bool NumberlikeArray<Blk>::operator ==(const NumberlikeArray<Blk> &x) const {
+	if (len != x.len)
+		// Definitely unequal.
+		return false;
+	else {
+		// Compare corresponding blocks one by one.
+		Index i;
+		for (i = 0; i < len; i++)
+			if (blk[i] != x.blk[i])
+				return false;
+		// No blocks differed, so the objects are equal.
+		return true;
+	}
+}
+
+#endif

src/bigint/src/BigInteger.cpp

@@ -0,0 +1,405 @@
+#include "../include/BigInteger.hpp"
+
+void BigInteger::operator =(const BigInteger &x) {
+	// Calls like a = a have no effect
+	if (this == &x)
+		return;
+	// Copy sign
+	sign = x.sign;
+	// Copy the rest
+	mag = x.mag;
+}
+
+BigInteger::BigInteger(const Blk *b, Index blen, Sign s) : mag(b, blen) {
+	switch (s) {
+	case zero:
+		if (!mag.isZero())
+			throw "BigInteger::BigInteger(const Blk *, Index, Sign): Cannot use a sign of zero with a nonzero magnitude";
+		sign = zero;
+		break;
+	case positive:
+	case negative:
+		// If the magnitude is zero, force the sign to zero.
+		sign = mag.isZero() ? zero : s;
+		break;
+	default:
+		/* g++ seems to be optimizing out this case on the assumption
+		 * that the sign is a valid member of the enumeration.  Oh well. */
+		throw "BigInteger::BigInteger(const Blk *, Index, Sign): Invalid sign";
+	}
+}
+
+BigInteger::BigInteger(const BigUnsigned &x, Sign s) : mag(x) {
+	switch (s) {
+	case zero:
+		if (!mag.isZero())
+			throw "BigInteger::BigInteger(const BigUnsigned &, Sign): Cannot use a sign of zero with a nonzero magnitude";
+		sign = zero;
+		break;
+	case positive:
+	case negative:
+		// If the magnitude is zero, force the sign to zero.
+		sign = mag.isZero() ? zero : s;
+		break;
+	default:
+		/* g++ seems to be optimizing out this case on the assumption
+		 * that the sign is a valid member of the enumeration.  Oh well. */
+		throw "BigInteger::BigInteger(const BigUnsigned &, Sign): Invalid sign";
+	}
+}
+
+/* CONSTRUCTION FROM PRIMITIVE INTEGERS
+ * Same idea as in BigUnsigned.cc, except that negative input results in a
+ * negative BigInteger instead of an exception. */
+
+// Done longhand to let us use initialization.
+BigInteger::BigInteger(unsigned long  x) : mag(x) { sign = mag.isZero() ? zero : positive; }
+BigInteger::BigInteger(unsigned int   x) : mag(x) { sign = mag.isZero() ? zero : positive; }
+BigInteger::BigInteger(unsigned short x) : mag(x) { sign = mag.isZero() ? zero : positive; }
+
+// For signed input, determine the desired magnitude and sign separately.
+
+namespace {
+	template <class X, class UX>
+	BigInteger::Blk magOf(X x) {
+		/* UX(...) cast needed to stop short(-2^15), which negates to
+		 * itself, from sign-extending in the conversion to Blk. */
+		return BigInteger::Blk(x < 0 ? UX(-x) : x);
+	}
+	template <class X>
+	BigInteger::Sign signOf(X x) {
+		return (x == 0) ? BigInteger::zero
+			: (x > 0) ? BigInteger::positive
+			: BigInteger::negative;
+	}
+}
+
+BigInteger::BigInteger(long  x) : sign(signOf(x)), mag(magOf<long , unsigned long >(x)) {}
+BigInteger::BigInteger(int   x) : sign(signOf(x)), mag(magOf<int  , unsigned int  >(x)) {}
+BigInteger::BigInteger(short x) : sign(signOf(x)), mag(magOf<short, unsigned short>(x)) {}
+
+// CONVERSION TO PRIMITIVE INTEGERS
+
+/* Reuse BigUnsigned's conversion to an unsigned primitive integer.
+ * The friend is a separate function rather than
+ * BigInteger::convertToUnsignedPrimitive to avoid requiring BigUnsigned to
+ * declare BigInteger. */
+template <class X>
+inline X convertBigUnsignedToPrimitiveAccess(const BigUnsigned &a) {
+	return a.convertToPrimitive<X>();
+}
+
+template <class X>
+X BigInteger::convertToUnsignedPrimitive() const {
+	if (sign == negative)
+		throw "BigInteger::to<Primitive>: "
+			"Cannot convert a negative integer to an unsigned type";
+	else
+		return convertBigUnsignedToPrimitiveAccess<X>(mag);
+}
+
+/* Similar to BigUnsigned::convertToPrimitive, but split into two cases for
+ * nonnegative and negative numbers. */
+template <class X, class UX>
+X BigInteger::convertToSignedPrimitive() const {
+	if (sign == zero)
+		return 0;
+	else if (mag.getLength() == 1) {
+		// The single block might fit in an X.  Try the conversion.
+		Blk b = mag.getBlock(0);
+		if (sign == positive) {
+			X x = X(b);
+			if (x >= 0 && Blk(x) == b)
+				return x;
+		} else {
+			X x = -X(b);
+			/* UX(...) needed to avoid rejecting conversion of
+			 * -2^15 to a short. */
+			if (x < 0 && Blk(UX(-x)) == b)
+				return x;
+		}
+		// Otherwise fall through.
+	}
+	throw "BigInteger::to<Primitive>: "
+		"Value is too big to fit in the requested type";
+}
+
+unsigned long  BigInteger::toUnsignedLong () const { return convertToUnsignedPrimitive<unsigned long >       (); }
+unsigned int   BigInteger::toUnsignedInt  () const { return convertToUnsignedPrimitive<unsigned int  >       (); }
+unsigned short BigInteger::toUnsignedShort() const { return convertToUnsignedPrimitive<unsigned short>       (); }
+long           BigInteger::toLong         () const { return convertToSignedPrimitive  <long , unsigned long> (); }
+int            BigInteger::toInt          () const { return convertToSignedPrimitive  <int  , unsigned int>  (); }
+short          BigInteger::toShort        () const { return convertToSignedPrimitive  <short, unsigned short>(); }
+
+// COMPARISON
+BigInteger::CmpRes BigInteger::compareTo(const BigInteger &x) const {
+	// A greater sign implies a greater number
+	if (sign < x.sign)
+		return less;
+	else if (sign > x.sign)
+		return greater;
+	else switch (sign) {
+		// If the signs are the same...
+	case zero:
+		return equal; // Two zeros are equal
+	case positive:
+		// Compare the magnitudes
+		return mag.compareTo(x.mag);
+	case negative:
+		// Compare the magnitudes, but return the opposite result
+		return CmpRes(-mag.compareTo(x.mag));
+	default:
+		throw "BigInteger internal error";
+	}
+}
+
+/* COPY-LESS OPERATIONS
+ * These do some messing around to determine the sign of the result,
+ * then call one of BigUnsigned's copy-less operations. */
+
+// See remarks about aliased calls in BigUnsigned.cc .
+#define DTRT_ALIASED(cond, op) \
+	if (cond) { \
+		BigInteger tmpThis; \
+		tmpThis.op; \
+		*this = tmpThis; \
+		return; \
+	}
+
+void BigInteger::add(const BigInteger &a, const BigInteger &b) {
+	DTRT_ALIASED(this == &a || this == &b, add(a, b));
+	// If one argument is zero, copy the other.
+	if (a.sign == zero)
+		operator =(b);
+	else if (b.sign == zero)
+		operator =(a);
+	// If the arguments have the same sign, take the
+	// common sign and add their magnitudes.
+	else if (a.sign == b.sign) {
+		sign = a.sign;
+		mag.add(a.mag, b.mag);
+	} else {
+		// Otherwise, their magnitudes must be compared.
+		switch (a.mag.compareTo(b.mag)) {
+		case equal:
+			// If their magnitudes are the same, copy zero.
+			mag = 0;
+			sign = zero;
+			break;
+			// Otherwise, take the sign of the greater, and subtract
+			// the lesser magnitude from the greater magnitude.
+		case greater:
+			sign = a.sign;
+			mag.subtract(a.mag, b.mag);
+			break;
+		case less:
+			sign = b.sign;
+			mag.subtract(b.mag, a.mag);
+			break;
+		}
+	}
+}
+
+void BigInteger::subtract(const BigInteger &a, const BigInteger &b) {
+	// Notice that this routine is identical to BigInteger::add,
+	// if one replaces b.sign by its opposite.
+	DTRT_ALIASED(this == &a || this == &b, subtract(a, b));
+	// If a is zero, copy b and flip its sign.  If b is zero, copy a.
+	if (a.sign == zero) {
+		mag = b.mag;
+		// Take the negative of _b_'s, sign, not ours.
+		// Bug pointed out by Sam Larkin on 2005.03.30.
+		sign = Sign(-b.sign);
+	} else if (b.sign == zero)
+		operator =(a);
+	// If their signs differ, take a.sign and add the magnitudes.
+	else if (a.sign != b.sign) {
+		sign = a.sign;
+		mag.add(a.mag, b.mag);
+	} else {
+		// Otherwise, their magnitudes must be compared.
+		switch (a.mag.compareTo(b.mag)) {
+			// If their magnitudes are the same, copy zero.
+		case equal:
+			mag = 0;
+			sign = zero;
+			break;
+			// If a's magnitude is greater, take a.sign and
+			// subtract a from b.
+		case greater:
+			sign = a.sign;
+			mag.subtract(a.mag, b.mag);
+			break;
+			// If b's magnitude is greater, take the opposite
+			// of b.sign and subtract b from a.
+		case less:
+			sign = Sign(-b.sign);
+			mag.subtract(b.mag, a.mag);
+			break;
+		}
+	}
+}
+
+void BigInteger::multiply(const BigInteger &a, const BigInteger &b) {
+	DTRT_ALIASED(this == &a || this == &b, multiply(a, b));
+	// If one object is zero, copy zero and return.
+	if (a.sign == zero || b.sign == zero) {
+		sign = zero;
+		mag = 0;
+		return;
+	}
+	// If the signs of the arguments are the same, the result
+	// is positive, otherwise it is negative.
+	sign = (a.sign == b.sign) ? positive : negative;
+	// Multiply the magnitudes.
+	mag.multiply(a.mag, b.mag);
+}
+
+/*
+ * DIVISION WITH REMAINDER
+ * Please read the comments before the definition of
+ * `BigUnsigned::divideWithRemainder' in `BigUnsigned.cc' for lots of
+ * information you should know before reading this function.
+ *
+ * Following Knuth, I decree that x / y is to be
+ * 0 if y==0 and floor(real-number x / y) if y!=0.
+ * Then x % y shall be x - y*(integer x / y).
+ *
+ * Note that x = y * (x / y) + (x % y) always holds.
+ * In addition, (x % y) is from 0 to y - 1 if y > 0,
+ * and from -(|y| - 1) to 0 if y < 0.  (x % y) = x if y = 0.
+ *
+ * Examples: (q = a / b, r = a % b)
+ *	a	b	q	r
+ *	===	===	===	===
+ *	4	3	1	1
+ *	-4	3	-2	2
+ *	4	-3	-2	-2
+ *	-4	-3	1	-1
+ */
+void BigInteger::divideWithRemainder(const BigInteger &b, BigInteger &q) {
+	// Defend against aliased calls;
+	// same idea as in BigUnsigned::divideWithRemainder .
+	if (this == &q)
+		throw "BigInteger::divideWithRemainder: Cannot write quotient and remainder into the same variable";
+	if (this == &b || &q == &b) {
+		BigInteger tmpB(b);
+		divideWithRemainder(tmpB, q);
+		return;
+	}
+
+	// Division by zero gives quotient 0 and remainder *this
+	if (b.sign == zero) {
+		q.mag = 0;
+		q.sign = zero;
+		return;
+	}
+	// 0 / b gives quotient 0 and remainder 0
+	if (sign == zero) {
+		q.mag = 0;
+		q.sign = zero;
+		return;
+	}
+
+	// Here *this != 0, b != 0.
+
+	// Do the operands have the same sign?
+	if (sign == b.sign) {
+		// Yes: easy case.  Quotient is zero or positive.
+		q.sign = positive;
+	} else {
+		// No: harder case.  Quotient is negative.
+		q.sign = negative;
+		// Decrease the magnitude of the dividend by one.
+		mag--;
+		/*
+		 * We tinker with the dividend before and with the
+		 * quotient and remainder after so that the result
+		 * comes out right.  To see why it works, consider the following
+		 * list of examples, where A is the magnitude-decreased
+		 * a, Q and R are the results of BigUnsigned division
+		 * with remainder on A and |b|, and q and r are the
+		 * final results we want:
+		 *
+		 *	a	A	b	Q	R	q	r
+		 *	-3	-2	3	0	2	-1	0
+		 *	-4	-3	3	1	0	-2	2
+		 *	-5	-4	3	1	1	-2	1
+		 *	-6	-5	3	1	2	-2	0
+		 *
+		 * It appears that we need a total of 3 corrections:
+		 * Decrease the magnitude of a to get A.  Increase the
+		 * magnitude of Q to get q (and make it negative).
+		 * Find r = (b - 1) - R and give it the desired sign.
+		 */
+	}
+
+	// Divide the magnitudes.
+	mag.divideWithRemainder(b.mag, q.mag);
+
+	if (sign != b.sign) {
+		// More for the harder case (as described):
+		// Increase the magnitude of the quotient by one.
+		q.mag++;
+		// Modify the remainder.
+		mag.subtract(b.mag, mag);
+		mag--;
+	}
+
+	// Sign of the remainder is always the sign of the divisor b.
+	sign = b.sign;
+
+	// Set signs to zero as necessary.  (Thanks David Allen!)
+	if (mag.isZero())
+		sign = zero;
+	if (q.mag.isZero())
+		q.sign = zero;
+
+	// WHEW!!!
+}
+
+// Negation
+void BigInteger::negate(const BigInteger &a) {
+	DTRT_ALIASED(this == &a, negate(a));
+	// Copy a's magnitude
+	mag = a.mag;
+	// Copy the opposite of a.sign
+	sign = Sign(-a.sign);
+}
+
+// INCREMENT/DECREMENT OPERATORS
+
+// Prefix increment
+void BigInteger::operator ++() {
+	if (sign == negative) {
+		mag--;
+		if (mag == 0)
+			sign = zero;
+	} else {
+		mag++;
+		sign = positive; // if not already
+	}
+}
+
+// Postfix increment: same as prefix
+void BigInteger::operator ++(int) {
+	operator ++();
+}
+
+// Prefix decrement
+void BigInteger::operator --() {
+	if (sign == positive) {
+		mag--;
+		if (mag == 0)
+			sign = zero;
+	} else {
+		mag++;
+		sign = negative;
+	}
+}
+
+// Postfix decrement: same as prefix
+void BigInteger::operator --(int) {
+	operator --();
+}
+

src/bigint/src/BigIntegerAlgorithms.cpp

@@ -0,0 +1,71 @@
+#include "../include/BigIntegerAlgorithms.hpp"
+
+BigUnsigned gcd(BigUnsigned a, BigUnsigned b) {
+	BigUnsigned trash;
+	// Neat in-place alternating technique.
+	for (;;) {
+		if (b.isZero())
+			return a;
+		a.divideWithRemainder(b, trash);
+		if (a.isZero())
+			return b;
+		b.divideWithRemainder(a, trash);
+	}
+}
+
+void extendedEuclidean(BigInteger m, BigInteger n,
+		BigInteger &g, BigInteger &r, BigInteger &s) {
+	if (&g == &r || &g == &s || &r == &s) {
+		throw "BigInteger extendedEuclidean: Outputs are aliased";
+	}
+	BigInteger r1(1), s1(0), r2(0), s2(1), q;
+	/* Invariants:
+	 * r1*m(orig) + s1*n(orig) == m(current)
+	 * r2*m(orig) + s2*n(orig) == n(current) */
+	for (;;) {
+		if (n.isZero()) {
+			r = r1; s = s1; g = m;
+			return;
+		}
+		// Subtract q times the second invariant from the first invariant.
+		m.divideWithRemainder(n, q);
+		r1 -= q*r2; s1 -= q*s2;
+
+		if (m.isZero()) {
+			r = r2; s = s2; g = n;
+			return;
+		}
+		// Subtract q times the first invariant from the second invariant.
+		n.divideWithRemainder(m, q);
+		r2 -= q*r1; s2 -= q*s1;
+	}
+}
+
+BigUnsigned modinv(const BigInteger &x, const BigUnsigned &n) {
+	BigInteger g, r, s;
+	extendedEuclidean(x, n, g, r, s);
+	if (g == 1)
+		// r*x + s*n == 1, so r*x === 1 (mod n), so r is the answer.
+		return (r % n).getMagnitude(); // (r % n) will be nonnegative
+	else
+		throw "BigInteger modinv: x and n have a common factor";
+}
+
+BigUnsigned modexp(const BigInteger &base, const BigUnsigned &exponent,
+		const BigUnsigned &modulus) {
+	BigUnsigned ans = 1, base2 = (base % modulus).getMagnitude();
+	BigUnsigned::Index i = exponent.bitLength();
+	// For each bit of the exponent, most to least significant...
+	while (i > 0) {
+		i--;
+		// Square.
+		ans *= ans;
+		ans %= modulus;
+		// And multiply if the bit is a 1.
+		if (exponent.getBit(i)) {
+			ans *= base2;
+			ans %= modulus;
+		}
+	}
+	return ans;
+}

src/bigint/src/BigIntegerUtils.cpp

@@ -0,0 +1,50 @@
+#include "../include/BigIntegerUtils.hpp"
+#include "../include/BigUnsignedInABase.hpp"
+
+std::string bigUnsignedToString(const BigUnsigned &x) {
+	return std::string(BigUnsignedInABase(x, 10));
+}
+
+std::string bigIntegerToString(const BigInteger &x) {
+	return (x.getSign() == BigInteger::negative)
+		? (std::string("-") + bigUnsignedToString(x.getMagnitude()))
+		: (bigUnsignedToString(x.getMagnitude()));
+}
+
+BigUnsigned stringToBigUnsigned(const std::string &s) {
+	return BigUnsigned(BigUnsignedInABase(s, 10));
+}
+
+BigInteger stringToBigInteger(const std::string &s) {
+	// Recognize a sign followed by a BigUnsigned.
+	return (s[0] == '-') ? BigInteger(stringToBigUnsigned(s.substr(1, s.length() - 1)), BigInteger::negative)
+		: (s[0] == '+') ? BigInteger(stringToBigUnsigned(s.substr(1, s.length() - 1)))
+		: BigInteger(stringToBigUnsigned(s));
+}
+
+std::ostream &operator <<(std::ostream &os, const BigUnsigned &x) {
+	BigUnsignedInABase::Base base;
+	long osFlags = os.flags();
+	if (osFlags & os.dec)
+		base = 10;
+	else if (osFlags & os.hex) {
+		base = 16;
+		if (osFlags & os.showbase)
+			os << "0x";
+	} else if (osFlags & os.oct) {
+		base = 8;
+		if (osFlags & os.showbase)
+			os << '0';
+	} else
+		throw "std::ostream << BigUnsigned: Could not determine the desired base from output-stream flags";
+	std::string s = std::string(BigUnsignedInABase(x, base));
+	os << s;
+	return os;
+}
+
+std::ostream &operator <<(std::ostream &os, const BigInteger &x) {
+	if (x.getSign() == BigInteger::negative)
+		os << '-';
+	os << x.getMagnitude();
+	return os;
+}

src/bigint/src/BigUnsigned.cpp

@@ -0,0 +1,697 @@
+#include "../include/BigUnsigned.hpp"
+
+// Memory management definitions have moved to the bottom of NumberlikeArray.hh.
+
+// The templates used by these constructors and converters are at the bottom of
+// BigUnsigned.hh.
+
+BigUnsigned::BigUnsigned(unsigned long  x) { initFromPrimitive      (x); }
+BigUnsigned::BigUnsigned(unsigned int   x) { initFromPrimitive      (x); }
+BigUnsigned::BigUnsigned(unsigned short x) { initFromPrimitive      (x); }
+BigUnsigned::BigUnsigned(         long  x) { initFromSignedPrimitive(x); }
+BigUnsigned::BigUnsigned(         int   x) { initFromSignedPrimitive(x); }
+BigUnsigned::BigUnsigned(         short x) { initFromSignedPrimitive(x); }
+
+unsigned long  BigUnsigned::toUnsignedLong () const { return convertToPrimitive      <unsigned long >(); }
+unsigned int   BigUnsigned::toUnsignedInt  () const { return convertToPrimitive      <unsigned int  >(); }
+unsigned short BigUnsigned::toUnsignedShort() const { return convertToPrimitive      <unsigned short>(); }
+long           BigUnsigned::toLong         () const { return convertToSignedPrimitive<         long >(); }
+int            BigUnsigned::toInt          () const { return convertToSignedPrimitive<         int  >(); }
+short          BigUnsigned::toShort        () const { return convertToSignedPrimitive<         short>(); }
+
+// BIT/BLOCK ACCESSORS
+
+void BigUnsigned::setBlock(Index i, Blk newBlock) {
+	if (newBlock == 0) {
+		if (i < len) {
+			blk[i] = 0;
+			zapLeadingZeros();
+		}
+		// If i >= len, no effect.
+	} else {
+		if (i >= len) {
+			// The nonzero block extends the number.
+			allocateAndCopy(i+1);
+			// Zero any added blocks that we aren't setting.
+			for (Index j = len; j < i; j++)
+				blk[j] = 0;
+			len = i+1;
+		}
+		blk[i] = newBlock;
+	}
+}
+
+/* Evidently the compiler wants BigUnsigned:: on the return type because, at
+ * that point, it hasn't yet parsed the BigUnsigned:: on the name to get the
+ * proper scope. */
+BigUnsigned::Index BigUnsigned::bitLength() const {
+	if (isZero())
+		return 0;
+	else {
+		Blk leftmostBlock = getBlock(len - 1);
+		Index leftmostBlockLen = 0;
+		while (leftmostBlock != 0) {
+			leftmostBlock >>= 1;
+			leftmostBlockLen++;
+		}
+		return leftmostBlockLen + (len - 1) * N;
+	}
+}
+
+void BigUnsigned::setBit(Index bi, bool newBit) {
+	Index blockI = bi / N;
+	Blk block = getBlock(blockI), mask = Blk(1) << (bi % N);
+	block = newBit ? (block | mask) : (block & ~mask);
+	setBlock(blockI, block);
+}
+
+// COMPARISON
+BigUnsigned::CmpRes BigUnsigned::compareTo(const BigUnsigned &x) const {
+	// A bigger length implies a bigger number.
+	if (len < x.len)
+		return less;
+	else if (len > x.len)
+		return greater;
+	else {
+		// Compare blocks one by one from left to right.
+		Index i = len;
+		while (i > 0) {
+			i--;
+			if (blk[i] == x.blk[i])
+				continue;
+			else if (blk[i] > x.blk[i])
+				return greater;
+			else
+				return less;
+		}
+		// If no blocks differed, the numbers are equal.
+		return equal;
+	}
+}
+
+// COPY-LESS OPERATIONS
+
+/*
+ * On most calls to copy-less operations, it's safe to read the inputs little by
+ * little and write the outputs little by little.  However, if one of the
+ * inputs is coming from the same variable into which the output is to be
+ * stored (an "aliased" call), we risk overwriting the input before we read it.
+ * In this case, we first compute the result into a temporary BigUnsigned
+ * variable and then copy it into the requested output variable *this.
+ * Each put-here operation uses the DTRT_ALIASED macro (Do The Right Thing on
+ * aliased calls) to generate code for this check.
+ * 
+ * I adopted this approach on 2007.02.13 (see Assignment Operators in
+ * BigUnsigned.hh).  Before then, put-here operations rejected aliased calls
+ * with an exception.  I think doing the right thing is better.
+ * 
+ * Some of the put-here operations can probably handle aliased calls safely
+ * without the extra copy because (for example) they process blocks strictly
+ * right-to-left.  At some point I might determine which ones don't need the
+ * copy, but my reasoning would need to be verified very carefully.  For now
+ * I'll leave in the copy.
+ */
+#define DTRT_ALIASED(cond, op) \
+	if (cond) { \
+		BigUnsigned tmpThis; \
+		tmpThis.op; \
+		*this = tmpThis; \
+		return; \
+	}
+
+
+
+void BigUnsigned::add(const BigUnsigned &a, const BigUnsigned &b) {
+	DTRT_ALIASED(this == &a || this == &b, add(a, b));
+	// If one argument is zero, copy the other.
+	if (a.len == 0) {
+		operator =(b);
+		return;
+	} else if (b.len == 0) {
+		operator =(a);
+		return;
+	}
+	// Some variables...
+	// Carries in and out of an addition stage
+	bool carryIn, carryOut;
+	Blk temp;
+	Index i;
+	// a2 points to the longer input, b2 points to the shorter
+	const BigUnsigned *a2, *b2;
+	if (a.len >= b.len) {
+		a2 = &a;
+		b2 = &b;
+	} else {
+		a2 = &b;
+		b2 = &a;
+	}
+	// Set prelimiary length and make room in this BigUnsigned
+	len = a2->len + 1;
+	allocate(len);
+	// For each block index that is present in both inputs...
+	for (i = 0, carryIn = false; i < b2->len; i++) {
+		// Add input blocks
+		temp = a2->blk[i] + b2->blk[i];
+		// If a rollover occurred, the result is less than either input.
+		// This test is used many times in the BigUnsigned code.
+		carryOut = (temp < a2->blk[i]);
+		// If a carry was input, handle it
+		if (carryIn) {
+			temp++;
+			carryOut |= (temp == 0);
+		}
+		blk[i] = temp; // Save the addition result
+		carryIn = carryOut; // Pass the carry along
+	}
+	// If there is a carry left over, increase blocks until
+	// one does not roll over.
+	for (; i < a2->len && carryIn; i++) {
+		temp = a2->blk[i] + 1;
+		carryIn = (temp == 0);
+		blk[i] = temp;
+	}
+	// If the carry was resolved but the larger number
+	// still has blocks, copy them over.
+	for (; i < a2->len; i++)
+		blk[i] = a2->blk[i];
+	// Set the extra block if there's still a carry, decrease length otherwise
+	if (carryIn)
+		blk[i] = 1;
+	else
+		len--;
+}
+
+void BigUnsigned::subtract(const BigUnsigned &a, const BigUnsigned &b) {
+	DTRT_ALIASED(this == &a || this == &b, subtract(a, b));
+	if (b.len == 0) {
+		// If b is zero, copy a.
+		operator =(a);
+		return;
+	} else if (a.len < b.len)
+		// If a is shorter than b, the result is negative.
+		throw "BigUnsigned::subtract: "
+			"Negative result in unsigned calculation";
+	// Some variables...
+	bool borrowIn, borrowOut;
+	Blk temp;
+	Index i;
+	// Set preliminary length and make room
+	len = a.len;
+	allocate(len);
+	// For each block index that is present in both inputs...
+	for (i = 0, borrowIn = false; i < b.len; i++) {
+		temp = a.blk[i] - b.blk[i];
+		// If a reverse rollover occurred,
+		// the result is greater than the block from a.
+		borrowOut = (temp > a.blk[i]);
+		// Handle an incoming borrow
+		if (borrowIn) {
+			borrowOut |= (temp == 0);
+			temp--;
+		}
+		blk[i] = temp; // Save the subtraction result
+		borrowIn = borrowOut; // Pass the borrow along
+	}
+	// If there is a borrow left over, decrease blocks until
+	// one does not reverse rollover.
+	for (; i < a.len && borrowIn; i++) {
+		borrowIn = (a.blk[i] == 0);
+		blk[i] = a.blk[i] - 1;
+	}
+	/* If there's still a borrow, the result is negative.
+	 * Throw an exception, but zero out this object so as to leave it in a
+	 * predictable state. */
+	if (borrowIn) {
+		len = 0;
+		throw "BigUnsigned::subtract: Negative result in unsigned calculation";
+	} else
+		// Copy over the rest of the blocks
+		for (; i < a.len; i++)
+			blk[i] = a.blk[i];
+	// Zap leading zeros
+	zapLeadingZeros();
+}
+
+/*
+ * About the multiplication and division algorithms:
+ *
+ * I searched unsucessfully for fast C++ built-in operations like the `b_0'
+ * and `c_0' Knuth describes in Section 4.3.1 of ``The Art of Computer
+ * Programming'' (replace `place' by `Blk'):
+ *
+ *    ``b_0[:] multiplication of a one-place integer by another one-place
+ *      integer, giving a two-place answer;
+ *
+ *    ``c_0[:] division of a two-place integer by a one-place integer,
+ *      provided that the quotient is a one-place integer, and yielding
+ *      also a one-place remainder.''
+ *
+ * I also missed his note that ``[b]y adjusting the word size, if
+ * necessary, nearly all computers will have these three operations
+ * available'', so I gave up on trying to use algorithms similar to his.
+ * A future version of the library might include such algorithms; I
+ * would welcome contributions from others for this.
+ *
+ * I eventually decided to use bit-shifting algorithms.  To multiply `a'
+ * and `b', we zero out the result.  Then, for each `1' bit in `a', we
+ * shift `b' left the appropriate amount and add it to the result.
+ * Similarly, to divide `a' by `b', we shift `b' left varying amounts,
+ * repeatedly trying to subtract it from `a'.  When we succeed, we note
+ * the fact by setting a bit in the quotient.  While these algorithms
+ * have the same O(n^2) time complexity as Knuth's, the ``constant factor''
+ * is likely to be larger.
+ *
+ * Because I used these algorithms, which require single-block addition
+ * and subtraction rather than single-block multiplication and division,
+ * the innermost loops of all four routines are very similar.  Study one
+ * of them and all will become clear.
+ */
+
+/*
+ * This is a little inline function used by both the multiplication
+ * routine and the division routine.
+ *
+ * `getShiftedBlock' returns the `x'th block of `num << y'.
+ * `y' may be anything from 0 to N - 1, and `x' may be anything from
+ * 0 to `num.len'.
+ *
+ * Two things contribute to this block:
+ *
+ * (1) The `N - y' low bits of `num.blk[x]', shifted `y' bits left.
+ *
+ * (2) The `y' high bits of `num.blk[x-1]', shifted `N - y' bits right.
+ *
+ * But we must be careful if `x == 0' or `x == num.len', in
+ * which case we should use 0 instead of (2) or (1), respectively.
+ *
+ * If `y == 0', then (2) contributes 0, as it should.  However,
+ * in some computer environments, for a reason I cannot understand,
+ * `a >> b' means `a >> (b % N)'.  This means `num.blk[x-1] >> (N - y)'
+ * will return `num.blk[x-1]' instead of the desired 0 when `y == 0';
+ * the test `y == 0' handles this case specially.
+ */
+inline BigUnsigned::Blk getShiftedBlock(const BigUnsigned &num,
+	BigUnsigned::Index x, unsigned int y) {
+	BigUnsigned::Blk part1 = (x == 0 || y == 0) ? 0 : (num.blk[x - 1] >> (BigUnsigned::N - y));
+	BigUnsigned::Blk part2 = (x == num.len) ? 0 : (num.blk[x] << y);
+	return part1 | part2;
+}
+
+void BigUnsigned::multiply(const BigUnsigned &a, const BigUnsigned &b) {
+	DTRT_ALIASED(this == &a || this == &b, multiply(a, b));
+	// If either a or b is zero, set to zero.
+	if (a.len == 0 || b.len == 0) {
+		len = 0;
+		return;
+	}
+	/*
+	 * Overall method:
+	 *
+	 * Set this = 0.
+	 * For each 1-bit of `a' (say the `i2'th bit of block `i'):
+	 *    Add `b << (i blocks and i2 bits)' to *this.
+	 */
+	// Variables for the calculation
+	Index i, j, k;
+	unsigned int i2;
+	Blk temp;
+	bool carryIn, carryOut;
+	// Set preliminary length and make room
+	len = a.len + b.len;
+	allocate(len);
+	// Zero out this object
+	for (i = 0; i < len; i++)
+		blk[i] = 0;
+	// For each block of the first number...
+	for (i = 0; i < a.len; i++) {
+		// For each 1-bit of that block...
+		for (i2 = 0; i2 < N; i2++) {
+			if ((a.blk[i] & (Blk(1) << i2)) == 0)
+				continue;
+			/*
+			 * Add b to this, shifted left i blocks and i2 bits.
+			 * j is the index in b, and k = i + j is the index in this.
+			 *
+			 * `getShiftedBlock', a short inline function defined above,
+			 * is now used for the bit handling.  It replaces the more
+			 * complex `bHigh' code, in which each run of the loop dealt
+			 * immediately with the low bits and saved the high bits to
+			 * be picked up next time.  The last run of the loop used to
+			 * leave leftover high bits, which were handled separately.
+			 * Instead, this loop runs an additional time with j == b.len.
+			 * These changes were made on 2005.01.11.
+			 */
+			for (j = 0, k = i, carryIn = false; j <= b.len; j++, k++) {
+				/*
+				 * The body of this loop is very similar to the body of the first loop
+				 * in `add', except that this loop does a `+=' instead of a `+'.
+				 */
+				temp = blk[k] + getShiftedBlock(b, j, i2);
+				carryOut = (temp < blk[k]);
+				if (carryIn) {
+					temp++;
+					carryOut |= (temp == 0);
+				}
+				blk[k] = temp;
+				carryIn = carryOut;
+			}
+			// No more extra iteration to deal with `bHigh'.
+			// Roll-over a carry as necessary.
+			for (; carryIn; k++) {
+				blk[k]++;
+				carryIn = (blk[k] == 0);
+			}
+		}
+	}
+	// Zap possible leading zero
+	if (blk[len - 1] == 0)
+		len--;
+}
+
+/*
+ * DIVISION WITH REMAINDER
+ * This monstrous function mods *this by the given divisor b while storing the
+ * quotient in the given object q; at the end, *this contains the remainder.
+ * The seemingly bizarre pattern of inputs and outputs was chosen so that the
+ * function copies as little as possible (since it is implemented by repeated
+ * subtraction of multiples of b from *this).
+ * 
+ * "modWithQuotient" might be a better name for this function, but I would
+ * rather not change the name now.
+ */
+void BigUnsigned::divideWithRemainder(const BigUnsigned &b, BigUnsigned &q) {
+	/* Defending against aliased calls is more complex than usual because we
+	 * are writing to both *this and q.
+	 * 
+	 * It would be silly to try to write quotient and remainder to the
+	 * same variable.  Rule that out right away. */
+	if (this == &q)
+		throw "BigUnsigned::divideWithRemainder: Cannot write quotient and remainder into the same variable";
+	/* Now *this and q are separate, so the only concern is that b might be
+	 * aliased to one of them.  If so, use a temporary copy of b. */
+	if (this == &b || &q == &b) {
+		BigUnsigned tmpB(b);
+		divideWithRemainder(tmpB, q);
+		return;
+	}
+
+	/*
+	 * Knuth's definition of mod (which this function uses) is somewhat
+	 * different from the C++ definition of % in case of division by 0.
+	 *
+	 * We let a / 0 == 0 (it doesn't matter much) and a % 0 == a, no
+	 * exceptions thrown.  This allows us to preserve both Knuth's demand
+	 * that a mod 0 == a and the useful property that
+	 * (a / b) * b + (a % b) == a.
+	 */
+	if (b.len == 0) {
+		q.len = 0;
+		return;
+	}
+
+	/*
+	 * If *this.len < b.len, then *this < b, and we can be sure that b doesn't go into
+	 * *this at all.  The quotient is 0 and *this is already the remainder (so leave it alone).
+	 */
+	if (len < b.len) {
+		q.len = 0;
+		return;
+	}
+
+	// At this point we know (*this).len >= b.len > 0.  (Whew!)
+
+	/*
+	 * Overall method:
+	 *
+	 * For each appropriate i and i2, decreasing:
+	 *    Subtract (b << (i blocks and i2 bits)) from *this, storing the
+	 *      result in subtractBuf.
+	 *    If the subtraction succeeds with a nonnegative result:
+	 *        Turn on bit i2 of block i of the quotient q.
+	 *        Copy subtractBuf back into *this.
+	 *    Otherwise bit i2 of block i remains off, and *this is unchanged.
+	 * 
+	 * Eventually q will contain the entire quotient, and *this will
+	 * be left with the remainder.
+	 *
+	 * subtractBuf[x] corresponds to blk[x], not blk[x+i], since 2005.01.11.
+	 * But on a single iteration, we don't touch the i lowest blocks of blk
+	 * (and don't use those of subtractBuf) because these blocks are
+	 * unaffected by the subtraction: we are subtracting
+	 * (b << (i blocks and i2 bits)), which ends in at least `i' zero
+	 * blocks. */
+	// Variables for the calculation
+	Index i, j, k;
+	unsigned int i2;
+	Blk temp;
+	bool borrowIn, borrowOut;
+
+	/*
+	 * Make sure we have an extra zero block just past the value.
+	 *
+	 * When we attempt a subtraction, we might shift `b' so
+	 * its first block begins a few bits left of the dividend,
+	 * and then we'll try to compare these extra bits with
+	 * a nonexistent block to the left of the dividend.  The
+	 * extra zero block ensures sensible behavior; we need
+	 * an extra block in `subtractBuf' for exactly the same reason.
+	 */
+	Index origLen = len; // Save real length.
+	/* To avoid an out-of-bounds access in case of reallocation, allocate
+	 * first and then increment the logical length. */
+	allocateAndCopy(len + 1);
+	len++;
+	blk[origLen] = 0; // Zero the added block.
+
+	// subtractBuf holds part of the result of a subtraction; see above.
+	Blk *subtractBuf = new Blk[len];
+
+	// Set preliminary length for quotient and make room
+	q.len = origLen - b.len + 1;
+	q.allocate(q.len);
+	// Zero out the quotient
+	for (i = 0; i < q.len; i++)
+		q.blk[i] = 0;
+
+	// For each possible left-shift of b in blocks...
+	i = q.len;
+	while (i > 0) {
+		i--;
+		// For each possible left-shift of b in bits...
+		// (Remember, N is the number of bits in a Blk.)
+		q.blk[i] = 0;
+		i2 = N;
+		while (i2 > 0) {
+			i2--;
+			/*
+			 * Subtract b, shifted left i blocks and i2 bits, from *this,
+			 * and store the answer in subtractBuf.  In the for loop, `k == i + j'.
+			 *
+			 * Compare this to the middle section of `multiply'.  They
+			 * are in many ways analogous.  See especially the discussion
+			 * of `getShiftedBlock'.
+			 */
+			for (j = 0, k = i, borrowIn = false; j <= b.len; j++, k++) {
+				temp = blk[k] - getShiftedBlock(b, j, i2);
+				borrowOut = (temp > blk[k]);
+				if (borrowIn) {
+					borrowOut |= (temp == 0);
+					temp--;
+				}
+				// Since 2005.01.11, indices of `subtractBuf' directly match those of `blk', so use `k'.
+				subtractBuf[k] = temp; 
+				borrowIn = borrowOut;
+			}
+			// No more extra iteration to deal with `bHigh'.
+			// Roll-over a borrow as necessary.
+			for (; k < origLen && borrowIn; k++) {
+				borrowIn = (blk[k] == 0);
+				subtractBuf[k] = blk[k] - 1;
+			}
+			/*
+			 * If the subtraction was performed successfully (!borrowIn),
+			 * set bit i2 in block i of the quotient.
+			 *
+			 * Then, copy the portion of subtractBuf filled by the subtraction
+			 * back to *this.  This portion starts with block i and ends--
+			 * where?  Not necessarily at block `i + b.len'!  Well, we
+			 * increased k every time we saved a block into subtractBuf, so
+			 * the region of subtractBuf we copy is just [i, k).
+			 */
+			if (!borrowIn) {
+				q.blk[i] |= (Blk(1) << i2);
+				while (k > i) {
+					k--;
+					blk[k] = subtractBuf[k];
+				}
+			} 
+		}
+	}
+	// Zap possible leading zero in quotient
+	if (q.blk[q.len - 1] == 0)
+		q.len--;
+	// Zap any/all leading zeros in remainder
+	zapLeadingZeros();
+	// Deallocate subtractBuf.
+	// (Thanks to Brad Spencer for noticing my accidental omission of this!)
+	delete [] subtractBuf;
+}
+
+/* BITWISE OPERATORS
+ * These are straightforward blockwise operations except that they differ in
+ * the output length and the necessity of zapLeadingZeros. */
+
+void BigUnsigned::bitAnd(const BigUnsigned &a, const BigUnsigned &b) {
+	DTRT_ALIASED(this == &a || this == &b, bitAnd(a, b));
+	// The bitwise & can't be longer than either operand.
+	len = (a.len >= b.len) ? b.len : a.len;
+	allocate(len);
+	Index i;
+	for (i = 0; i < len; i++)
+		blk[i] = a.blk[i] & b.blk[i];
+	zapLeadingZeros();
+}
+
+void BigUnsigned::bitOr(const BigUnsigned &a, const BigUnsigned &b) {
+	DTRT_ALIASED(this == &a || this == &b, bitOr(a, b));
+	Index i;
+	const BigUnsigned *a2, *b2;
+	if (a.len >= b.len) {
+		a2 = &a;
+		b2 = &b;
+	} else {
+		a2 = &b;
+		b2 = &a;
+	}
+	allocate(a2->len);
+	for (i = 0; i < b2->len; i++)
+		blk[i] = a2->blk[i] | b2->blk[i];
+	for (; i < a2->len; i++)
+		blk[i] = a2->blk[i];
+	len = a2->len;
+	// Doesn't need zapLeadingZeros.
+}
+
+void BigUnsigned::bitXor(const BigUnsigned &a, const BigUnsigned &b) {
+	DTRT_ALIASED(this == &a || this == &b, bitXor(a, b));
+	Index i;
+	const BigUnsigned *a2, *b2;
+	if (a.len >= b.len) {
+		a2 = &a;
+		b2 = &b;
+	} else {
+		a2 = &b;
+		b2 = &a;
+	}
+	allocate(a2->len);
+	for (i = 0; i < b2->len; i++)
+		blk[i] = a2->blk[i] ^ b2->blk[i];
+	for (; i < a2->len; i++)
+		blk[i] = a2->blk[i];
+	len = a2->len;
+	zapLeadingZeros();
+}
+
+void BigUnsigned::bitShiftLeft(const BigUnsigned &a, int b) {
+	DTRT_ALIASED(this == &a, bitShiftLeft(a, b));
+	if (b < 0) {
+		if (b << 1 == 0)
+			throw "BigUnsigned::bitShiftLeft: "
+				"Pathological shift amount not implemented";
+		else {
+			bitShiftRight(a, -b);
+			return;
+		}
+	}
+	Index shiftBlocks = b / N;
+	unsigned int shiftBits = b % N;
+	// + 1: room for high bits nudged left into another block
+	len = a.len + shiftBlocks + 1;
+	allocate(len);
+	Index i, j;
+	for (i = 0; i < shiftBlocks; i++)
+		blk[i] = 0;
+	for (j = 0, i = shiftBlocks; j <= a.len; j++, i++)
+		blk[i] = getShiftedBlock(a, j, shiftBits);
+	// Zap possible leading zero
+	if (blk[len - 1] == 0)
+		len--;
+}
+
+void BigUnsigned::bitShiftRight(const BigUnsigned &a, int b) {
+	DTRT_ALIASED(this == &a, bitShiftRight(a, b));
+	if (b < 0) {
+		if (b << 1 == 0)
+			throw "BigUnsigned::bitShiftRight: "
+				"Pathological shift amount not implemented";
+		else {
+			bitShiftLeft(a, -b);
+			return;
+		}
+	}
+	// This calculation is wacky, but expressing the shift as a left bit shift
+	// within each block lets us use getShiftedBlock.
+	Index rightShiftBlocks = (b + N - 1) / N;
+	unsigned int leftShiftBits = N * rightShiftBlocks - b;
+	// Now (N * rightShiftBlocks - leftShiftBits) == b
+	// and 0 <= leftShiftBits < N.
+	if (rightShiftBlocks >= a.len + 1) {
+		// All of a is guaranteed to be shifted off, even considering the left
+		// bit shift.
+		len = 0;
+		return;
+	}
+	// Now we're allocating a positive amount.
+	// + 1: room for high bits nudged left into another block
+	len = a.len + 1 - rightShiftBlocks;
+	allocate(len);
+	Index i, j;
+	for (j = rightShiftBlocks, i = 0; j <= a.len; j++, i++)
+		blk[i] = getShiftedBlock(a, j, leftShiftBits);
+	// Zap possible leading zero
+	if (blk[len - 1] == 0)
+		len--;
+}
+
+// INCREMENT/DECREMENT OPERATORS
+
+// Prefix increment
+void BigUnsigned::operator ++() {
+	Index i;
+	bool carry = true;
+	for (i = 0; i < len && carry; i++) {
+		blk[i]++;
+		carry = (blk[i] == 0);
+	}
+	if (carry) {
+		// Allocate and then increase length, as in divideWithRemainder
+		allocateAndCopy(len + 1);
+		len++;
+		blk[i] = 1;
+	}
+}
+
+// Postfix increment: same as prefix
+void BigUnsigned::operator ++(int) {
+	operator ++();
+}
+
+// Prefix decrement
+void BigUnsigned::operator --() {
+	if (len == 0)
+		throw "BigUnsigned::operator --(): Cannot decrement an unsigned zero";
+	Index i;
+	bool borrow = true;
+	for (i = 0; borrow; i++) {
+		borrow = (blk[i] == 0);
+		blk[i]--;
+	}
+	// Zap possible leading zero (there can only be one)
+	if (blk[len - 1] == 0)
+		len--;
+}
+
+// Postfix decrement: same as prefix
+void BigUnsigned::operator --(int) {
+	operator --();
+}

src/bigint/src/BigUnsignedInABase.cpp

@@ -0,0 +1,125 @@
+#include "../include/BigUnsignedInABase.hpp"
+
+BigUnsignedInABase::BigUnsignedInABase(const Digit *d, Index l, Base base)
+	: NumberlikeArray<Digit>(d, l), base(base) {
+	// Check the base
+	if (base < 2)
+		throw "BigUnsignedInABase::BigUnsignedInABase(const Digit *, Index, Base): The base must be at least 2";
+
+	// Validate the digits.
+	for (Index i = 0; i < l; i++)
+		if (blk[i] >= base)
+			throw "BigUnsignedInABase::BigUnsignedInABase(const Digit *, Index, Base): A digit is too large for the specified base";
+
+	// Eliminate any leading zeros we may have been passed.
+	zapLeadingZeros();
+}
+
+namespace {
+	unsigned int bitLen(unsigned int x) {
+		unsigned int len = 0;
+		while (x > 0) {
+			x >>= 1;
+			len++;
+		}
+		return len;
+	}
+	unsigned int ceilingDiv(unsigned int a, unsigned int b) {
+		return (a + b - 1) / b;
+	}
+}
+
+BigUnsignedInABase::BigUnsignedInABase(const BigUnsigned &x, Base base) {
+	// Check the base
+	if (base < 2)
+		throw "BigUnsignedInABase(BigUnsigned, Base): The base must be at least 2";
+	this->base = base;
+
+	// Get an upper bound on how much space we need
+	int maxBitLenOfX = x.getLength() * BigUnsigned::N;
+	int minBitsPerDigit = bitLen(base) - 1;
+	int maxDigitLenOfX = ceilingDiv(maxBitLenOfX, minBitsPerDigit);
+	len = maxDigitLenOfX; // Another change to comply with `staying in bounds'.
+	allocate(len); // Get the space
+
+	BigUnsigned x2(x), buBase(base);
+	Index digitNum = 0;
+
+	while (!x2.isZero()) {
+		// Get last digit.  This is like `lastDigit = x2 % buBase, x2 /= buBase'.
+		BigUnsigned lastDigit(x2);
+		lastDigit.divideWithRemainder(buBase, x2);
+		// Save the digit.
+		blk[digitNum] = lastDigit.toUnsignedShort();
+		// Move on.  We can't run out of room: we figured it out above.
+		digitNum++;
+	}
+
+	// Save the actual length.
+	len = digitNum;
+}
+
+BigUnsignedInABase::operator BigUnsigned() const {
+	BigUnsigned ans(0), buBase(base), temp;
+	Index digitNum = len;
+	while (digitNum > 0) {
+		digitNum--;
+		temp.multiply(ans, buBase);
+		ans.add(temp, BigUnsigned(blk[digitNum]));
+	}
+	return ans;
+}
+
+BigUnsignedInABase::BigUnsignedInABase(const std::string &s, Base base) {
+	// Check the base.
+	if (base > 36)
+		throw "BigUnsignedInABase(std::string, Base): The default string conversion routines use the symbol set 0-9, A-Z and therefore support only up to base 36.  You tried a conversion with a base over 36; write your own string conversion routine.";
+	// Save the base.
+	// This pattern is seldom seen in C++, but the analogous ``this.'' is common in Java.
+	this->base = base;
+
+	// `s.length()' is a `size_t', while `len' is a `NumberlikeArray::Index',
+	// also known as an `unsigned int'.  Some compilers warn without this cast.
+	len = Index(s.length());
+	allocate(len);
+
+	Index digitNum, symbolNumInString;
+	for (digitNum = 0; digitNum < len; digitNum++) {
+		symbolNumInString = len - 1 - digitNum;
+		char theSymbol = s[symbolNumInString];
+		if (theSymbol >= '0' && theSymbol <= '9')
+			blk[digitNum] = theSymbol - '0';
+		else if (theSymbol >= 'A' && theSymbol <= 'Z')
+			blk[digitNum] = theSymbol - 'A' + 10;
+		else if (theSymbol >= 'a' && theSymbol <= 'z')
+			blk[digitNum] = theSymbol - 'a' + 10;
+		else
+			throw "BigUnsignedInABase(std::string, Base): Bad symbol in input.  Only 0-9, A-Z, a-z are accepted.";
+
+		if (blk[digitNum] >= base)
+			throw "BigUnsignedInABase::BigUnsignedInABase(const Digit *, Index, Base): A digit is too large for the specified base";
+	}
+	zapLeadingZeros();
+}
+
+BigUnsignedInABase::operator std::string() const {
+	if (base > 36)
+		throw "BigUnsignedInABase ==> std::string: The default string conversion routines use the symbol set 0-9, A-Z and therefore support only up to base 36.  You tried a conversion with a base over 36; write your own string conversion routine.";
+	if (len == 0)
+		return std::string("0");
+	// Some compilers don't have push_back, so use a char * buffer instead.
+	char *s = new char[len + 1];
+	s[len] = '\0';
+	Index digitNum, symbolNumInString;
+	for (symbolNumInString = 0; symbolNumInString < len; symbolNumInString++) {
+		digitNum = len - 1 - symbolNumInString;
+		Digit theDigit = blk[digitNum];
+		if (theDigit < 10)
+			s[symbolNumInString] = char('0' + theDigit);
+		else
+			s[symbolNumInString] = char('A' + theDigit - 10);
+	}
+	std::string s2(s);
+	delete [] s;
+	return s2;
+}

src/ecc/ecc.cpp

@@ -0,0 +1,366 @@
+/*
+	ecc.cpp - inplementations of ECC operations using keys
+			  defined with sect233r1 / NIST B-233
+	This is NOT intended to be used in an actual cryptographic
+	scheme; as written, it is vulnerable to several attacks.
+	This might or might not change in the future. It is intended
+	to be used for doing operations on keys which are already known.
+
+	Copyright © 2018 Jbop (https://github.com/jbop1626);
+	Modification of a part of iQueCrypt
+	(https://github.com/jbop1626/iquecrypt)
+
+	This file is a part of ninty-233.
+
+	ninty-233 is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	ninty-233 is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+#include <iostream>
+#include <iomanip>
+#include "ecc.hpp"
+
+/*
+	Printing
+*/
+void print_element(const element a) {
+	for (int i = 0; i < 8; ++i) {
+		std::cout << std::setw(8) << std::setfill('0') << std::hex << a[i] << " ";
+	}
+	std::cout << std::endl << std::endl;;
+}
+
+void print_point(const ec_point & a) {
+	std::cout << "x: ";
+	print_element(a.x);
+	std::cout << "y: ";
+	print_element(a.y);
+	std::cout << std::endl;
+}
+
+/*
+	Helper functions for working with elements in GF(2^m)
+*/
+bool gf2m_is_equal(const element a, const element b) {
+	for (int i = 0; i < 7; ++i) {
+		if (a[i] != b[i]) return false;
+	}
+	return true;
+}
+
+void gf2m_set_zero(element a) {
+	for (int i = 0; i < 8; ++i) {
+		a[i] = 0;
+	}
+}
+
+void gf2m_copy(const element src, element dst) {
+	std::memcpy(dst, src, 32);
+}
+
+int gf2m_get_bit(const element a, int index) {
+	int word_index = ((index / 32) - 7) * -1;
+	int shift = index - (32 * (7 - word_index));
+	return (a[word_index] >> shift) & 1;
+}
+
+void gf2m_left_shift(element a, int shift) {
+	if (!shift) {
+		a[0] &= 0x1FF;
+		return;
+	}
+	for (int i = 0; i < 7; ++i) {
+		a[i] <<= 1;
+		if (a[i + 1] >= 0x80000000) a[i] |= 1;
+	}
+	a[7] <<= 1;
+	gf2m_left_shift(a, shift - 1);
+}
+
+bool gf2m_is_one(const element a) {
+	if (a[7] != 1) return false;
+	else {
+		for (int i = 0; i < 7; ++i) {
+			if (a[i] != 0) return false;
+		}
+	}
+	return true;
+}
+
+int gf2m_degree(const element a) {
+	int degree = 0;
+	int i = 0;
+	while (a[i] == 0) {
+		i++;
+	}
+	degree = (7 - i) * 32;
+	uint32_t MSW = a[i];
+	while (MSW != 0) {
+		MSW >>= 1;
+		degree += 1;
+	}
+	return degree - 1;
+}
+
+void gf2m_swap(element a, element b) {
+	element temp;
+	gf2m_copy(a, temp);
+	gf2m_copy(b, a);
+	gf2m_copy(temp, b);
+}
+
+/*
+	Arithmetic operations on elements in GF(2^m)
+*/
+void gf2m_add(const element a, const element b, element c) {
+	for (int i = 0; i < 8; ++i) {
+		c[i] = a[i] ^ b[i];
+	}
+}
+
+void gf2m_inv(const element a, element c) {
+	element u, v, g_1, g_2, temp;
+	gf2m_copy(a, u);
+	gf2m_copy(poly_f, v);
+	gf2m_set_zero(g_1);
+	g_1[7] |= 1;
+	gf2m_set_zero(g_2);
+	int j = gf2m_degree(u) - 233;
+	while (!gf2m_is_one(u)) {
+		if (j < 0) {
+			gf2m_swap(u, v);
+			gf2m_swap(g_1, g_2);
+			j = -j;
+		}
+		gf2m_copy(v, temp);
+		gf2m_left_shift(temp, j);
+		gf2m_add(u, temp, u);
+		gf2m_copy(g_2, temp);
+		gf2m_left_shift(temp, j);
+		gf2m_add(g_1, temp, g_1);
+
+		u[0] &= 0x1FF;
+		g_1[0] &= 0x1FF;
+
+		j = gf2m_degree(u) - gf2m_degree(v);
+	}
+	gf2m_copy(g_1, c);
+}
+
+// basic implementation
+void gf2m_mul(const element a, const element b, element c) {
+	element t1, t2, t3;
+	gf2m_copy(a, t1);
+	gf2m_copy(b, t2);
+	gf2m_set_zero(t3);
+	for (int i = 0; i < 233; ++i) {
+		if (gf2m_get_bit(t2, i)) {
+			gf2m_add(t3, t1, t3);
+		}
+		int carry = gf2m_get_bit(t1, 232);
+		gf2m_left_shift(t1, 1);
+		if (carry == 1) {
+			gf2m_add(poly_r, t1, t1);
+		}
+	}
+	gf2m_copy(t3, c);
+}
+
+void gf2m_div(const element a, const element b, element c) {
+	element temp;
+	gf2m_inv(b, temp);
+	gf2m_mul(a, temp, c);
+}
+// void gf2m_reduce(element c)
+// void gf2m_square(const element a, element c)
+
+/*
+	Operations on points on the elliptic curve
+	y^2 + xy = x^3 + ax^2 + b over GF(2^m)
+*/
+void ec_point_copy(const ec_point & src, ec_point & dst) {
+	gf2m_copy(src.x, dst.x);
+	gf2m_copy(src.y, dst.y);
+}
+	
+bool ec_point_is_equal(const ec_point & a, const ec_point & c) {
+	return gf2m_is_equal(a.x, c.x) && gf2m_is_equal(a.y, c.y);
+}
+
+void ec_point_neg(const ec_point & a, ec_point & c) {
+	element temp;
+	gf2m_copy(a.x, c.x);
+	gf2m_add(a.x, a.y, temp);
+	gf2m_copy(temp, c.y);
+}
+
+void ec_point_double(const ec_point & a, ec_point & c) {
+	ec_point temp;
+	ec_point zero;
+	gf2m_set_zero(zero.x);
+	gf2m_set_zero(zero.y);
+
+	ec_point_neg(a, temp);
+	if (ec_point_is_equal(a, temp) || ec_point_is_equal(a, zero)) {
+		ec_point_copy(zero, c);
+		return;
+	}
+
+	element lambda, x, y, t, t2;
+	// Compute lambda (a.x + (a.y / a.x))
+	gf2m_div(a.y, a.x, t);
+	gf2m_add(a.x, t, lambda);
+	// Compute X (lambda^2 + lambda + a_coeff)
+	gf2m_mul(lambda, lambda, t);
+	gf2m_add(t, lambda, t);
+	gf2m_add(t, a_coeff, x);
+	// Compute Y (a.x^2 + (lambda * X) + X)
+	gf2m_mul(a.x, a.x, t);
+	gf2m_mul(lambda, x, t2);
+	gf2m_add(t, t2, t);
+	gf2m_add(t, x, y);
+	// Copy X,Y to output point c
+	gf2m_copy(x, c.x);
+	gf2m_copy(y, c.y);
+}
+
+void ec_point_add(const ec_point & a, const ec_point & b, ec_point & c) {
+	if (!ec_point_is_equal(a, b)) {
+		ec_point temp;
+		ec_point zero;
+		gf2m_set_zero(zero.x);
+		gf2m_set_zero(zero.y);
+		ec_point_neg(b, temp);
+		if (ec_point_is_equal(a, temp)) {
+			ec_point_copy(zero, c);
+			return;
+		}
+		else if (ec_point_is_equal(a, zero)) {
+			ec_point_copy(b, c);
+			return;
+		}
+		else if (ec_point_is_equal(b, zero)) {
+			ec_point_copy(a, c);
+			return;
+		}
+		else {
+			element lambda, x, y, t, t2;
+			// Compute lambda ((b.y + a.y) / (b.x + a.x))
+			gf2m_add(b.y, a.y, t);
+			gf2m_add(b.x, a.x, t2);
+			gf2m_div(t, t2, lambda);
+			// Compute X (lambda^2 + lambda + a.x + b.x + a_coeff)
+			gf2m_mul(lambda, lambda, t);
+			gf2m_add(t, lambda, t2);
+			gf2m_add(t2, a.x, t);
+			gf2m_add(t, b.x, t2);
+			gf2m_add(t2, a_coeff, x);
+			// Compute Y ((lambda * (a.x + X)) + X + a.y)
+			gf2m_add(a.x, x, t);
+			gf2m_mul(lambda, t, t2);
+			gf2m_add(t2, x, t);
+			gf2m_add(t, a.y, y);
+			// Copy X,Y to output point c
+			gf2m_copy(x, c.x);
+			gf2m_copy(y, c.y);
+			return;
+		}
+	}
+	else {
+		ec_point_double(a, c);
+	}
+}
+
+void ec_point_mul(const element a, const ec_point & b, ec_point & c) {
+	element k;
+	ec_point P;
+	ec_point Q;
+
+	gf2m_copy(a, k);
+	ec_point_copy(b, P);
+	gf2m_set_zero(Q.x);
+	gf2m_set_zero(Q.y);
+	for (int i = 0; i < 233; ++i) {
+		if (gf2m_get_bit(k, i)) {
+			ec_point_add(Q, P, Q);
+		}
+		ec_point_double(P, P);
+	}
+	ec_point_copy(Q, c);
+}
+
+bool ec_point_on_curve(const ec_point & P) {
+	// y^2 + xy = x^3 + ax^2 + b
+	element xx, yy, xy, lhs, rhs;
+	
+	gf2m_mul(P.y, P.y, yy);
+	gf2m_mul(P.x, P.y, xy);
+	gf2m_add(yy, xy, lhs);
+	
+	gf2m_mul(P.x, P.x, xx);
+	gf2m_add(P.x, a_coeff, rhs);
+	gf2m_mul(xx, rhs, rhs);
+	gf2m_add(rhs, b_coeff, rhs);
+	
+	return gf2m_is_equal(lhs, rhs);
+}
+
+/*
+	I/O Helpers
+		Private keys are expected to be 32 bytes; Public keys
+		are expected to be 64 bytes and in uncompressed form.
+		
+		Wii keys will need to be padded - two 0 bytes at the
+		start of the private key, and two 0 bytes before each
+		coordinate in the public key.
+		
+		These functions are mainly intended for reading/writing
+		*keys* as byte arrays or octet streams, but they will
+		work fine for any input with the correct length.
+*/
+// (32-byte) octet stream to GF(2^m) element
+void os_to_elem(const uint8_t * os, element elem) {
+	int j = 0;
+	for (int i = 0; i < 8; ++i) {
+		uint32_t temp = 0;
+		temp |= (os[j] << 24);
+		temp |= (os[j + 1] << 16);
+		temp |= (os[j + 2] << 8);
+		temp |= os[j + 3];
+		elem[i] = temp;
+		j += 4;
+	}
+}
+
+// (64-byte) octet stream to elliptic curve point
+void os_to_point(const uint8_t * os, ec_point & point) {
+	os_to_elem(os, point.x);
+	os_to_elem(os + 32, point.y);
+}
+
+// GF(2^m) element to (32-byte) octet stream
+void elem_to_os(const element src, uint8_t * output_os) {
+	int j = 0;
+	for (int i = 0; i < 7; ++i) {
+		output_os[j] = ((src[i] & 0xFF000000) >> 24);
+		output_os[j + 1] = ((src[i] & 0x00FF0000) >> 16);
+		output_os[j + 2] = ((src[i] & 0x0000FF00) >> 8);
+		output_os[j + 3] = src[i] & 0x000000FF;
+		j += 4;
+	}
+}
+
+// Elliptic curve point to (64-byte) octet stream
+void point_to_os(const ec_point & src, uint8_t * output_os) {
+	elem_to_os(src.x, output_os);
+	elem_to_os(src.y, output_os + 32);
+}

src/ecc/ecc.hpp

@@ -0,0 +1,90 @@
+/*
+	ecc.hpp - definitions required for ECC operations using keys
+			  defined with sect233r1 / NIST B-233
+	
+	Copyright © 2018 Jbop (https://github.com/jbop1626);
+	Modification of a part of iQueCrypt
+	(https://github.com/jbop1626/iquecrypt)
+
+	This file is a part of ninty-233.
+
+	ninty-233 is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	ninty-233 is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+typedef uint32_t element[8];
+
+typedef struct {
+	element x;
+	element y;
+} ec_point;
+
+/*
+	sect233r1 - domain parameters over GF(2^m). Defined in SEC 2 v2.0, pp. 19-20
+	Not all are currently used.
+*/
+const element poly_f = 		{0x0200, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000400, 0x00000000, 0x00000001};
+const element poly_r = 		{0x0000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000400, 0x00000000, 0x00000001};
+const element a_coeff =		{0x0000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000001};
+const element b_coeff =		{0x0066, 0x647EDE6C, 0x332C7F8C, 0x0923BB58, 0x213B333B, 0x20E9CE42, 0x81FE115F, 0x7D8F90AD};
+const element G_x =			{0x00FA, 0xC9DFCBAC, 0x8313BB21, 0x39F1BB75, 0x5FEF65BC, 0x391F8B36, 0xF8F8EB73, 0x71FD558B};
+const element G_y = 		{0x0100, 0x6A08A419, 0x03350678, 0xE58528BE, 0xBF8A0BEF, 0xF867A7CA, 0x36716F7E, 0x01F81052};
+const element G_order = 	{0x0100, 0x00000000, 0x00000000, 0x00000000, 0x0013E974, 0xE72F8A69, 0x22031D26, 0x03CFE0D7}; /*
+const uint32_t cofactor = 	0x02; */
+
+/*
+	Printing
+*/
+void print_element(const element a);
+void print_point(const ec_point & a);
+
+/*
+	Helper functions for working with elements in GF(2^m)
+*/
+bool gf2m_is_equal(const element a, const element b);
+void gf2m_set_zero(element a);
+void gf2m_copy(const element src, element dst);
+int  gf2m_get_bit(const element a, int index);
+void gf2m_left_shift(element a, int shift);
+bool gf2m_is_one(const element a);
+int  gf2m_degree(const element a);
+void gf2m_swap(element a, element b);
+
+/*
+	Arithmetic operations on elements in GF(2^m)
+*/
+void gf2m_add(const element a, const element b, element c);
+void gf2m_inv(const element a, element c);
+void gf2m_mul(const element a, const element b, element c);
+void gf2m_div(const element a, const element b, element c);
+// void gf2m_reduce(element c);
+// void gf2m_square(const element a, element c);
+
+/*
+	Operations on points on the elliptic curve
+	y^2 + xy = x^3 + ax^2 + b over GF(2^m)
+*/
+void ec_point_copy(const ec_point & src, ec_point & dst);
+bool ec_point_is_equal(const ec_point & a, const ec_point & c);
+void ec_point_neg(const ec_point & a, ec_point & c);
+void ec_point_double(const ec_point & a, ec_point & c);
+void ec_point_add(const ec_point & a, const ec_point & b, ec_point & c);
+void ec_point_mul(const element a, const ec_point & b, ec_point & c);
+bool ec_point_on_curve(const ec_point & a);
+
+/*
+	I/O Helpers
+*/
+void os_to_elem(const uint8_t * os, element elem);
+void os_to_point(const uint8_t * os, ec_point & point);
+void elem_to_os(const element src, uint8_t * output_os);
+void point_to_os(const ec_point & src, uint8_t * output_os);

src/ninty-233.cpp

@@ -0,0 +1,204 @@
+/*
+	ninty-233.cpp
+
+	Copyright © 2018 Jbop (https://github.com/jbop1626);
+
+	This file is a part of ninty-233.
+
+	ninty-233 is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	ninty-233 is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+#include "ninty-233.hpp"
+#include <iomanip>
+#include <random>
+#include <limits>
+
+/*
+	BigUnsigned <--> GF(2^m) element conversions
+*/
+BigUnsigned gf2m_to_bigunsigned(const element src) {
+	BigUnsigned dst = src[0];
+	for (int i = 1; i < 8; ++i) {
+		dst <<= 32;
+		dst += src[i];
+	}
+	return dst;
+}
+
+void bigunsigned_to_gf2m(const BigUnsigned & src, element dst) {
+	gf2m_set_zero(dst);
+	BigUnsigned temp = src;
+	for (int i = 7; i >= 0; --i) {
+		BigUnsigned low32 = temp & 0xFFFFFFFF;
+		dst[i] = low32.toUnsignedInt();
+		temp >>= 32;
+	}
+}
+
+/*
+	SHA-1 result as big (unsigned) integer
+*/
+BigUnsigned sha1(uint8_t * input, int length) {
+	SHA1_HASH hash;
+	Sha1Context context;
+	
+	Sha1Initialise(&context);
+	Sha1Update(&context, input, length);
+#if defined(IQUE_ECC) && (IQUE_ECC == 1)
+	uint8_t ique_magic[4] = { 0x06, 0x09, 0x19, 0x68 }; // iQue-specific magic
+	Sha1Update(&context, &ique_magic, 4);
+#endif
+	Sha1Finalise(&context, &hash);
+	
+	BigUnsigned hash_bigint = hash.bytes[0];
+	for (int i = 1; i < 20; ++i) {
+		hash_bigint <<= 8;
+		hash_bigint += hash.bytes[i];
+	}
+
+	return hash_bigint;
+}
+
+/*
+	Generation of k, for signing
+*/
+BigUnsigned generate_k(const BigUnsigned & n, const BigUnsigned & hash) {
+	BigUnsigned bu_temp = hash;
+	element elem_temp;
+	uint8_t os_temp[32];
+	
+	std::random_device rd;
+	std::uniform_int_distribution<unsigned int> dist(1, std::numeric_limits<unsigned int>::max());
+	unsigned int salt = dist(rd);
+	salt = salt * dist(rd);
+	bu_temp += salt;
+
+	bigunsigned_to_gf2m(bu_temp, elem_temp);
+	elem_to_os(elem_temp, os_temp);
+	BigUnsigned k = sha1(os_temp, 32);
+	k *= k;
+	while(k >= n) {
+		k /= 7;
+	}
+	return k;
+}
+
+/*
+	ECC algorithms
+*/
+void ecdh(const uint8_t * private_key, const uint8_t * public_key, uint8_t * output) {
+	element private_copy;
+	ec_point public_copy;
+	ec_point shared_secret;
+	
+	os_to_elem(private_key, private_copy);
+	os_to_point(public_key, public_copy);
+	
+	ec_point_mul(private_copy, public_copy, shared_secret);
+	
+	point_to_os(shared_secret, output);
+}
+
+void ecdsa_sign(const BigUnsigned z, const uint8_t * private_key, element r_out, element s_out) {
+	element private_copy;
+	os_to_elem(private_key, private_copy);
+	
+	BigUnsigned r = 0;
+	BigUnsigned s = 0;
+	BigUnsigned n = gf2m_to_bigunsigned(G_order);
+	BigUnsigned D = gf2m_to_bigunsigned(private_copy);
+	
+	while(r == 0 || s == 0) {
+		// Generate k in [1, n - 1]
+		BigUnsigned k = generate_k(n, z);
+		element k_elem;
+		bigunsigned_to_gf2m(k, k_elem);
+		
+		// Calculate P = kG
+		ec_point G;
+		gf2m_copy(G_x, G.x);
+		gf2m_copy(G_y, G.y);
+		ec_point P;
+		ec_point_mul(k_elem, G, P);
+		
+		// Calculate r = x_p mod n
+		BigUnsigned x_p = gf2m_to_bigunsigned(P.x);
+		r = x_p % n;
+		
+		// Calculate s = k^-1(z + rD) mod n
+		BigUnsigned k_inv = modinv(k, n);
+		BigUnsigned med = (z + (r * D)) % n;
+		s = (k_inv * med) % n;
+	}
+	bigunsigned_to_gf2m(r, r_out);
+	bigunsigned_to_gf2m(s, s_out);
+}
+
+bool ecdsa_verify(const BigUnsigned z, const uint8_t * public_key, const element r_input, const element s_input) {
+	ec_point Q, test;
+	os_to_point(public_key, Q);
+	element zero = { 0 };
+
+	// If Q is the identity, Q is invalid
+	if (gf2m_is_equal(Q.x, zero) && gf2m_is_equal(Q.y, zero)) {
+		return false;
+	}
+	// If Q is not a point on the curve, Q is invalid
+	if (!ec_point_on_curve(Q)) {
+		return false;
+	}
+	// If nQ is not the identity, Q is invalid (or n is messed up)
+	ec_point_mul(G_order, Q, test);
+	if (!(gf2m_is_equal(test.x, zero) && gf2m_is_equal(test.y, zero))) {
+		return false;
+	}
+	// Public key is valid, now verify signature...
+	BigUnsigned r = gf2m_to_bigunsigned(r_input);
+	BigUnsigned s = gf2m_to_bigunsigned(s_input);
+	BigUnsigned n = gf2m_to_bigunsigned(G_order);
+
+	// If r,s are not in [1, n - 1], sig is invalid
+	if (r < 1 || r >= n) {
+		return false;
+	}
+	if (s < 1 || s >= n) {
+		return false;
+	}
+
+	// Calculate u_1 and u_2
+	BigUnsigned s_inv = modinv(s, n);
+	BigUnsigned u_1 = (z * s_inv) % n;
+	BigUnsigned u_2 = (r * s_inv) % n;
+
+	// Calculate P3 = u_1G + u_2Q
+	element u_1_elem, u_2_elem;
+	ec_point P1, P2, P3;
+	ec_point G;
+	gf2m_copy(G_x, G.x);
+	gf2m_copy(G_y, G.y);
+	bigunsigned_to_gf2m(u_1, u_1_elem);
+	bigunsigned_to_gf2m(u_2, u_2_elem);
+
+	ec_point_mul(u_1_elem, G, P1);
+	ec_point_mul(u_2_elem, Q, P2);
+	ec_point_add(P1, P2, P3);
+
+	// If P3 is the identity, sig is invalid
+	if (gf2m_is_equal(P3.x, zero) && gf2m_is_equal(P3.y, zero)) {
+		return false;
+	}
+	
+	// And finally, is r congruent to P3.x mod n?
+	BigUnsigned x_p = gf2m_to_bigunsigned(P3.x);
+	return r == (x_p % n);
+}

src/ninty-233.hpp

@@ -0,0 +1,56 @@
+/*
+	ninty-233
+	Library for ECC operations using keys defined with
+	sect233r1 / NIST B-233 -- the curve/domain parameters
+	used by Nintendo in the iQue Player and Wii.
+
+	Copyright © 2018 Jbop (https://github.com/jbop1626);
+
+	This file is a part of ninty-233.
+
+	ninty-233 is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	ninty-233 is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+#ifndef NINTY_233
+#define NINTY_233
+
+#include "bigint/include/BigIntegerLibrary.hpp"
+#include "ecc/ecc.hpp"
+#include "sha1/sha1.hpp"
+
+#define IQUE_ECC 1
+
+/*
+	BigUnsigned <--> GF(2^m) element conversions
+*/
+BigUnsigned gf2m_to_bigunsigned(const element src);
+void bigunsigned_to_gf2m(const BigUnsigned & src, element dst);
+
+/*
+	SHA-1 result as big (unsigned) integer
+*/
+BigUnsigned sha1(uint8_t * input, int length);
+
+/*
+	Generation of k, for signing
+*/
+BigUnsigned generate_k(const BigUnsigned & n, const BigUnsigned & hash);
+
+/*
+	ECC algorithms
+*/
+void ecdh(const uint8_t * private_key, const uint8_t * public_key, uint8_t * output);
+void ecdsa_sign(const BigUnsigned hash, const uint8_t * private_key, element r_out, element s_out);
+bool ecdsa_verify(const BigUnsigned hash, const uint8_t * public_key, const element r_input, const element s_input);
+
+#endif

src/sha1/sha1.c

@@ -0,0 +1,269 @@
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  WjCryptLib_Sha1
+//
+//  Implementation of SHA1 hash function.
+//  Original author:  Steve Reid <sreid@sea-to-sky.net>
+//  Contributions by: James H. Brown <jbrown@burgoyne.com>, Saul Kravitz <Saul.Kravitz@celera.com>,
+//  and Ralph Giles <giles@ghostscript.com>
+//  Modified by WaterJuice retaining Public Domain license.
+//
+//  This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  IMPORTS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+#include "sha1.h"
+#include <memory.h>
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  DEFINES
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+// Decide whether to use the Little-Endian shortcut. If the shortcut is not used then the code will work correctly
+// on either big or little endian, however if we do know it is a little endian architecture we can speed it up a bit.
+// Note, there are TWO places where USE_LITTLE_ENDIAN_SHORTCUT is used. They MUST be paired together.
+#if defined(__BYTE_ORDER__) && defined(__ORDER_LITTLE_ENDIAN__) && ( __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ )
+    // gcc defines __BYTE_ORDER__ so if it says its little endian we can use that.
+    #define USE_LITTLE_ENDIAN_SHORTCUT
+#elif defined( _WIN32 )
+    // Windows is always little endian so we can use that.
+    #define USE_LITTLE_ENDIAN_SHORTCUT
+#endif
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  TYPES
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+typedef union
+{
+    uint8_t     c [64];
+    uint32_t    l [16];
+} CHAR64LONG16;
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  INTERNAL FUNCTIONS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+// Endian neutral macro for loading 32 bit value from 4 byte array (in big endian form).
+#define LOAD32H(x, y)                           \
+     { x = ((uint32_t)((y)[0] & 255)<<24) |     \
+           ((uint32_t)((y)[1] & 255)<<16) |     \
+           ((uint32_t)((y)[2] & 255)<<8)  |     \
+           ((uint32_t)((y)[3] & 255)); }
+
+#define rol(value, bits) (((value) << (bits)) | ((value) >> (32 - (bits))))
+
+// blk0() and blk() perform the initial expand.
+#ifdef USE_LITTLE_ENDIAN_SHORTCUT
+    #define blk0(i) (block->l[i] = (rol(block->l[i],24)&0xFF00FF00) | (rol(block->l[i],8)&0x00FF00FF))
+#else
+    #define blk0(i) block->l[i]
+#endif
+
+#define blk(i) (block->l[i&15] = rol(block->l[(i+13)&15] ^ block->l[(i+8)&15] ^ block->l[(i+2)&15] ^ block->l[i&15],1))
+
+// (R0+R1), R2, R3, R4 are the different operations used in SHA1
+#define R0(v,w,x,y,z,i)  z += ((w&(x^y))^y)     + blk0(i)+ 0x5A827999 + rol(v,5); w=rol(w,30);
+#define R1(v,w,x,y,z,i)  z += ((w&(x^y))^y)     + blk(i) + 0x5A827999 + rol(v,5); w=rol(w,30);
+#define R2(v,w,x,y,z,i)  z += (w^x^y)           + blk(i) + 0x6ED9EBA1 + rol(v,5); w=rol(w,30);
+#define R3(v,w,x,y,z,i)  z += (((w|x)&y)|(w&x)) + blk(i) + 0x8F1BBCDC + rol(v,5); w=rol(w,30);
+#define R4(v,w,x,y,z,i)  z += (w^x^y)           + blk(i) + 0xCA62C1D6 + rol(v,5); w=rol(w,30);
+
+// Loads the 128 bits from ByteArray into WordArray, treating ByteArray as big endian data
+#ifdef USE_LITTLE_ENDIAN_SHORTCUT
+    #define Load128BitsAsWords( WordArray, ByteArray )  \
+        memcpy( WordArray, ByteArray, 64 )
+#else
+    #define Load128BitsAsWords( WordArray, ByteArray )      \
+    {                                                       \
+        uint32_t i;                                         \
+        for( i=0; i<16; i++ )                               \
+        {                                                   \
+            LOAD32H( (WordArray)[i], (ByteArray)+(i*4) );   \
+        }                                                   \
+    }
+#endif
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  TransformFunction
+//
+//  Hash a single 512-bit block. This is the core of the algorithm
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+static
+void
+    TransformFunction
+    (
+        uint32_t            state[5],
+        uint8_t const       buffer[64]
+    )
+{
+    uint32_t            a;
+    uint32_t            b;
+    uint32_t            c;
+    uint32_t            d;
+    uint32_t            e;
+    uint8_t             workspace[64];
+    CHAR64LONG16*       block = (CHAR64LONG16*) workspace;
+
+    Load128BitsAsWords( block->l, buffer );
+
+    // Copy context->state[] to working vars
+    a = state[0];
+    b = state[1];
+    c = state[2];
+    d = state[3];
+    e = state[4];
+
+    // 4 rounds of 20 operations each. Loop unrolled.
+    R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3);
+    R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7);
+    R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11);
+    R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15);
+    R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
+    R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
+    R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
+    R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
+    R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
+    R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
+    R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
+    R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
+    R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
+    R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
+    R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
+    R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
+    R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
+    R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
+    R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
+    R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
+
+    // Add the working vars back into context.state[]
+    state[0] += a;
+    state[1] += b;
+    state[2] += c;
+    state[3] += d;
+    state[4] += e;
+}
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  PUBLIC FUNCTIONS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha1Initialise
+//
+//  Initialises an SHA1 Context. Use this to initialise/reset a context.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha1Initialise
+    (
+        Sha1Context*        Context         // [out]
+    )
+{
+    // SHA1 initialisation constants
+    Context->State[0] = 0x67452301;
+    Context->State[1] = 0xEFCDAB89;
+    Context->State[2] = 0x98BADCFE;
+    Context->State[3] = 0x10325476;
+    Context->State[4] = 0xC3D2E1F0;
+    Context->Count[0] = 0;
+    Context->Count[1] = 0;
+}
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha1Update
+//
+//  Adds data to the SHA1 context. This will process the data and update the internal state of the context. Keep on
+//  calling this function until all the data has been added. Then call Sha1Finalise to calculate the hash.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha1Update
+    (
+        Sha1Context*        Context,        // [in out]
+        void  const*        Buffer,         // [in]
+        uint32_t            BufferSize      // [in]
+    )
+{
+    uint32_t    i;
+    uint32_t    j;
+
+    j = (Context->Count[0] >> 3) & 63;
+    if( (Context->Count[0] += BufferSize << 3) < (BufferSize << 3) )
+    {
+        Context->Count[1]++;
+    }
+
+    Context->Count[1] += (BufferSize >> 29);
+    if( (j + BufferSize) > 63 )
+    {
+        i = 64 - j;
+        memcpy( &Context->Buffer[j], Buffer, i );
+        TransformFunction(Context->State, Context->Buffer);
+        for( ; i + 63 < BufferSize; i += 64 )
+        {
+            TransformFunction(Context->State, (uint8_t*)Buffer + i);
+        }
+        j = 0;
+    }
+    else
+    {
+        i = 0;
+    }
+
+    memcpy( &Context->Buffer[j], &((uint8_t*)Buffer)[i], BufferSize - i );
+}
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha1Finalise
+//
+//  Performs the final calculation of the hash and returns the digest (20 byte buffer containing 160bit hash). After
+//  calling this, Sha1Initialised must be used to reuse the context.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha1Finalise
+    (
+        Sha1Context*        Context,        // [in out]
+        SHA1_HASH*          Digest          // [in]
+    )
+{
+    uint32_t    i;
+    uint8_t     finalcount[8];
+
+    for( i=0; i<8; i++ )
+    {
+        finalcount[i] = (unsigned char)((Context->Count[(i >= 4 ? 0 : 1)]
+         >> ((3-(i & 3)) * 8) ) & 255);  // Endian independent
+    }
+    Sha1Update( Context, (uint8_t*)"\x80", 1 );
+    while( (Context->Count[0] & 504) != 448 )
+    {
+        Sha1Update( Context, (uint8_t*)"\0", 1 );
+    }
+
+    Sha1Update( Context, finalcount, 8 );  // Should cause a Sha1TransformFunction()
+    for( i=0; i<SHA1_HASH_SIZE; i++ )
+    {
+        Digest->bytes[i] = (uint8_t)((Context->State[i>>2] >> ((3-(i & 3)) * 8) ) & 255);
+    }
+}
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha1Calculate
+//
+//  Combines Sha1Initialise, Sha1Update, and Sha1Finalise into one function. Calculates the SHA1 hash of the buffer.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha1Calculate
+    (
+        void  const*        Buffer,         // [in]
+        uint32_t            BufferSize,     // [in]
+        SHA1_HASH*          Digest          // [in]
+    )
+{
+    Sha1Context context;
+
+    Sha1Initialise( &context );
+    Sha1Update( &context, Buffer, BufferSize );
+    Sha1Finalise( &context, Digest );
+}

src/sha1/sha1.h

@@ -0,0 +1,94 @@
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  WjCryptLib_Sha1
+//
+//  Implementation of SHA1 hash function.
+//  Original author:  Steve Reid <sreid@sea-to-sky.net>
+//  Contributions by: James H. Brown <jbrown@burgoyne.com>, Saul Kravitz <Saul.Kravitz@celera.com>,
+//  and Ralph Giles <giles@ghostscript.com>
+//  Modified by WaterJuice retaining Public Domain license.
+//
+//  This is free and unencumbered software released into the public domain - June 2013 waterjuice.org
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+#pragma once
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  IMPORTS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+#include <stdint.h>
+#include <stdio.h>
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  TYPES
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+// Sha1Context - This must be initialised using Sha1Initialised. Do not modify the contents of this structure directly.
+typedef struct
+{
+    uint32_t        State[5];
+    uint32_t        Count[2];
+    uint8_t         Buffer[64];
+} Sha1Context;
+
+#define SHA1_HASH_SIZE           ( 160 / 8 )
+
+typedef struct
+{
+    uint8_t      bytes [SHA1_HASH_SIZE];
+} SHA1_HASH;
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  PUBLIC FUNCTIONS
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha1Initialise
+//
+//  Initialises an SHA1 Context. Use this to initialise/reset a context.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha1Initialise
+    (
+        Sha1Context*        Context         // [out]
+    );
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha1Update
+//
+//  Adds data to the SHA1 context. This will process the data and update the internal state of the context. Keep on
+//  calling this function until all the data has been added. Then call Sha1Finalise to calculate the hash.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha1Update
+    (
+        Sha1Context*        Context,        // [in out]
+        void const*         Buffer,         // [in]
+        uint32_t            BufferSize      // [in]
+    );
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha1Finalise
+//
+//  Performs the final calculation of the hash and returns the digest (20 byte buffer containing 160bit hash). After
+//  calling this, Sha1Initialised must be used to reuse the context.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha1Finalise
+    (
+        Sha1Context*        Context,        // [in out]
+        SHA1_HASH*          Digest          // [in]
+    );
+
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//  Sha1Calculate
+//
+//  Combines Sha1Initialise, Sha1Update, and Sha1Finalise into one function. Calculates the SHA1 hash of the buffer.
+////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+void
+    Sha1Calculate
+    (
+        void  const*        Buffer,         // [in]
+        uint32_t            BufferSize,     // [in]
+        SHA1_HASH*          Digest          // [in]
+    );

src/sha1/sha1.hpp

@@ -0,0 +1,32 @@
+/*
+	Copyright © 2018 Jbop (https://github.com/jbop1626);
+
+	This file is a part of ninty-233.
+
+	ninty-233 is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	ninty-233 is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _SHA1_HPP_
+#define _SHA1_HPP_
+
+#ifndef __cplusplus
+#error Do not include this header in a C project
+#endif
+
+extern "C" {
+#include "sha1.h"
+}
+
+#endif
+