A workable SM9 R-ate pairing over BN curve

This textbook version R-ate pairing is very slow. About 0.5 seconds on my Macbook Pro 2018 with 2.7 GHz Core i7.

crypto/sm9/build.info

@@ -1,3 +1,4 @@
 LIBS=../../libcrypto
 SOURCE[../../libcrypto]=sm9_lib.c sm9_err.c sm9_asn1.c sm9_params.c \
-	sm9_setup.c sm9_keygen.c sm9_sign.c sm9_enc.c sm9_exch.c
+	sm9_setup.c sm9_keygen.c sm9_sign.c sm9_enc.c sm9_exch.c \
+	sm9_rate.c

crypto/sm9/sm9_lcl.h

@@ -76,15 +76,8 @@
 extern "C" {
 #endif
 
-
-const BIGNUM *SM9_get0_prime(void);
-const BIGNUM *SM9_get0_order(void);
-const BIGNUM *SM9_get0_trace(void);
-const BIGNUM *SM9_get0_generator2_x0(void);
-const BIGNUM *SM9_get0_generator2_x1(void);
-const BIGNUM *SM9_get0_generator2_y0(void);
-const BIGNUM *SM9_get0_generator2_y1(void);
-
+int SM9_rate_pairing(BIGNUM *r[12], const BIGNUM *xQ[2], const BIGNUM *yQ[2],
+	const BIGNUM *xP, const BIGNUM *yP, BN_CTX *ctx);
 
 struct SM9PublicParameters_st {
 	ASN1_OBJECT *curve;
@@ -136,7 +129,14 @@ int SM9_hash2(const EVP_MD *md, BIGNUM **r,
 	const unsigned char *elem, size_t elemlen,
 	const BIGNUM *range, BN_CTX *ctx);
 
-EC_GROUP *EC_GROUP_new_sm9s256t1(void);
+const BIGNUM *SM9_get0_prime(void);
+const BIGNUM *SM9_get0_order(void);
+const BIGNUM *SM9_get0_loop_count(void);
+const BIGNUM *SM9_get0_final_exponent(void);
+const BIGNUM *SM9_get0_generator2_x0(void);
+const BIGNUM *SM9_get0_generator2_x1(void);
+const BIGNUM *SM9_get0_generator2_y0(void);
+const BIGNUM *SM9_get0_generator2_y1(void);
 
 
 #ifdef __cplusplus

crypto/sm9/sm9_params.c

@@ -60,8 +60,8 @@
 
 
 #define BN_SM9_BN256_TOP (256+BN_BITS2-1)/BN_BITS2
-#define BN_SM9_TRACE_TOP (66+BN_BITS2-1)/BN_BITS2
-#define BN_SM9_FINAL_EXPO_TOP (66+BN_BITS2-1)/BN_BITS2
+#define BN_SM9_LOOP_TOP (66+BN_BITS2-1)/BN_BITS2
+#define BN_SM9_FINAL_EXPO_TOP (2816+BN_BITS2-1)/BN_BITS2
 
 #if BN_BITS2 == 64
 static const BN_ULONG _sm9bn256v1_prime[BN_SM9_BN256_TOP] = {
@@ -74,7 +74,7 @@ static const BN_ULONG _sm9bn256v1_order[BN_SM9_BN256_TOP] = {
 	0xD603AB4FF58EC744ULL, 0xB640000002A3A6F1ULL,
 };
 
-static const BN_ULONG _sm9bn256v1_trace[BN_SM9_TRACE_TOP] = {
+static const BN_ULONG _sm9bn256v1_loop[BN_SM9_LOOP_TOP] = {
 	0x400000000215D93EULL, 0x02ULL,
 };
 
@@ -93,7 +93,28 @@ static const BN_ULONG _sm9bn256v1_y2[][BN_SM9_BN256_TOP] = {
 };
 
 static const BN_ULONG _sm9bn256v1_final_expo[BN_SM9_FINAL_EXPO_TOP] = {
-	0x400000000215D93EULL, 0x02ULL,
+	0x2FACDD0F0D042330ULL, 0xB19FE1764AC0B748ULL,
+	0xC6135FEC864E1676ULL, 0x8E4890AB7E824DC7ULL,
+	0x5B83E3D7E2D0B969ULL, 0xCBD806A8225955B0ULL,
+	0x6FE5E935A4B5F799ULL, 0x0B48EE8FD4C31B8FULL,
+	0x8478B1A3E843D1FAULL, 0xBB6793F9FE39F256ULL,
+	0xB760558913D719F2ULL, 0xEFE915CAB1B62D11ULL,
+	0x1D16182C1D978AD0ULL, 0x5BBD6C4AA78C62F3ULL,
+	0xF703B00C9E53535AULL, 0x0F4C6983D64089BDULL,
+	0xC3E3945F87BF2203ULL, 0xE804F361D729E88DULL,
+	0x6B948EBD4AA170BAULL, 0x4550E98DCA2042C3ULL,
+	0x5A54D51E82F7DD63ULL, 0x2FB14FC5412315ECULL,
+	0xE2C3601D19F32C69ULL, 0x335D59C358AAC66EULL,
+	0x96FD3135583D5AA1ULL, 0xB78BD480FF56FA06ULL,
+	0xA4DEFA394C04689AULL, 0xCB5A6B4B9EC19BA7ULL,
+	0x80357732739295EDULL, 0x3BED65F00632C9CCULL,
+	0x93DC562FA23AFA5AULL, 0xF1C8D7D0598EEE9BULL,
+	0xB97559B180EE9629ULL, 0x5ED57CD410455806ULL,
+	0x239E0CB2A1387366ULL, 0x96F691269CEB7907ULL,
+	0x93B5122D974B7BA1ULL, 0xBE8CB0476C5042CBULL,
+	0x9BF41BCB4067AA64ULL, 0xDD9D1D3019DBA153ULL,
+	0xC16BE7FBACA54D38ULL, 0xACEF6F4E86411255ULL,
+	0x1A09A6AE43ADE454ULL, 0x061835E8B1259499ULL,
 };
 
 #elif BN_BITS2 == 32
@@ -107,7 +128,7 @@ static const BN_ULONG _sm9bn256v1_order[BN_SM9_BN256_TOP] = {
 	0xF58EC744, 0xD603AB4F, 0x02A3A6F1, 0xB6400000,
 };
 
-static const BN_ULONG _sm9bn256v1_trace[BN_SM9_TRACE_TOP] = {
+static const BN_ULONG _sm9bn256v1_loop[BN_SM9_LOOP_TOP] = {
 	0x0215D93E, 0x40000000, 0x02,
 };
 
@@ -126,7 +147,28 @@ static const BN_ULONG _sm9bn256v1_y2[][BN_SM9_BN256_TOP] = {
 };
 
 static const BN_ULONG _sm9bn256v1_final_expo[BN_SM9_FINAL_EXPO_TOP] = {
-	0, 0, 0
+	0x0D042330, 0x2FACDD0F, 0x4AC0B748, 0xB19FE176,
+	0x864E1676, 0xC6135FEC, 0x7E824DC7, 0x8E4890AB,
+	0xE2D0B969, 0x5B83E3D7, 0x225955B0, 0xCBD806A8,
+	0xA4B5F799, 0x6FE5E935, 0xD4C31B8F, 0x0B48EE8F,
+	0xE843D1FA, 0x8478B1A3, 0xFE39F256, 0xBB6793F9,
+	0x13D719F2, 0xB7605589, 0xB1B62D11, 0xEFE915CA,
+	0x1D978AD0, 0x1D16182C, 0xA78C62F3, 0x5BBD6C4A,
+	0x9E53535A, 0xF703B00C, 0xD64089BD, 0x0F4C6983,
+	0x87BF2203, 0xC3E3945F, 0xD729E88D, 0xE804F361,
+	0x4AA170BA, 0x6B948EBD, 0xCA2042C3, 0x4550E98D,
+	0x82F7DD63, 0x5A54D51E, 0x412315EC, 0x2FB14FC5,
+	0x19F32C69, 0xE2C3601D, 0x58AAC66E, 0x335D59C3,
+	0x583D5AA1, 0x96FD3135, 0xFF56FA06, 0xB78BD480,
+	0x4C04689A, 0xA4DEFA39, 0x9EC19BA7, 0xCB5A6B4B,
+	0x739295ED, 0x80357732, 0x0632C9CC, 0x3BED65F0,
+	0xA23AFA5A, 0x93DC562F, 0x598EEE9B, 0xF1C8D7D0,
+	0x80EE9629, 0xB97559B1, 0x10455806, 0x5ED57CD4,
+	0xA1387366, 0x239E0CB2, 0x9CEB7907, 0x96F69126,
+	0x974B7BA1, 0x93B5122D, 0x6C5042CB, 0xBE8CB047,
+	0x4067AA64, 0x9BF41BCB, 0x19DBA153, 0xDD9D1D30,
+	0xACA54D38, 0xC16BE7FB, 0x86411255, 0xACEF6F4E,
+	0x43ADE454, 0x1A09A6AE, 0xB1259499, 0x061835E8,
 };
 
 #else
@@ -149,10 +191,10 @@ static const BIGNUM _bignum_sm9bn256v1_order = {
 	BN_FLG_STATIC_DATA
 };
 
-static const BIGNUM _bignum_sm9bn256v1_trace = {
-	(BN_ULONG *)_sm9bn256v1_trace,
-	BN_SM9_TRACE_TOP,
-	BN_SM9_TRACE_TOP,
+static const BIGNUM _bignum_sm9bn256v1_loop = {
+	(BN_ULONG *)_sm9bn256v1_loop,
+	BN_SM9_LOOP_TOP,
+	BN_SM9_LOOP_TOP,
 	0,
 	BN_FLG_STATIC_DATA
 };
@@ -227,9 +269,9 @@ const BIGNUM *SM9_get0_order(void)
 	return &_bignum_sm9bn256v1_order;
 }
 
-const BIGNUM *SM9_get0_trace(void)
+const BIGNUM *SM9_get0_loop_count(void)
 {
-	return &_bignum_sm9bn256v1_trace;
+	return &_bignum_sm9bn256v1_loop;
 }
 
 const BIGNUM *SM9_get0_final_exponent(void)

crypto/sm9/sm9_setup.c

@@ -218,7 +218,5 @@ end:
 int SM9_setup_by_pairing_name(int nid, int hid,
 	SM9PublicParameters **mpk, SM9MasterSecret **msk)
 {
-	EC_GROUP *group = EC_GROUP_new_sm9s256t1();
-	return SM9_setup_type1curve(group, EVP_sm3(), mpk, msk);
+	return 0;
 }
-