Paul Elliott
4fa8334bae
Convert curve 448 to use ecp core functions
...
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2023-05-16 17:51:48 +01:00
Gabor Mezei
caac83c517
Fix comment
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-16 17:41:26 +02:00
Gabor Mezei
03558b847e
Add _raw
function to P256K1
...
Modified the testing to use the generic fast reduction test function.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-16 17:30:03 +02:00
Gabor Mezei
e42bb6294e
Add _raw
function to P224K1
...
Modified the testing to use the generic fast reduction test function.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-16 17:30:03 +02:00
Gabor Mezei
dacfe56370
Add _raw
function to P192K1
...
Modified the testing to use the generic fast reduction test function.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-16 17:29:57 +02:00
Gabor Mezei
a274041190
Fix comment
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-15 14:50:17 +02:00
Gabor Mezei
b6653f3e27
Update comments
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-12 12:34:12 +02:00
Gabor Mezei
dcaf99ebb8
Add another round in the Koblitz reduction
...
The addition can result in an overflow so another round is needed
in the reduction.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-12 12:34:05 +02:00
Paul Elliott
481a6a8edb
Merge pull request #7482 from gabor-mezei-arm/6029_use_core_api_in_ecp_mod_koblitz
...
[Bignum] Use core API in ecp_mod_koblitz()
2023-05-10 17:24:46 +01:00
Gabor Mezei
908f40014c
Determine special cases in-place in the common Koblitz function
...
Remove parameter used by the special cases and check for special cases in-place.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-05 16:31:19 +02:00
Paul Elliott
47a3c82118
Enable curve 448 to be tested
...
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2023-04-26 22:23:13 +01:00
Gabor Mezei
19c6f47dbc
Allocate the right amount of memory
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 15:22:11 +02:00
Gabor Mezei
fead53311b
Remove unused macro
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 15:20:01 +02:00
Gabor Mezei
03367fe42d
Ignore carry since it can not be generated
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 14:08:45 +02:00
Gabor Mezei
d2c0ba172c
Fix value in comment
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 14:08:44 +02:00
Gabor Mezei
7097447b84
Ensure input parameter size for Koblitz reduction
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 14:08:35 +02:00
Gabor Mezei
8183c5dcc3
Use core API in ecp_mod_koblitz()
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 14:03:29 +02:00
Janos Follath
91a618375a
Merge pull request #7427 from minosgalanakis/ecp/7258_ecp_mod_p256K1_add_test_cases
...
ECP: Add Unit Tests for secp256k1
2023-04-26 08:52:24 +01:00
Minos Galanakis
9c2c81f996
ecp_curves: Renamed ecp_mod_p256k1
-> mbedtls_ecp_mod_p256k1
...
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-04-25 13:30:59 +01:00
Minos Galanakis
d6751dcd8b
ecp_curves: Added unit-tests for secp256k1
...
This patch introduces basic unit-testing for the `ecp_mod_p256k1()`.
The method is exposed through the ecp_invasive interface, and
the standard testing data is being provided by the python framework.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-04-25 13:30:59 +01:00
Gabor Mezei
f921f4d228
Use loop for two passes in the reduction
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-21 14:09:06 +02:00
Minos Galanakis
9d80879f90
ecp_curves: Introduced mbedtls_ecp_mod_p224k1()
...
This patch introduces a `MBEDTLS_STATIC_TESTABLE` helper
method which exposes `ecp_mod_p256k1()` to the test-framework
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-04-18 14:13:20 +01:00
Minos Galanakis
e5dab975c6
ecp_curves: Added unit-tests for secp224k1
...
This patch introduces basic unit-testing for the `ecp_mod_p224k1()`.
The method is exposed through the ecp_invasive interface, and
the standard testing data is being provided by the python framework.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-04-18 14:13:20 +01:00
Janos Follath
3c3b94a31b
Merge pull request #7424 from gabor-mezei-arm/7256_unit_tests_for_p192k1
...
Add unit tests for ecp_mod_p192k1()
2023-04-18 12:19:40 +01:00
Gabor Mezei
0a11ee6da8
Fix function declaration
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-13 12:48:06 +02:00
Gabor Mezei
83669d910e
Add a testable function for ecp_mod_p192k1
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-13 12:44:37 +02:00
Valerio Setti
d4a5d461de
library: add remaining changes for the new ECP_LIGHT symbol
...
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-04-11 11:33:50 +02:00
Janos Follath
44c6694be7
Merge pull request #7351 from gabor-mezei-arm/7109_ecp_fast_reduction_testing
...
Test unlikely cases of ECC modular reduction
2023-04-06 15:55:19 +01:00
Gabor Mezei
df9c029dd5
Remove obsolete ecp_fix_negative function
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-28 18:43:07 +02:00
Gabor Mezei
514806bbe9
Add a second round of carry reduction for P192 fast reduction
...
The first round of carry reduction can generate a carry so a
second round is needed.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-28 15:09:34 +02:00
Minos Galanakis
68d64a10b6
ecp_curves: Re-introduced mbedtls_ecp_fix_negative()
...
This patch re-introduces `mbedtls_ecp_fix_negative` and
appropriately adjusts its' define guards.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-03-22 11:28:15 +00:00
Minos Galanakis
37f4cb6d0e
ecp_curves: Minor rework for p384
...
This patch adjusts formatting, documentation and testing.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-03-21 15:46:50 +00:00
Minos Galanakis
6fb105fb2e
ecp_curves: Ported prototypes
...
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-03-21 15:41:26 +00:00
Janos Follath
c18cd0c8e6
Merge pull request #7230 from gabor-mezei-arm/6850_Secp256r1_fast_reduction
...
Extract Secp256r1 fast reduction from the prototype
2023-03-16 19:43:25 +00:00
Gabor Mezei
e4710ae9ed
Add and fix comments
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-09 13:43:02 +01:00
Gabor Mezei
716447ff32
Fix limb size calculation
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-08 14:09:51 +01:00
Gabor Mezei
ed1acf642c
Apply naming conventions
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-08 14:09:50 +01:00
Gabor Mezei
5221c04b92
Change the p256_raw fuction to be testable
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-08 14:09:50 +01:00
Gabor Mezei
ab6ac91a0a
Extract Secp256r1 from the prototype
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-08 14:09:50 +01:00
Tom Cosgrove
5c8505f061
Fix typos
...
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2023-03-07 11:39:52 +00:00
Janos Follath
fe780a3c4b
Merge pull request #7184 from gabor-mezei-arm/6349_Secp224r1_fast_reduction
...
Extract Secp224r1 fast reduction from the prototype
2023-03-07 10:57:58 +00:00
Gabor Mezei
97803abd2a
Update comment
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-06 16:32:16 +01:00
Gabor Mezei
aeadc2d731
Apply naming convention
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-01 16:53:03 +01:00
Gabor Mezei
620f0dc850
Fix for 32-bit
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-28 18:42:33 +01:00
Gabor Mezei
08a94953e1
Apply naming convention for p224
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-28 18:40:57 +01:00
Gabor Mezei
5afb80e00a
Fix coding style issues
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-27 17:00:34 +01:00
Gabor Mezei
804cfd32ea
Follow the naming convention
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-27 16:50:09 +01:00
Gabor Mezei
bf506361c4
Revert the illustration and remove unnecessary code
...
This reverts commit 73e8553273
.
Removes the second round of carry reduction from p224.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-27 16:37:32 +01:00
Gabor Mezei
73e8553273
Add comments to illustrate the second round of carry reduction is unnecessary
...
The first round of carry reduction can not generate a carry thus the
secound round is not needed. The comments illustrating when the
carry is 1. The reduction is simmetric so the case when the carry is
-1 is similar.
The illustration is trying to calculate the input value starting with
setting the carry to 1 before the second round of the carry reduction.
It calculates backwords and tries to determine the value range of
each word. It ends up with a contradiction that A10 must have the
value of 0 and UINT32_MAX.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-27 16:32:42 +01:00
Gabor Mezei
a835d20cde
Add documentation
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-27 15:58:30 +01:00
Gabor Mezei
aef0f2de9f
Fix limb size calculation
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-21 11:35:31 +01:00
Gabor Mezei
e14b5bdba7
Change the ecp_mod_p224_raw to be testable
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-21 11:35:26 +01:00
Gabor Mezei
66f88a9d22
Extract Secp224r1 from the prototype
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-21 11:32:29 +01:00
Minos Galanakis
a30afe2216
ecp_curves: Minor refactoring.
...
This patch introduces the following changes:
* Documentation for `mbedtls_ecp_modulus_setup()`
moved to `ecp_invasive.h`.
* Added invalid modulus selector `MBEDTLS_ECP_MOD_NONE`.
* Adjusted negative tests to use invalid selectors.
* Reworded documentation.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-02-20 13:53:06 +00:00
Minos Galanakis
d2ca802329
ecp_curves: Added mbedtls_ecp_modulus_setup()
.
...
This patch introduces a new static method, responsible
for automatically initialising an modulus structure,
based on the curve id and a modulus type selector.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-02-20 13:49:46 +00:00
Gabor Mezei
ac70ad6576
Fix coding style
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-16 19:31:21 +01:00
Gabor Mezei
cf228706cd
Restrict input parameter size for ecp_mod_p521_raw
...
The imput mpi parameter must have twice as many limbs as the modulus.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:19:08 +01:00
Gabor Mezei
d10d429380
Stack usage optimization for mod_p521
...
Instead of creating an mpi on the stack, reuse the unused part of the input mpi.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:51 +01:00
Janos Follath
fe24e91a34
mod_p521: document reduction algorithm
...
Signed-off-by: Janos Follath <janos.follath@arm.com>
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:50 +01:00
Janos Follath
666673e83f
modp521: apply naming conventions
...
Apply the usual parameter name and align the local variables and
comments. This naming diverges from the standard notation, but this is
beneficial as our variable meanings diverge as well and the difference
can help avoiding confusion.
Signed-off-by: Janos Follath <janos.follath@arm.com>
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:50 +01:00
Janos Follath
13c3aa13af
Revert changes to mod_p521 flow
...
It is not necessary to save the middle limb upfront as overwriting it is
the desired result: in the first step we are reducing modulo
2^{512+biL}.
Arguably, the original flow is more intuitive and easier to see the idea
behind it.
Signed-off-by: Janos Follath <janos.follath@arm.com>
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:50 +01:00
Gabor Mezei
6bfbd36507
Fix coding style issues
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:49 +01:00
Gabor Mezei
b62ad5d569
Rename function to follow naming convention
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:48 +01:00
Gabor Mezei
2cb630edee
Change the ecp_mod_p521_raw to be testable
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:05:22 +01:00
Gabor Mezei
8450ab9c60
Fix Secp521r1 reduction
...
The prototype calculated with wrong limb size and not taken into account
the overflow in the shared limb.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:03:03 +01:00
Gabor Mezei
42df16c84b
Extract Secp521r1 from the prototype
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:02:57 +01:00
Gilles Peskine
e2a9f86755
Merge pull request #6971 from gabor-mezei-arm/6026_Secp192r1_fast_reduction
...
Extract Secp192r1 fast reduction from the prototype
2023-02-15 16:22:36 +01:00
Gabor Mezei
a264831cff
Update documentation and add comments
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-13 16:29:05 +01:00
Dave Rodgman
6dd757a8ba
Fix use of sizeof without brackets
...
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-02-02 12:40:50 +00:00
Gabor Mezei
2038ce976e
Rename function to follow naming convention
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-01-31 14:40:05 +01:00
Gabor Mezei
deece2bb65
Change the ecp_mod_p192_raw to be testable
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-01-31 14:40:05 +01:00
Gabor Mezei
b5bba497fe
Extract Secp192r1 from the prototype
...
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-01-31 14:40:05 +01:00
Minos Galanakis
e9fa7a74cd
ecp_curves: Update pre-processor define guards for ecp_mpi_load()
.
...
This patch adjusts the logic, so that the method is included,
when the following components are enabled:
* MBEDTLS_ECP_DP_CURVE448_ENABLED
* MBEDTLS_ECP_DP_CURVE25519_ENABLED
* ECP_LOAD_GROUP
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-01-19 16:12:07 +00:00
Minos Galanakis
146fed9849
ecp_curves: Hardcode Montgomery const for curve448.
...
This patch adds two embedded constants used by `ecp_use_curve448()`.
The method has been updated to read that into an mpi instead of
calculating it on the fly.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-01-19 16:11:50 +00:00
Minos Galanakis
bececeb0b9
ecp_curves: Hardcod Montgomery const for curve25519
...
This patch adds two embedded constants used by `ecp_use_curve25519()`.
The method has been updated to read that into an mpi instead of
calculating it on the fly.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-01-19 11:38:19 +00:00
Gilles Peskine
449bd8303e
Switch to the new code style
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-01-11 14:50:10 +01:00
Gilles Peskine
5a34b36bbd
Remove more now-redundant definitions of inline
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-11-25 13:26:44 +01:00
Tom Cosgrove
82d3f1e824
Remove bignum_internal.h, moving contents to bignum_core.h
...
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-08-23 12:01:39 +01:00
Pol Henarejos
b101cb6111
Since the group is unloaded for all curves, it is better to initialize the group also for all curves.
...
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
2022-05-06 18:43:58 +02:00
Pol Henarejos
aa68d36234
Fix order value for curve x448.
...
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
2022-05-05 19:22:29 +02:00
Hanno Becker
0dbf04a9a6
Remove unnecessary memory operations in p25519 quasireduction
...
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-13 07:26:53 +01:00
Hanno Becker
127fcabb21
Fail gracefully upon unexpectedly large input to p25519 reduction
...
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-12 22:18:36 +01:00
Hanno Becker
bb04cb992f
Fix check in p25519 quasi-reduction
...
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-12 11:18:11 +01:00
Hanno Becker
d830feb256
Simplify check in p25519 quasi-reduction
...
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-12 11:10:19 +01:00
Hanno Becker
2ef0cff6c3
Fix size check in p25519 modular reduction
...
The check was meant to precisely catch an underflow.
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-12 11:02:05 +01:00
Hanno Becker
53b3c607a0
Move const
keyword prior to type name
...
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-11 13:46:30 +01:00
Hanno Becker
e9dd9a1f31
Use size_t for number of limbs
...
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-11 09:06:27 +01:00
Hanno Becker
6454993e2e
Safeguard against calling p255 reduction with single-width MPI
...
(In this case, there's nothing to do anyway since we only do a
quasi-reduction to N+1 limbs)
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-11 07:35:58 +01:00
Hanno Becker
25bb732ea7
Simplify x25519 reduction using internal bignum MLA helper
...
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-11 07:03:48 +01:00
Janos Follath
1107ee4e44
Add prefix to BYTES_TO_T_UINT_*
...
These macros were moved into a header and now check-names.sh is failing.
Add an MBEDTL_ prefix to the macro names to make it pass.
Signed-off-by: Janos Follath <janos.follath@arm.com>
2021-06-25 12:46:40 +01:00
Janos Follath
8b8b781524
Use mbedtls_mpi_lset() more
...
Signed-off-by: Janos Follath <janos.follath@arm.com>
2021-06-24 15:00:33 +01:00
Janos Follath
8c70e815dd
Move mpi constant macros to bn_mul.h
...
Signed-off-by: Janos Follath <janos.follath@arm.com>
2021-06-24 14:48:38 +01:00
Manuel Pégourié-Gonnard
06215eaa3e
Avoid complaints about undeclared non-static symbols
...
Clang was complaining and check-names.sh too
This only duplicates macros, so no impact on code size. In 3.0 we can
probably avoid the duplication by using an internal header under
library/ but this won't work for 2.16.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2021-06-23 12:59:02 +02:00
Manuel Pégourié-Gonnard
2d457b8fca
Use more compact encoding of Montgomery curve constants
...
Base 256 beats base 16.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2021-06-23 12:44:21 +02:00
Manuel Pégourié-Gonnard
2389a6000e
Use a more compact encoding of bad points
...
Base 10 is horrible, base 256 is much better.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2021-06-23 12:25:48 +02:00
kXuan
ba9cb76e9f
static initialize comb table
...
MBEDTLS_ECP_FIXED_POINT_OPTIM aims to speed up ecc multiplication performance.
We compute the comb table in runtime now. It is a costly operation.
This patch add a pre-computed table to initialize well-known curves. It speed up ECDSA signature verify process in runtime by using more ROM size.
Signed-off-by: kXuan <kxuanobj@gmail.com>
2021-06-01 10:02:13 +08:00
Gilles Peskine
ff6a32d79c
Fix low-probability arithmetic error in ECC
...
Fix the subtraction in fix_negative, which was incorrectly not looking
for a carry. This caused the result to be wrong when the least
significant limb of N was 0. Fix #4296 .
The bug was introduced by d10e8fae9e
"Optimize fix_negative". Thanks to Philippe Antoine (catenacyber) for
reporting the bug which was found by his EC differential fuzzer.
Credit to OSS-Fuzz.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-04 01:10:41 +02:00
Gilles Peskine
349b37273e
Fix an incorrect comment about fix_negative
...
We're subtracting multiples of 2^bits, not 2^(bits+32).
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-04 01:10:41 +02:00
Gilles Peskine
618be2ec41
Add unit tests for fix_negative
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-04 01:10:41 +02:00
Gilles Peskine
b76517b764
Cosmetic improvement
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-10 23:44:28 +01:00