generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ec/ecp_nistz256.c: further harmonization with latest rules.

Browse Source 
Reviewed-by: Tim Hudson <tjh@openssl.org>
This commit is contained in:
Andy Polyakov 2015-01-21 17:28:45 +01:00 committed by Matt Caswell
parent 4664862013
commit 20728adc8f
1 changed files with 74 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

122
crypto/ec/ecp_nistz256.c
View File

@ -71,9 +71,11 @@ typedef P256_POINT_AFFINE PRECOMP256_ROW[64];
typedef struct ec_pre_comp_st { typedef struct ec_pre_comp_st {
const EC_GROUP *group; /* Parent EC_GROUP object */ const EC_GROUP *group; /* Parent EC_GROUP object */
size_t w; /* Window size */ size_t w; /* Window size */
/* Constant time access to the X and Y coordinates of the pre-computed, /*
* Constant time access to the X and Y coordinates of the pre-computed,
* generator multiplies, in the Montgomery domain. Pre-calculated * generator multiplies, in the Montgomery domain. Pre-calculated
* multiplies are stored in affine form. */ * multiplies are stored in affine form.
*/
PRECOMP256_ROW *precomp; PRECOMP256_ROW *precomp;
void *precomp_storage; void *precomp_storage;
int references; int references;
@ -89,15 +91,15 @@ void ecp_nistz256_div_by_2(BN_ULONG res[P256_LIMBS],
/* Modular mul by 3: res = 3*a mod P */ /* Modular mul by 3: res = 3*a mod P */
void ecp_nistz256_mul_by_3(BN_ULONG res[P256_LIMBS], void ecp_nistz256_mul_by_3(BN_ULONG res[P256_LIMBS],
const BN_ULONG a[P256_LIMBS]); const BN_ULONG a[P256_LIMBS]);
/* Modular add: res = a+b mod P */ /* Modular add: res = a+b mod P */
void ecp_nistz256_add(BN_ULONG res[P256_LIMBS], void ecp_nistz256_add(BN_ULONG res[P256_LIMBS],
const BN_ULONG a[P256_LIMBS], const BN_ULONG a[P256_LIMBS],
const BN_ULONG b[P256_LIMBS]); const BN_ULONG b[P256_LIMBS]);
/* Modular sub: res = a-b mod P */ /* Modular sub: res = a-b mod P */
void ecp_nistz256_sub(BN_ULONG res[P256_LIMBS], void ecp_nistz256_sub(BN_ULONG res[P256_LIMBS],
const BN_ULONG a[P256_LIMBS], const BN_ULONG a[P256_LIMBS],
const BN_ULONG b[P256_LIMBS]); const BN_ULONG b[P256_LIMBS]);
/* Modular neg: res = -a mod P */ /* Modular neg: res = -a mod P */
void ecp_nistz256_neg(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS]); void ecp_nistz256_neg(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS]);
/* Montgomery mul: res = a*b*2^-256 mod P */ /* Montgomery mul: res = a*b*2^-256 mod P */
void ecp_nistz256_mul_mont(BN_ULONG res[P256_LIMBS], void ecp_nistz256_mul_mont(BN_ULONG res[P256_LIMBS],
@ -114,11 +116,11 @@ void ecp_nistz256_to_mont(BN_ULONG res[P256_LIMBS],
const BN_ULONG in[P256_LIMBS]); const BN_ULONG in[P256_LIMBS]);
/* Functions that perform constant time access to the precomputed tables */ /* Functions that perform constant time access to the precomputed tables */
void ecp_nistz256_scatter_w5(P256_POINT *val, void ecp_nistz256_scatter_w5(P256_POINT *val,
const P256_POINT *in_t, int index); const P256_POINT *in_t, int index);
void ecp_nistz256_gather_w5(P256_POINT * val, void ecp_nistz256_gather_w5(P256_POINT *val,
const P256_POINT *in_t, int index); const P256_POINT *in_t, int index);
void ecp_nistz256_scatter_w7(P256_POINT_AFFINE *val, void ecp_nistz256_scatter_w7(P256_POINT_AFFINE *val,
const P256_POINT_AFFINE *in_t, int index); const P256_POINT_AFFINE *in_t, int index);
void ecp_nistz256_gather_w7(P256_POINT_AFFINE *val, void ecp_nistz256_gather_w7(P256_POINT_AFFINE *val,
const P256_POINT_AFFINE *in_t, int index); const P256_POINT_AFFINE *in_t, int index);
@ -279,8 +281,8 @@ static void ecp_nistz256_point_double(P256_POINT *r, const P256_POINT *a)
} }
/* Point addition: r = a+b */ /* Point addition: r = a+b */
static void ecp_nistz256_point_add(P256_POINT * r, static void ecp_nistz256_point_add(P256_POINT *r,
const P256_POINT * a, const P256_POINT * b) const P256_POINT *a, const P256_POINT *b)
{ {
BN_ULONG U2[P256_LIMBS], S2[P256_LIMBS]; BN_ULONG U2[P256_LIMBS], S2[P256_LIMBS];
BN_ULONG U1[P256_LIMBS], S1[P256_LIMBS]; BN_ULONG U1[P256_LIMBS], S1[P256_LIMBS];
@ -336,8 +338,9 @@ static void ecp_nistz256_point_add(P256_POINT * r,
ecp_nistz256_mul_mont(U2, in2_x, Z1sqr); /* U2 = X2*Z1^2 */ ecp_nistz256_mul_mont(U2, in2_x, Z1sqr); /* U2 = X2*Z1^2 */
ecp_nistz256_sub(H, U2, U1); /* H = U2 - U1 */ ecp_nistz256_sub(H, U2, U1); /* H = U2 - U1 */
/* This should not happen during sign/ecdh, /*
* so no constant time violation */ * This should not happen during sign/ecdh, so no constant time violation
*/
if (is_equal(U1, U2) && !in1infty && !in2infty) { if (is_equal(U1, U2) && !in1infty && !in2infty) {
if (is_equal(S1, S2)) { if (is_equal(S1, S2)) {
ecp_nistz256_point_double(r, a); ecp_nistz256_point_double(r, a);
@ -404,8 +407,10 @@ static void ecp_nistz256_point_add_affine(P256_POINT *r,
const BN_ULONG *in2_x = b->X; const BN_ULONG *in2_x = b->X;
const BN_ULONG *in2_y = b->Y; const BN_ULONG *in2_y = b->Y;
/* In affine representation we encode infty as (0,0), /*
* which is not on the curve, so it is OK */ * In affine representation we encode infty as (0,0), which is not on the
* curve, so it is OK
*/
in1infty = (in1_x[0] | in1_x[1] | in1_x[2] | in1_x[3] | in1infty = (in1_x[0] | in1_x[1] | in1_x[2] | in1_x[3] |
in1_y[0] | in1_y[1] | in1_y[2] | in1_y[3]); in1_y[0] | in1_y[1] | in1_y[2] | in1_y[3]);
if (P256_LIMBS == 8) if (P256_LIMBS == 8)
@ -467,8 +472,10 @@ static void ecp_nistz256_point_add_affine(P256_POINT *r,
static void ecp_nistz256_mod_inverse(BN_ULONG r[P256_LIMBS], static void ecp_nistz256_mod_inverse(BN_ULONG r[P256_LIMBS],
const BN_ULONG in[P256_LIMBS]) const BN_ULONG in[P256_LIMBS])
{ {
/* The poly is ffffffff 00000001 00000000 00000000 00000000 ffffffff ffffffff ffffffff /*
We use FLT and used poly-2 as exponent */ * The poly is ffffffff 00000001 00000000 00000000 00000000 ffffffff
* ffffffff ffffffff We use FLT and used poly-2 as exponent
*/
BN_ULONG p2[P256_LIMBS]; BN_ULONG p2[P256_LIMBS];
BN_ULONG p4[P256_LIMBS]; BN_ULONG p4[P256_LIMBS];
BN_ULONG p8[P256_LIMBS]; BN_ULONG p8[P256_LIMBS];
@ -538,10 +545,12 @@ static void ecp_nistz256_mod_inverse(BN_ULONG r[P256_LIMBS],
memcpy(r, res, sizeof(res)); memcpy(r, res, sizeof(res));
} }
/* ecp_nistz256_bignum_to_field_elem copies the contents of |in| to |out| and /*
* returns one if it fits. Otherwise it returns zero. */ * ecp_nistz256_bignum_to_field_elem copies the contents of |in| to |out| and
* returns one if it fits. Otherwise it returns zero.
*/
static int ecp_nistz256_bignum_to_field_elem(BN_ULONG out[P256_LIMBS], static int ecp_nistz256_bignum_to_field_elem(BN_ULONG out[P256_LIMBS],
const BIGNUM * in) const BIGNUM *in)
{ {
return bn_copy_words(out, in, P256_LIMBS); return bn_copy_words(out, in, P256_LIMBS);
} }
@ -559,9 +568,9 @@ static void ecp_nistz256_windowed_mul(const EC_GROUP *group,
const unsigned int window_size = 5; const unsigned int window_size = 5;
const unsigned int mask = (1 << (window_size + 1)) - 1; const unsigned int mask = (1 << (window_size + 1)) - 1;
unsigned int wvalue; unsigned int wvalue;
P256_POINT *temp; /* place for 5 temporary points */ P256_POINT *temp; /* place for 5 temporary points */
const BIGNUM **scalars = NULL; const BIGNUM **scalars = NULL;
P256_POINT(*table)[16] = NULL; P256_POINT (*table)[16] = NULL;
void *table_storage = NULL; void *table_storage = NULL;
if ((table_storage = if ((table_storage =
@ -574,7 +583,7 @@ static void ecp_nistz256_windowed_mul(const EC_GROUP *group,
} }
table = (void *)ALIGNPTR(table_storage, 64); table = (void *)ALIGNPTR(table_storage, 64);
temp = (P256_POINT *)(table + num); temp = (P256_POINT *)(table + num);
for (i = 0; i < num; i++) { for (i = 0; i < num; i++) {
P256_POINT *row = table[i]; P256_POINT *row = table[i];
@ -618,9 +627,10 @@ static void ecp_nistz256_windowed_mul(const EC_GROUP *group,
goto err; goto err;
} }
/* row[0] is implicitly (0,0,0) (the point at infinity), /*
* therefore it is not stored. All other values are actually * row[0] is implicitly (0,0,0) (the point at infinity), therefore it
* stored with an offset of -1 in table. * is not stored. All other values are actually stored with an offset
* of -1 in table.
*/ */
ecp_nistz256_scatter_w5 (row, &temp[0], 1); ecp_nistz256_scatter_w5 (row, &temp[0], 1);
@ -729,8 +739,10 @@ const static BN_ULONG def_yG[P256_LIMBS] = {
TOBN(0xd2e88688, 0xdd21f325), TOBN(0x8571ff18, 0x25885d85) TOBN(0xd2e88688, 0xdd21f325), TOBN(0x8571ff18, 0x25885d85)
}; };
/* ecp_nistz256_is_affine_G returns one if |generator| is the standard, /*
* P-256 generator. */ * ecp_nistz256_is_affine_G returns one if |generator| is the standard, P-256
* generator.
*/
static int ecp_nistz256_is_affine_G(const EC_POINT *generator) static int ecp_nistz256_is_affine_G(const EC_POINT *generator)
{ {
return (bn_get_top(generator->X) == P256_LIMBS) && return (bn_get_top(generator->X) == P256_LIMBS) &&
@ -743,10 +755,12 @@ static int ecp_nistz256_is_affine_G(const EC_POINT *generator)
static int ecp_nistz256_mult_precompute(EC_GROUP *group, BN_CTX *ctx) static int ecp_nistz256_mult_precompute(EC_GROUP *group, BN_CTX *ctx)
{ {
/* We precompute a table for a Booth encoded exponent (wNAF) based /*
* We precompute a table for a Booth encoded exponent (wNAF) based
* computation. Each table holds 64 values for safe access, with an * computation. Each table holds 64 values for safe access, with an
* implicit value of infinity at index zero. We use window of size 7, * implicit value of infinity at index zero. We use window of size 7, and
* and therefore require ceil(256/7) = 37 tables. */ * therefore require ceil(256/7) = 37 tables.
*/
BIGNUM *order; BIGNUM *order;
EC_POINT *P = NULL, *T = NULL; EC_POINT *P = NULL, *T = NULL;
const EC_POINT *generator; const EC_POINT *generator;
@ -769,8 +783,10 @@ static int ecp_nistz256_mult_precompute(EC_GROUP *group, BN_CTX *ctx)
} }
if (ecp_nistz256_is_affine_G(generator)) { if (ecp_nistz256_is_affine_G(generator)) {
/* No need to calculate tables for the standard generator /*
* because we have them statically. */ * No need to calculate tables for the standard generator because we
* have them statically.
*/
return 1; return 1;
} }
@ -810,17 +826,20 @@ static int ecp_nistz256_mult_precompute(EC_GROUP *group, BN_CTX *ctx)
P = EC_POINT_new(group); P = EC_POINT_new(group);
T = EC_POINT_new(group); T = EC_POINT_new(group);
/* The zero entry is implicitly infinity, and we skip it, /*
* storing other values with -1 offset. */ * The zero entry is implicitly infinity, and we skip it, storing other
* values with -1 offset.
*/
EC_POINT_copy(T, generator); EC_POINT_copy(T, generator);
for (k = 0; k < 64; k++) { for (k = 0; k < 64; k++) {
EC_POINT_copy(P, T); EC_POINT_copy(P, T);
for (j = 0; j < 37; j++) { for (j = 0; j < 37; j++) {
P256_POINT_AFFINE temp; P256_POINT_AFFINE temp;
/* It would be faster to use /*
* ec_GFp_simple_points_make_affine and make multiple * It would be faster to use ec_GFp_simple_points_make_affine and
* points affine at the same time. */ * make multiple points affine at the same time.
*/
ec_GFp_simple_make_affine(group, P, ctx); ec_GFp_simple_make_affine(group, P, ctx);
ecp_nistz256_bignum_to_field_elem(temp.X, P->X); ecp_nistz256_bignum_to_field_elem(temp.X, P->X);
ecp_nistz256_bignum_to_field_elem(temp.Y, P->Y); ecp_nistz256_bignum_to_field_elem(temp.Y, P->Y);
@ -907,9 +926,11 @@ static void booth_recode_w7(unsigned char *sign,
*digit = d; *digit = d;
} }
/* ecp_nistz256_avx2_mul_g performs multiplication by G, using only the /*
* ecp_nistz256_avx2_mul_g performs multiplication by G, using only the
* precomputed table. It does 4 affine point additions in parallel, * precomputed table. It does 4 affine point additions in parallel,
* significantly speeding up point multiplication for a fixed value. */ * significantly speeding up point multiplication for a fixed value.
*/
static void ecp_nistz256_avx2_mul_g(P256_POINT *r, static void ecp_nistz256_avx2_mul_g(P256_POINT *r,
unsigned char p_str[33], unsigned char p_str[33],
const P256_POINT_AFFINE(*preComputedTable)[64]) const P256_POINT_AFFINE(*preComputedTable)[64])
@ -1159,9 +1180,10 @@ static int ecp_nistz256_points_mul(const EC_GROUP *group,
ecp_nistz256_pre_comp_clear_free); ecp_nistz256_pre_comp_clear_free);
if (pre_comp) { if (pre_comp) {
/* If there is a precomputed table for the generator, /*
* check that it was generated with the same * If there is a precomputed table for the generator, check that
* generator. */ * it was generated with the same generator.
*/
EC_POINT *pre_comp_generator = EC_POINT_new(group); EC_POINT *pre_comp_generator = EC_POINT_new(group);
if (pre_comp_generator == NULL) if (pre_comp_generator == NULL)
goto err; goto err;
@ -1178,10 +1200,12 @@ static int ecp_nistz256_points_mul(const EC_GROUP *group,
} }
if (preComputedTable == NULL && ecp_nistz256_is_affine_G(generator)) { if (preComputedTable == NULL && ecp_nistz256_is_affine_G(generator)) {
/* If there is no precomputed data, but the generator /*
* is the default, a hardcoded table of precomputed * If there is no precomputed data, but the generator is the
* data is used. This is because applications, such as * default, a hardcoded table of precomputed data is used. This
* Apache, do not use EC_KEY_precompute_mult. */ * is because applications, such as Apache, do not use
* EC_KEY_precompute_mult.
*/
preComputedTable = ecp_nistz256_precomputed; preComputedTable = ecp_nistz256_precomputed;
} }
@ -1262,8 +1286,10 @@ static int ecp_nistz256_points_mul(const EC_GROUP *group,
p_is_infinity = 1; p_is_infinity = 1;
if (no_precomp_for_generator) { if (no_precomp_for_generator) {
/* Without a precomputed table for the generator, it has to be /*
* handled like a normal point. */ * Without a precomputed table for the generator, it has to be
* handled like a normal point.
*/
const BIGNUM **new_scalars; const BIGNUM **new_scalars;
const EC_POINT **new_points; const EC_POINT **new_points;