generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Changes to Lenka's Montgomery implementation.

Browse Source 
Submitted by: Lenka Fibikova
This commit is contained in:
Bodo Möller 2000-11-30 17:35:17 +00:00
parent 0ae485dc07
commit db5bda670f
4 changed files with 189 additions and 125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

224
crypto/bn/bn_mont2.c
View File

@ -14,8 +14,7 @@
#include <stdlib.h>
#include <assert.h>
#include "bn.h"
#include "bn_modfs.h"
#include "bn_lcl.h"
#include "bn_mont2.h"
#define BN_mask_word(x, m) ((x->d[0]) & (m))
@ -145,25 +144,97 @@ int BN_mont_set(BIGNUM *p, BN_MONTGOMERY *mont, BN_CTX *ctx)
}
static int BN_cpy_mul_word(BIGNUM *ret, BIGNUM *a, BN_ULONG w)
/* ret = a * w */
{
if (BN_copy(ret, a) == NULL) return 0;
if (!BN_mul_word(ret, w)) return 0;
return 1;
#ifdef BN_LLONG
#define cpy_mul_add(r, b, a, w, c) { \
BN_ULLONG t; \
t = (BN_ULLONG)w * (a) + (b) + (c); \
(r)= Lw(t); \
(c)= Hw(t); \
}
BN_ULONG BN_mul_add_rshift(BN_ULONG *r, BN_ULONG *a, int num, BN_ULONG w)
/* r = (r + a * w) >> BN_BITS2 */
{
BN_ULONG c = 0;
int BN_mont_red(BIGNUM *y, BN_MONTGOMERY *mont, BN_CTX *ctx)
mul_add(r[0], a[0], w, c);
if (--num == 0) return c;
a++;
for (;;)
{
cpy_mul_add(r[0], r[1], a[0], w, c);
if (--num == 0) break;
cpy_mul_add(r[1], r[2], a[1], w, c);
if (--num == 0) break;
cpy_mul_add(r[2], r[3], a[2], w, c);
if (--num == 0) break;
cpy_mul_add(r[3], r[4], a[3], w, c);
if (--num == 0) break;
a += 4;
r += 4;
}
return c;
}
#else
#define cpy_mul_add(r, b, a, bl, bh, c) { \
BN_ULONG l,h; \
\
h=(a); \
l=LBITS(h); \
h=HBITS(h); \
mul64(l,h,(bl),(bh)); \
\
/* non-multiply part */ \
l=(l+(c))&BN_MASK2; if (l < (c)) h++; \
(c)=(b); \
l=(l+(c))&BN_MASK2; if (l < (c)) h++; \
(c)=h&BN_MASK2; \
(r)=l; \
}
static BN_ULONG BN_mul_add_rshift(BN_ULONG *r, BN_ULONG *a, int num, BN_ULONG w)
/* ret = (ret + a * w) << shift * BN_BITS2 */
{
BN_ULONG c = 0;
BN_ULONG bl, bh;
bl = LBITS(w);
bh = HBITS(w);
mul_add(r[0], a[0], bl, bh, c);
if (--num == 0) return c;
a++;
for (;;)
{
cpy_mul_add(r[0], r[1], a[0], bl, bh, c);
if (--num == 0) break;
cpy_mul_add(r[1], r[2], a[1], bl, bh, c);
if (--num == 0) break;
cpy_mul_add(r[2], r[3], a[2], bl, bh, c);
if (--num == 0) break;
cpy_mul_add(r[3], r[4], a[3], bl, bh, c);
if (--num == 0) break;
a += 4;
r += 4;
}
return c;
}
#endif /* BN_LLONG */
int BN_mont_red(BIGNUM *y, BN_MONTGOMERY *mont)
/* yR^{-1} (mod p) */
{
int i;
BIGNUM *up, *p;
BN_ULONG u;
BIGNUM *p;
BN_ULONG c;
int i, max;
assert(y != NULL && mont != NULL && ctx != NULL);
assert(y != NULL && mont != NULL);
assert(mont->p != NULL);
assert(BN_cmp(y, mont->p) < 0);
assert(!y->neg);
@ -172,50 +243,40 @@ int BN_mont_red(BIGNUM *y, BN_MONTGOMERY *mont, BN_CTX *ctx)
if (BN_is_zero(y)) return 1;
p = mont->p;
max = mont->p_num_bytes;
BN_CTX_start(ctx);
up = BN_CTX_get(ctx);
if (up == NULL) goto err;
if (bn_wexpand(y, max) == NULL) return 0;
for (i = y->top; i < max; i++) y->d[i] = 0;
y->top = max;
for (i = 0; i < mont->p_num_bytes; i++)
/* r = [r + (y_0 * p') * p] / b */
for (i = 0; i < max; i++)
{
u = (y->d[0]) * mont->p_inv_b_neg; /* u = y_0 * p' */
if (!BN_cpy_mul_word(up, p, u)) goto err; /* up = u * p */
if (!BN_add(y, y, up)) goto err;
#ifdef TEST
if (y->d[0]) goto err;
#endif
if (!BN_rshift(y, y, BN_BITS2)) goto err; /* y = (y + up)/b */
c = BN_mul_add_rshift(y->d, p->d, max, ((y->d[0]) * mont->p_inv_b_neg) & BN_MASK2);
y->d[max - 1] = c;
}
while (y->d[y->top - 1] == 0) y->top--;
if (BN_cmp(y, mont->p) >= 0)
if (BN_cmp(y, p) >= 0)
{
if (!BN_sub(y, y, mont->p)) goto err;
if (!BN_sub(y, y, p)) return 0;
}
BN_CTX_end(ctx);
return 1;
err:
BN_CTX_end(ctx);
return 0;
}
int BN_mont_mod_mul(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_MONTGOMERY *mont, BN_CTX *ctx)
int BN_mont_mod_mul(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_MONTGOMERY *mont)
/* r = x * y mod p */
/* r != x && r! = y !!! */
{
BIGNUM *xiy, *up;
BN_ULONG u;
int i;
BN_ULONG c;
BIGNUM *p;
int i, j, max;
assert(r != x && r != y);
assert(r != NULL && x != NULL && y != NULL && mont != NULL && ctx != NULL);
assert(r != NULL && x != NULL && y != NULL && mont != NULL);
assert(mont->p != NULL);
assert(BN_cmp(x, mont->p) < 0);
assert(BN_cmp(y, mont->p) < 0);
@ -228,56 +289,61 @@ int BN_mont_mod_mul(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_MONTGOMERY *mont, BN_CTX
return 1;
}
p = mont->p;
max = mont->p_num_bytes;
BN_CTX_start(ctx);
xiy = BN_CTX_get(ctx);
up = BN_CTX_get(ctx);
if (up == NULL) goto err;
if (!BN_zero(r)) goto err;
/* for multiplication we need at most max + 2 words
the last one --- max + 3 --- is only as a backstop
for incorrect input
*/
if (bn_wexpand(r, max + 3) == NULL) return 0;
for (i = 0; i < max + 3; i++) r->d[i] = 0;
r->top = max + 2;
for (i = 0; i < x->top; i++)
{
u = (r->d[0] + x->d[i] * y->d[0]) * mont->p_inv_b_neg;
if (!BN_cpy_mul_word(xiy, y, x->d[i])) goto err;
if (!BN_cpy_mul_word(up, mont->p, u)) goto err;
if (!BN_add(r, r, xiy)) goto err;
if (!BN_add(r, r, up)) goto err;
#ifdef TEST
if (r->d[0]) goto err;
#endif
if (!BN_rshift(r, r, BN_BITS2)) goto err;
/* r = r + (r_0 + x_i * y_0) * p' * p */
c = bn_mul_add_words(r->d, p->d, max, \
((r->d[0] + x->d[i] * y->d[0]) * mont->p_inv_b_neg) & BN_MASK2);
if (c)
{
if (((r->d[max] += c) & BN_MASK2) < c)
if (((r->d[max + 1] ++) & BN_MASK2) == 0) return 0;
}
/* r = (r + x_i * y) / b */
c = BN_mul_add_rshift(r->d, y->d, y->top, x->d[i]);
for(j = y->top; j <= max + 1; j++) r->d[j - 1] = r->d[j];
if (c)
{
if (((r->d[y->top - 1] += c) & BN_MASK2) < c)
{
j = y->top;
while (((++ (r->d[j]) ) & BN_MASK2) == 0)
j++;
if (j > max) return 0;
}
}
r->d[max + 1] = 0;
}
for (i = x->top; i < mont->p_num_bytes; i++)
for (i = x->top; i < max; i++)
{
u = (r->d[0]) * mont->p_inv_b_neg;
if (!BN_cpy_mul_word(up, mont->p, u)) goto err;
if (!BN_add(r, r, up)) goto err;
#ifdef TEST
if (r->d[0]) goto err;
#endif
if (!BN_rshift(r, r, BN_BITS2)) goto err;
/* r = (r + r_0 * p' * p) / b */
c = BN_mul_add_rshift(r->d, p->d, max, ((r->d[0]) * mont->p_inv_b_neg) & BN_MASK2);
j = max - 1;
r->d[j] = c + r->d[max];
if (r->d[j++] < c) r->d[j] = r->d[++j] + 1;
else r->d[j] = r->d[++j];
r->d[max + 1] = 0;
}
while (r->d[r->top - 1] == 0) r->top--;
if (BN_cmp(r, mont->p) >= 0)
if (BN_cmp(r, mont->p) >= 0)
{
if (!BN_sub(r, r, mont->p)) goto err;
if (!BN_sub(r, r, mont->p)) return 0;
}
BN_CTX_end(ctx);
return 1;
err:
BN_CTX_end(ctx);
return 0;
}

6
crypto/bn/bn_mont2.h
View File

@ -23,14 +23,14 @@ typedef struct bn_mont_st{
BN_ULONG p_inv_b_neg; /* p' = p^{-1} mod b; b = 2^BN_BITS */
} BN_MONTGOMERY;
#define BN_from_mont(x, mont, ctx) (BN_mont_red((x), (mont), (ctx)))
#define BN_from_mont(x, mont) (BN_mont_red((x), (mont)))
BN_MONTGOMERY *BN_mont_new();
int BN_to_mont(BIGNUM *x, BN_MONTGOMERY *mont, BN_CTX *ctx);
void BN_mont_clear_free(BN_MONTGOMERY *mont);
int BN_mont_set(BIGNUM *p, BN_MONTGOMERY *mont, BN_CTX *ctx);
int BN_mont_red(BIGNUM *y, BN_MONTGOMERY *mont, BN_CTX *ctx);
BN_ULONG BN_mont_inv(BIGNUM *x, int e, BN_CTX *ctx);
int BN_mont_red(BIGNUM *y, BN_MONTGOMERY *mont);
int BN_mont_mod_mul(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_MONTGOMERY *mont);
#endif

7
crypto/ec/ec.c
View File

@ -15,7 +15,6 @@
#include <assert.h>
#include "ec.h"
#include "bn_modfs.h"
@ -97,9 +96,9 @@ int EC_from_montgomery(EC *E, BN_MONTGOMERY *mont, BN_CTX *ctx)
if (!E->is_in_mont) return 1;
if (!BN_mont_red(E->A, mont, ctx)) return 0;
if (!BN_mont_red(E->B, mont, ctx)) return 0;
if (!BN_mont_red(E->h, mont, ctx)) return 0;
if (!BN_mont_red(E->A, mont)) return 0;
if (!BN_mont_red(E->B, mont)) return 0;
if (!BN_mont_red(E->h, mont)) return 0;
E->is_in_mont = 0;
return 1;

77
crypto/ec/ec_point.c
View File

@ -16,7 +16,6 @@
#include <openssl/bn.h>
#include "../bn/bn_modfs.h" /* XXX */
#include "../bn/bn_mont2.h" /* XXX */
#include "ec.h"
@ -965,9 +964,9 @@ int ECP_from_montgomery(EC_POINT *P, BN_MONTGOMERY *mont, BN_CTX *ctx)
if (!P->is_in_mont) return 1;
if (!BN_mont_red(P->X, mont, ctx)) return 0;
if (!BN_mont_red(P->Y, mont, ctx)) return 0;
if (!BN_mont_red(P->Z, mont, ctx)) return 0;
if (!BN_mont_red(P->X, mont)) return 0;
if (!BN_mont_red(P->Y, mont)) return 0;
if (!BN_mont_red(P->Z, mont)) return 0;
P->is_in_mont = 0;
return 1;
@ -1019,17 +1018,17 @@ int ECP_mont_cmp(EC_POINT *P, EC_POINT *Q, BN_MONTGOMERY *mont, BN_CTX *ctx)
p = mont->p;
if (!BN_mont_mod_mul(n5, Q->Z, Q->Z, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n1, P->X, n5, mont, ctx)) goto err; /* L1 = x_p * z_q^2 */
if (!BN_mont_mod_mul(n5, Q->Z, Q->Z, mont)) goto err;
if (!BN_mont_mod_mul(n1, P->X, n5, mont)) goto err; /* L1 = x_p * z_q^2 */
if (!BN_mont_mod_mul(n0, n5, Q->Z, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n2, P->Y, n0, mont, ctx)) goto err; /* L2 = y_p * z_q^3 */
if (!BN_mont_mod_mul(n0, n5, Q->Z, mont)) goto err;
if (!BN_mont_mod_mul(n2, P->Y, n0, mont)) goto err; /* L2 = y_p * z_q^3 */
if (!BN_mont_mod_mul(n5, P->Z, P->Z, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n3, Q->X, n5, mont, ctx)) goto err; /* L3 = x_q * z_p^2 */
if (!BN_mont_mod_mul(n5, P->Z, P->Z, mont)) goto err;
if (!BN_mont_mod_mul(n3, Q->X, n5, mont)) goto err; /* L3 = x_q * z_p^2 */
if (!BN_mont_mod_mul(n0, n5, P->Z, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n4, Q->Y, n0, mont, ctx)) goto err; /* L4 = y_q * z_p^3 */
if (!BN_mont_mod_mul(n0, n5, P->Z, mont)) goto err;
if (!BN_mont_mod_mul(n4, Q->Y, n0, mont)) goto err; /* L4 = y_q * z_p^3 */
if (!BN_mod_sub_quick(n0, n1, n3, p)) goto err; /* L5 = L1 - L3 */
@ -1098,36 +1097,36 @@ int ECP_mont_double(EC_POINT *R, EC_POINT *P, EC *E, BN_MONTGOMERY *mont, BN_CTX
p = E->p;
/* L1 */
if (!BN_mont_mod_mul(n0, P->Z, P->Z, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n2, n0, n0, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n0, n2, E->A, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n1, P->X, P->X, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n0, P->Z, P->Z, mont)) goto err;
if (!BN_mont_mod_mul(n2, n0, n0, mont)) goto err;
if (!BN_mont_mod_mul(n0, n2, E->A, mont)) goto err;
if (!BN_mont_mod_mul(n1, P->X, P->X, mont)) goto err;
if (!BN_mod_lshift1_quick(n2, n1, p)) goto err;
if (!BN_mod_add_quick(n1, n1, n2, p)) goto err;
if (!BN_mod_add_quick(n1, n1, n0, p)) goto err; /* L1 = 3 * x^2 + a * z^4 */
/* Z */
if (!BN_mont_mod_mul(n0, P->Y, P->Z, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n0, P->Y, P->Z, mont)) goto err;
if (!BN_mod_lshift1_quick(R->Z, n0, p)) goto err; /* Z = 2 * y * z */
/* L2 */
if (!BN_mont_mod_mul(n3, P->Y, P->Y, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n2, P->X, n3, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n3, P->Y, P->Y, mont)) goto err;
if (!BN_mont_mod_mul(n2, P->X, n3, mont)) goto err;
if (!BN_mod_lshift_quick(n2, n2, 2, p)) goto err; /* L2 = 4 * x * y^2 */
/* X */
if (!BN_mod_lshift1_quick(n0, n2, p)) goto err;
if (!BN_mont_mod_mul(R->X, n1, n1, mont, ctx)) goto err;
if (!BN_mont_mod_mul(R->X, n1, n1, mont)) goto err;
if (!BN_mod_sub_quick(R->X, R->X, n0, p)) goto err; /* X = L1^2 - 2 * L2 */
/* L3 */
if (!BN_mont_mod_mul(n0, n3, n3, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n0, n3, n3, mont)) goto err;
if (!BN_mod_lshift_quick(n3, n0, 3, p)) goto err; /* L3 = 8 * y^4 */
/* Y */
if (!BN_mod_sub_quick(n2, n2, R->X, p)) goto err;
if (!BN_mont_mod_mul(n0, n1, n2, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n0, n1, n2, mont)) goto err;
if (!BN_mod_sub_quick(R->Y, n0, n3, p)) goto err; /* Y = L1 * (L2 - X) - L3 */
BN_CTX_end(ctx);
@ -1190,19 +1189,19 @@ int ECP_mont_add(EC_POINT *R, EC_POINT *P, EC_POINT *Q, EC *E, BN_MONTGOMERY *mo
R->is_in_mont = 1;
/* L1; L2 */
if (!BN_mont_mod_mul(n6, Q->Z, Q->Z, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n1, P->X, n6, mont, ctx)) goto err; /* L1 = x_p * z_q^2 */
if (!BN_mont_mod_mul(n6, Q->Z, Q->Z, mont)) goto err;
if (!BN_mont_mod_mul(n1, P->X, n6, mont)) goto err; /* L1 = x_p * z_q^2 */
if (!BN_mont_mod_mul(n0, n6, Q->Z, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n2, P->Y, n0, mont, ctx)) goto err; /* L2 = y_p * z_q^3 */
if (!BN_mont_mod_mul(n0, n6, Q->Z, mont)) goto err;
if (!BN_mont_mod_mul(n2, P->Y, n0, mont)) goto err; /* L2 = y_p * z_q^3 */
/* L3; L4 */
if (!BN_mont_mod_mul(n6, P->Z, P->Z, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n3, Q->X, n6, mont, ctx)) goto err; /* L3 = x_q * z_p^2 */
if (!BN_mont_mod_mul(n6, P->Z, P->Z, mont)) goto err;
if (!BN_mont_mod_mul(n3, Q->X, n6, mont)) goto err; /* L3 = x_q * z_p^2 */
if (!BN_mont_mod_mul(n0, n6, P->Z, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n4, Q->Y, n0, mont, ctx)) goto err; /* L4 = y_q * z_p^3 */
if (!BN_mont_mod_mul(n0, n6, P->Z, mont)) goto err;
if (!BN_mont_mod_mul(n4, Q->Y, n0, mont)) goto err; /* L4 = y_q * z_p^3 */
/* L5; L6 */
@ -1232,14 +1231,14 @@ int ECP_mont_add(EC_POINT *R, EC_POINT *P, EC_POINT *Q, EC *E, BN_MONTGOMERY *mo
/* Z */
if (!BN_mont_mod_mul(n0, P->Z, Q->Z, mont, ctx)) goto err;
if (!BN_mont_mod_mul(R->Z, n0, n5, mont, ctx)) goto err; /* Z = z_p * z_q * L_5 */
if (!BN_mont_mod_mul(n0, P->Z, Q->Z, mont)) goto err;
if (!BN_mont_mod_mul(R->Z, n0, n5, mont)) goto err; /* Z = z_p * z_q * L_5 */
/* X */
if (!BN_mont_mod_mul(n0, n6, n6, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n4, n5, n5, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n3, n1, n4, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n0, n6, n6, mont)) goto err;
if (!BN_mont_mod_mul(n4, n5, n5, mont)) goto err;
if (!BN_mont_mod_mul(n3, n1, n4, mont)) goto err;
if (!BN_mod_sub_quick(R->X, n0, n3, p)) goto err; /* X = L6^2 - L5^2 * L7 */
@ -1249,11 +1248,11 @@ int ECP_mont_add(EC_POINT *R, EC_POINT *P, EC_POINT *Q, EC *E, BN_MONTGOMERY *mo
/* Y */
if (!BN_mont_mod_mul(n0, n3, n6, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n6, n4, n5, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n1, n2, n6, mont, ctx)) goto err;
if (!BN_mont_mod_mul(n0, n3, n6, mont)) goto err;
if (!BN_mont_mod_mul(n6, n4, n5, mont)) goto err;
if (!BN_mont_mod_mul(n1, n2, n6, mont)) goto err;
if (!BN_mod_sub_quick(n0, n0, n1, p)) goto err;
if (!BN_mont_mod_mul(R->Y, n0, E->h, mont, ctx)) goto err; /* Y = (L6 * L9 - L8 * L5^3) / 2 */
if (!BN_mont_mod_mul(R->Y, n0, E->h, mont)) goto err; /* Y = (L6 * L9 - L8 * L5^3) / 2 */
BN_CTX_end(ctx);