wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Updates from stable branch: BN_*_no_branch privatization and elimination of

Browse source 
conditional final subtraction in Montgomery multiplication.
This commit is contained in:
Andy Polyakov 2007-06-11 16:43:29 +00:00
parent e20d6ef3d6
commit 0c86c87c60
5 changed files with 79 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
crypto/bn/bn.h
View file

@ -435,8 +435,6 @@ void BN_set_negative(BIGNUM *b, int n);
int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
BN_CTX *ctx); BN_CTX *ctx);
int BN_div_no_branch(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m,
const BIGNUM *d, BN_CTX *ctx);
#define BN_mod(rem,m,d,ctx) BN_div(NULL,(rem),(m),(d),(ctx)) #define BN_mod(rem,m,d,ctx) BN_div(NULL,(rem),(m),(d),(ctx))
int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx); int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx);
int BN_mod_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m, BN_CTX *ctx); int BN_mod_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m, BN_CTX *ctx);
@ -505,8 +503,6 @@ int BN_gcd(BIGNUM *r,const BIGNUM *a,const BIGNUM *b,BN_CTX *ctx);
int BN_kronecker(const BIGNUM *a,const BIGNUM *b,BN_CTX *ctx); /* returns -2 for error */ int BN_kronecker(const BIGNUM *a,const BIGNUM *b,BN_CTX *ctx); /* returns -2 for error */
BIGNUM *BN_mod_inverse(BIGNUM *ret, BIGNUM *BN_mod_inverse(BIGNUM *ret,
const BIGNUM *a, const BIGNUM *n,BN_CTX *ctx); const BIGNUM *a, const BIGNUM *n,BN_CTX *ctx);
BIGNUM *BN_mod_inverse_no_branch(BIGNUM *ret,
const BIGNUM *A, const BIGNUM *n,BN_CTX *ctx);
BIGNUM *BN_mod_sqrt(BIGNUM *ret, BIGNUM *BN_mod_sqrt(BIGNUM *ret,
const BIGNUM *a, const BIGNUM *n,BN_CTX *ctx); const BIGNUM *a, const BIGNUM *n,BN_CTX *ctx);

8
crypto/bn/bn_div.c
View file

@ -169,13 +169,15 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
#endif /* OPENSSL_NO_ASM */ #endif /* OPENSSL_NO_ASM */
/* BN_div computes dv := num / divisor, rounding towards zero, and sets up /* BN_div[_no_branch] computes dv := num / divisor, rounding towards
* rm such that dv*divisor + rm = num holds. * zero, and sets up rm such that dv*divisor + rm = num holds.
* Thus: * Thus:
* dv->neg == num->neg ^ divisor->neg (unless the result is zero) * dv->neg == num->neg ^ divisor->neg (unless the result is zero)
* rm->neg == num->neg (unless the remainder is zero) * rm->neg == num->neg (unless the remainder is zero)
* If 'dv' or 'rm' is NULL, the respective value is not returned. * If 'dv' or 'rm' is NULL, the respective value is not returned.
*/ */
static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
const BIGNUM *divisor, BN_CTX *ctx);
int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor, int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
BN_CTX *ctx) BN_CTX *ctx)
{ {
@ -406,7 +408,7 @@ err:
/* BN_div_no_branch is a special version of BN_div. It does not contain /* BN_div_no_branch is a special version of BN_div. It does not contain
* branches that may leak sensitive information. * branches that may leak sensitive information.
*/ */
int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
const BIGNUM *divisor, BN_CTX *ctx) const BIGNUM *divisor, BN_CTX *ctx)
{ {
int norm_shift,i,loop; int norm_shift,i,loop;

4
crypto/bn/bn_gcd.c
View file

@ -203,6 +203,8 @@ err:
/* solves ax == 1 (mod n) */ /* solves ax == 1 (mod n) */
static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx);
BIGNUM *BN_mod_inverse(BIGNUM *in, BIGNUM *BN_mod_inverse(BIGNUM *in,
const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx) const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
{ {
@ -501,7 +503,7 @@ err:
/* BN_mod_inverse_no_branch is a special version of BN_mod_inverse. /* BN_mod_inverse_no_branch is a special version of BN_mod_inverse.
* It does not contain branches that may leak sensitive information. * It does not contain branches that may leak sensitive information.
*/ */
BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in, static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx) const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
{ {
BIGNUM *A,*B,*X,*Y,*M,*D,*T,*R=NULL; BIGNUM *A,*B,*X,*Y,*M,*D,*T,*R=NULL;

84
crypto/bn/bn_mont.c
View file

@ -176,7 +176,6 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
max=(nl+al+1); /* allow for overflow (no?) XXX */ max=(nl+al+1); /* allow for overflow (no?) XXX */
if (bn_wexpand(r,max) == NULL) goto err; if (bn_wexpand(r,max) == NULL) goto err;
if (bn_wexpand(ret,max) == NULL) goto err;
r->neg=a->neg^n->neg; r->neg=a->neg^n->neg;
np=n->d; np=n->d;
@ -228,19 +227,76 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
} }
bn_correct_top(r); bn_correct_top(r);
/* mont->ri will be a multiple of the word size */ /* mont->ri will be a multiple of the word size and below code
#if 0 * is kind of BN_rshift(ret,r,mont->ri) equivalent */
BN_rshift(ret,r,mont->ri); if (r->top <= ri)
#else {
ret->neg = r->neg; ret->top=0;
x=ri; retn=1;
goto err;
}
al=r->top-ri;
# define BRANCH_FREE 1
# if BRANCH_FREE
if (bn_wexpand(ret,ri) == NULL) goto err;
x=0-(((al-ri)>>(sizeof(al)*8-1))&1);
ret->top=x=(ri&~x)|(al&x); /* min(ri,al) */
ret->neg=r->neg;
rp=ret->d; rp=ret->d;
ap= &(r->d[x]); ap=&(r->d[ri]);
if (r->top < x) nrp=ap;
al=0;
else /* This 'if' denotes violation of 2*M<r^(n-1) boundary condition
al=r->top-x; * formulated by C.D.Walter in "Montgomery exponentiation needs
* no final subtractions." Incurred branch can disclose only
* information about modulus length, which is not really secret. */
if ((mont->N.d[ri-1]>>(BN_BITS2-2))!=0)
{
size_t m1,m2;
v=bn_sub_words(rp,ap,mont->N.d,ri);
/* this -----------------------^^ works even in al<ri case
* thanks to zealous zeroing of top of the vector in the
* beginning. */
/* if (al==ri && !v) || al>ri) nrp=rp; else nrp=ap; */
/* in other words if subtraction result is real, then
* trick unconditional memcpy below to perform in-place
* "refresh" instead of actual copy. */
m1=0-(size_t)(((al-ri)>>(sizeof(al)*8-1))&1); /* al<ri */
m2=0-(size_t)(((ri-al)>>(sizeof(al)*8-1))&1); /* al>ri */
m1|=m2; /* (al!=ri) */
m1|=(0-(size_t)v); /* (al!=ri || v) */
m1&=~m2; /* (al!=ri || v) && !al>ri */
nrp=(BN_ULONG *)(((size_t)rp&~m1)|((size_t)ap&m1));
}
/* 'i<ri' is chosen to eliminate dependency on input data, even
* though it results in redundant copy in al<ri case. */
for (i=0,ri-=4; i<ri; i+=4)
{
BN_ULONG t1,t2,t3,t4;
t1=nrp[i+0];
t2=nrp[i+1];
t3=nrp[i+2]; ap[i+0]=0;
t4=nrp[i+3]; ap[i+1]=0;
rp[i+0]=t1; ap[i+2]=0;
rp[i+1]=t2; ap[i+3]=0;
rp[i+2]=t3;
rp[i+3]=t4;
}
for (ri+=4; i<ri; i++)
rp[i]=nrp[i], ap[i]=0;
# else
if (bn_wexpand(ret,al) == NULL) goto err;
ret->top=al; ret->top=al;
ret->neg=r->neg;
rp=ret->d;
ap=&(r->d[ri]);
al-=4; al-=4;
for (i=0; i<al; i+=4) for (i=0; i<al; i+=4)
{ {
@ -258,7 +314,7 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
al+=4; al+=4;
for (; i<al; i++) for (; i<al; i++)
rp[i]=ap[i]; rp[i]=ap[i];
#endif # endif
#else /* !MONT_WORD */ #else /* !MONT_WORD */
BIGNUM *t1,*t2; BIGNUM *t1,*t2;
@ -278,10 +334,12 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
if (!BN_rshift(ret,t2,mont->ri)) goto err; if (!BN_rshift(ret,t2,mont->ri)) goto err;
#endif /* MONT_WORD */ #endif /* MONT_WORD */
#if !defined(BRANCH_FREE) || BRANCH_FREE==0
if (BN_ucmp(ret, &(mont->N)) >= 0) if (BN_ucmp(ret, &(mont->N)) >= 0)
{ {
if (!BN_usub(ret,ret,&(mont->N))) goto err; if (!BN_usub(ret,ret,&(mont->N))) goto err;
} }
#endif
retn=1; retn=1;
bn_check_top(ret); bn_check_top(ret);
err: err:

2
util/libeay.num
View file

@ -3511,8 +3511,6 @@ BIO_get_callback_arg 3902 EXIST::FUNCTION:
BIO_set_callback 3903 EXIST::FUNCTION: BIO_set_callback 3903 EXIST::FUNCTION:
d2i_ASIdOrRange 3904 EXIST::FUNCTION:RFC3779 d2i_ASIdOrRange 3904 EXIST::FUNCTION:RFC3779
i2d_ASIdentifiers 3905 EXIST::FUNCTION:RFC3779 i2d_ASIdentifiers 3905 EXIST::FUNCTION:RFC3779
BN_div_no_branch 3906 EXIST::FUNCTION:
BN_mod_inverse_no_branch 3907 EXIST::FUNCTION:
SEED_decrypt 3908 EXIST::FUNCTION:SEED SEED_decrypt 3908 EXIST::FUNCTION:SEED
SEED_encrypt 3909 EXIST::FUNCTION:SEED SEED_encrypt 3909 EXIST::FUNCTION:SEED
SEED_cbc_encrypt 3910 EXIST::FUNCTION:SEED SEED_cbc_encrypt 3910 EXIST::FUNCTION:SEED