wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ec/ecp_nistz256.c: further harmonization with latest rules.

Browse source 
Reviewed-by: Tim Hudson <tjh@openssl.org>
This commit is contained in:
Andy Polyakov 2015-01-21 17:28:45 +01:00 committed by Matt Caswell
parent 4664862013
commit 20728adc8f
1 changed files with 74 additions and 48 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

122
crypto/ec/ecp_nistz256.c
View file

@ -71,9 +71,11 @@ typedef P256_POINT_AFFINE PRECOMP256_ROW[64];
typedef struct ec_pre_comp_st {
const EC_GROUP *group; /* Parent EC_GROUP object */
size_t w; /* Window size */
/* Constant time access to the X and Y coordinates of the pre-computed,
/*
* Constant time access to the X and Y coordinates of the pre-computed,
* generator multiplies, in the Montgomery domain. Pre-calculated
* multiplies are stored in affine form. */
* multiplies are stored in affine form.
*/
PRECOMP256_ROW *precomp;
void *precomp_storage;
int references;
@ -89,15 +91,15 @@ void ecp_nistz256_div_by_2(BN_ULONG res[P256_LIMBS],
/* Modular mul by 3: res = 3*a mod P */
void ecp_nistz256_mul_by_3(BN_ULONG res[P256_LIMBS],
const BN_ULONG a[P256_LIMBS]);
/* Modular add: res = a+b mod P */
/* Modular add: res = a+b mod P */
void ecp_nistz256_add(BN_ULONG res[P256_LIMBS],
const BN_ULONG a[P256_LIMBS],
const BN_ULONG b[P256_LIMBS]);
/* Modular sub: res = a-b mod P */
/* Modular sub: res = a-b mod P */
void ecp_nistz256_sub(BN_ULONG res[P256_LIMBS],
const BN_ULONG a[P256_LIMBS],
const BN_ULONG b[P256_LIMBS]);
/* Modular neg: res = -a mod P */
/* Modular neg: res = -a mod P */
void ecp_nistz256_neg(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS]);
/* Montgomery mul: res = a*b*2^-256 mod P */
void ecp_nistz256_mul_mont(BN_ULONG res[P256_LIMBS],
@ -114,11 +116,11 @@ void ecp_nistz256_to_mont(BN_ULONG res[P256_LIMBS],
const BN_ULONG in[P256_LIMBS]);
/* Functions that perform constant time access to the precomputed tables */
void ecp_nistz256_scatter_w5(P256_POINT *val,
const P256_POINT *in_t, int index);
void ecp_nistz256_gather_w5(P256_POINT * val,
const P256_POINT *in_t, int index);
void ecp_nistz256_gather_w5(P256_POINT *val,
const P256_POINT *in_t, int index);
void ecp_nistz256_scatter_w7(P256_POINT_AFFINE *val,
const P256_POINT_AFFINE *in_t, int index);
const P256_POINT_AFFINE *in_t, int index);
void ecp_nistz256_gather_w7(P256_POINT_AFFINE *val,
const P256_POINT_AFFINE *in_t, int index);
@ -279,8 +281,8 @@ static void ecp_nistz256_point_double(P256_POINT *r, const P256_POINT *a)
}
/* Point addition: r = a+b */
static void ecp_nistz256_point_add(P256_POINT * r,
const P256_POINT * a, const P256_POINT * b)
static void ecp_nistz256_point_add(P256_POINT *r,
const P256_POINT *a, const P256_POINT *b)
{
BN_ULONG U2[P256_LIMBS], S2[P256_LIMBS];
BN_ULONG U1[P256_LIMBS], S1[P256_LIMBS];
@ -336,8 +338,9 @@ static void ecp_nistz256_point_add(P256_POINT * r,
ecp_nistz256_mul_mont(U2, in2_x, Z1sqr); /* U2 = X2*Z1^2 */
ecp_nistz256_sub(H, U2, U1); /* H = U2 - U1 */
/* This should not happen during sign/ecdh,
* so no constant time violation */
/*
* This should not happen during sign/ecdh, so no constant time violation
*/
if (is_equal(U1, U2) && !in1infty && !in2infty) {
if (is_equal(S1, S2)) {
ecp_nistz256_point_double(r, a);
@ -404,8 +407,10 @@ static void ecp_nistz256_point_add_affine(P256_POINT *r,
const BN_ULONG *in2_x = b->X;
const BN_ULONG *in2_y = b->Y;
/* In affine representation we encode infty as (0,0),
* which is not on the curve, so it is OK */
/*
* In affine representation we encode infty as (0,0), which is not on the
* curve, so it is OK
*/
in1infty = (in1_x[0] | in1_x[1] | in1_x[2] | in1_x[3] |
in1_y[0] | in1_y[1] | in1_y[2] | in1_y[3]);
if (P256_LIMBS == 8)
@ -467,8 +472,10 @@ static void ecp_nistz256_point_add_affine(P256_POINT *r,
static void ecp_nistz256_mod_inverse(BN_ULONG r[P256_LIMBS],
const BN_ULONG in[P256_LIMBS])
{
/* The poly is ffffffff 00000001 00000000 00000000 00000000 ffffffff ffffffff ffffffff
We use FLT and used poly-2 as exponent */
/*
* The poly is ffffffff 00000001 00000000 00000000 00000000 ffffffff
* ffffffff ffffffff We use FLT and used poly-2 as exponent
*/
BN_ULONG p2[P256_LIMBS];
BN_ULONG p4[P256_LIMBS];
BN_ULONG p8[P256_LIMBS];
@ -538,10 +545,12 @@ static void ecp_nistz256_mod_inverse(BN_ULONG r[P256_LIMBS],
memcpy(r, res, sizeof(res));
}
/* ecp_nistz256_bignum_to_field_elem copies the contents of |in| to |out| and
* returns one if it fits. Otherwise it returns zero. */
/*
* ecp_nistz256_bignum_to_field_elem copies the contents of |in| to |out| and
* returns one if it fits. Otherwise it returns zero.
*/
static int ecp_nistz256_bignum_to_field_elem(BN_ULONG out[P256_LIMBS],
const BIGNUM * in)
const BIGNUM *in)
{
return bn_copy_words(out, in, P256_LIMBS);
}
@ -559,9 +568,9 @@ static void ecp_nistz256_windowed_mul(const EC_GROUP *group,
const unsigned int window_size = 5;
const unsigned int mask = (1 << (window_size + 1)) - 1;
unsigned int wvalue;
P256_POINT *temp; /* place for 5 temporary points */
P256_POINT *temp; /* place for 5 temporary points */
const BIGNUM **scalars = NULL;
P256_POINT(*table)[16] = NULL;
P256_POINT (*table)[16] = NULL;
void *table_storage = NULL;
if ((table_storage =
@ -574,7 +583,7 @@ static void ecp_nistz256_windowed_mul(const EC_GROUP *group,
}
table = (void *)ALIGNPTR(table_storage, 64);
temp = (P256_POINT *)(table + num);
temp = (P256_POINT *)(table + num);
for (i = 0; i < num; i++) {
P256_POINT *row = table[i];
@ -618,9 +627,10 @@ static void ecp_nistz256_windowed_mul(const EC_GROUP *group,
goto err;
}
/* row[0] is implicitly (0,0,0) (the point at infinity),
* therefore it is not stored. All other values are actually
* stored with an offset of -1 in table.
/*
* row[0] is implicitly (0,0,0) (the point at infinity), therefore it
* is not stored. All other values are actually stored with an offset
* of -1 in table.
*/
ecp_nistz256_scatter_w5 (row, &temp[0], 1);
@ -729,8 +739,10 @@ const static BN_ULONG def_yG[P256_LIMBS] = {
TOBN(0xd2e88688, 0xdd21f325), TOBN(0x8571ff18, 0x25885d85)
};
/* ecp_nistz256_is_affine_G returns one if |generator| is the standard,
* P-256 generator. */
/*
* ecp_nistz256_is_affine_G returns one if |generator| is the standard, P-256
* generator.
*/
static int ecp_nistz256_is_affine_G(const EC_POINT *generator)
{
return (bn_get_top(generator->X) == P256_LIMBS) &&
@ -743,10 +755,12 @@ static int ecp_nistz256_is_affine_G(const EC_POINT *generator)
static int ecp_nistz256_mult_precompute(EC_GROUP *group, BN_CTX *ctx)
{
/* We precompute a table for a Booth encoded exponent (wNAF) based
/*
* We precompute a table for a Booth encoded exponent (wNAF) based
* computation. Each table holds 64 values for safe access, with an
* implicit value of infinity at index zero. We use window of size 7,
* and therefore require ceil(256/7) = 37 tables. */
* implicit value of infinity at index zero. We use window of size 7, and
* therefore require ceil(256/7) = 37 tables.
*/
BIGNUM *order;
EC_POINT *P = NULL, *T = NULL;
const EC_POINT *generator;
@ -769,8 +783,10 @@ static int ecp_nistz256_mult_precompute(EC_GROUP *group, BN_CTX *ctx)
}
if (ecp_nistz256_is_affine_G(generator)) {
/* No need to calculate tables for the standard generator
* because we have them statically. */
/*
* No need to calculate tables for the standard generator because we
* have them statically.
*/
return 1;
}
@ -810,17 +826,20 @@ static int ecp_nistz256_mult_precompute(EC_GROUP *group, BN_CTX *ctx)
P = EC_POINT_new(group);
T = EC_POINT_new(group);
/* The zero entry is implicitly infinity, and we skip it,
* storing other values with -1 offset. */
/*
* The zero entry is implicitly infinity, and we skip it, storing other
* values with -1 offset.
*/
EC_POINT_copy(T, generator);
for (k = 0; k < 64; k++) {
EC_POINT_copy(P, T);
for (j = 0; j < 37; j++) {
P256_POINT_AFFINE temp;
/* It would be faster to use
* ec_GFp_simple_points_make_affine and make multiple
* points affine at the same time. */
/*
* It would be faster to use ec_GFp_simple_points_make_affine and
* make multiple points affine at the same time.
*/
ec_GFp_simple_make_affine(group, P, ctx);
ecp_nistz256_bignum_to_field_elem(temp.X, P->X);
ecp_nistz256_bignum_to_field_elem(temp.Y, P->Y);
@ -907,9 +926,11 @@ static void booth_recode_w7(unsigned char *sign,
*digit = d;
}
/* ecp_nistz256_avx2_mul_g performs multiplication by G, using only the
/*
* ecp_nistz256_avx2_mul_g performs multiplication by G, using only the
* precomputed table. It does 4 affine point additions in parallel,
* significantly speeding up point multiplication for a fixed value. */
* significantly speeding up point multiplication for a fixed value.
*/
static void ecp_nistz256_avx2_mul_g(P256_POINT *r,
unsigned char p_str[33],
const P256_POINT_AFFINE(*preComputedTable)[64])
@ -1159,9 +1180,10 @@ static int ecp_nistz256_points_mul(const EC_GROUP *group,
ecp_nistz256_pre_comp_clear_free);
if (pre_comp) {
/* If there is a precomputed table for the generator,
* check that it was generated with the same
* generator. */
/*
* If there is a precomputed table for the generator, check that
* it was generated with the same generator.
*/
EC_POINT *pre_comp_generator = EC_POINT_new(group);
if (pre_comp_generator == NULL)
goto err;
@ -1178,10 +1200,12 @@ static int ecp_nistz256_points_mul(const EC_GROUP *group,
}
if (preComputedTable == NULL && ecp_nistz256_is_affine_G(generator)) {
/* If there is no precomputed data, but the generator
* is the default, a hardcoded table of precomputed
* data is used. This is because applications, such as
* Apache, do not use EC_KEY_precompute_mult. */
/*
* If there is no precomputed data, but the generator is the
* default, a hardcoded table of precomputed data is used. This
* is because applications, such as Apache, do not use
* EC_KEY_precompute_mult.
*/
preComputedTable = ecp_nistz256_precomputed;
}
@ -1262,8 +1286,10 @@ static int ecp_nistz256_points_mul(const EC_GROUP *group,
p_is_infinity = 1;
if (no_precomp_for_generator) {
/* Without a precomputed table for the generator, it has to be
* handled like a normal point. */
/*
* Without a precomputed table for the generator, it has to be
* handled like a normal point.
*/
const BIGNUM **new_scalars;
const EC_POINT **new_points;