9d91530d2d
This commit leverages the Montgomery ladder scaffold introduced in #6690 (alongside a specialized Lopez-Dahab ladder for binary curves) to provide a specialized differential addition-and-double implementation to speedup prime curves, while keeping all the features of `ec_scalar_mul_ladder` against SCA attacks. The arithmetic in ladder_pre, ladder_step and ladder_post is auto generated with tooling, from the following formulae: - `ladder_pre`: Formula 3 for doubling from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", as described at https://hyperelliptic.org/EFD/g1p/auto-shortw-xz.html#doubling-dbl-2002-it-2 - `ladder_step`: differential addition-and-doubling Eq. (8) and (10) from Izu-Takagi "A fast parallel elliptic curve multiplication resistant against side channel attacks", as described at https://hyperelliptic.org/EFD/g1p/auto-shortw-xz.html#ladder-ladd-2002-it-3 - `ladder_post`: y-coordinate recovery using Eq. (8) from Brier-Joye "Weierstrass Elliptic Curves and Side-Channel Attacks", modified to work in projective coordinates. Co-authored-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6772) |
||
---|---|---|
.. | ||
asm | ||
curve448 | ||
build.info | ||
curve25519.c | ||
ec2_oct.c | ||
ec2_smpl.c | ||
ec_ameth.c | ||
ec_asn1.c | ||
ec_check.c | ||
ec_curve.c | ||
ec_cvt.c | ||
ec_err.c | ||
ec_key.c | ||
ec_kmeth.c | ||
ec_lcl.h | ||
ec_lib.c | ||
ec_mult.c | ||
ec_oct.c | ||
ec_pmeth.c | ||
ec_print.c | ||
ecdh_kdf.c | ||
ecdh_ossl.c | ||
ecdsa_ossl.c | ||
ecdsa_sign.c | ||
ecdsa_vrf.c | ||
eck_prn.c | ||
ecp_mont.c | ||
ecp_nist.c | ||
ecp_nistp224.c | ||
ecp_nistp256.c | ||
ecp_nistp521.c | ||
ecp_nistputil.c | ||
ecp_nistz256.c | ||
ecp_nistz256_table.c | ||
ecp_oct.c | ||
ecp_smpl.c | ||
ecx_meth.c |