kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add 64-bit, P-256 implementation.

Browse Source 
This is taken from upstream, although it originally came from us. This
will only take effect on 64-bit systems (x86-64 and aarch64).

Before:

Did 1496 ECDH P-256 operations in 1038743us (1440.2 ops/sec)
Did 2783 ECDSA P-256 signing operations in 1081006us (2574.5 ops/sec)
Did 2400 ECDSA P-256 verify operations in 1059508us (2265.2 ops/sec)

After:

Did 4147 ECDH P-256 operations in 1061723us (3905.9 ops/sec)
Did 9372 ECDSA P-256 signing operations in 1040589us (9006.4 ops/sec)
Did 4114 ECDSA P-256 verify operations in 1063478us (3868.4 ops/sec)

Change-Id: I11fabb03239cc3a7c4a97325ed4e4c97421f91a9
This commit is contained in:
Adam Langley 2015-04-14 12:07:44 -07:00
parent 042bcdd9bd
commit ad6b28e974
9 changed files with 2287 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
crypto/ec/CMakeLists.txt
View File

@ -6,12 +6,14 @@ add_library(
OBJECT
ec.c
oct.c
simple.c
ec_montgomery.c
wnaf.c
ec_key.c
ec_asn1.c
ec_key.c
ec_montgomery.c
oct.c
p256-64.c
util-64.c
simple.c
wnaf.c
)
add_executable(

17
crypto/ec/ec.c
View File

@ -219,11 +219,18 @@ static const struct curve_data P521 = {
0xB7, 0x1E, 0x91, 0x38, 0x64, 0x09}};
const struct built_in_curve OPENSSL_built_in_curves[] = {
{NID_secp224r1, &P224, 0},
{NID_X9_62_prime256v1, &P256, 0},
{NID_secp384r1, &P384, 0},
{NID_secp521r1, &P521, 0},
{NID_undef, 0, 0},
{NID_secp224r1, &P224, 0},
{
NID_X9_62_prime256v1, &P256,
#if defined(OPENSSL_64_BIT) && !defined(OPENSSL_WINDOWS)
EC_GFp_nistp256_method,
#else
0,
#endif
},
{NID_secp384r1, &P384, 0},
{NID_secp521r1, &P521, 0},
{NID_undef, 0, 0},
};
EC_GROUP *ec_group_new(const EC_METHOD *meth) {

13
crypto/ec/internal.h
View File

@ -309,6 +309,19 @@ int ec_point_set_Jprojective_coordinates_GFp(const EC_GROUP *group,
const BIGNUM *y, const BIGNUM *z,
BN_CTX *ctx);
void ec_GFp_nistp_points_make_affine_internal(
size_t num, void *point_array, size_t felem_size, void *tmp_felems,
void (*felem_one)(void *out), int (*felem_is_zero)(const void *in),
void (*felem_assign)(void *out, const void *in),
void (*felem_square)(void *out, const void *in),
void (*felem_mul)(void *out, const void *in1, const void *in2),
void (*felem_inv)(void *out, const void *in),
void (*felem_contract)(void *out, const void *in));
void ec_GFp_nistp_recode_scalar_bits(uint8_t *sign, uint8_t *digit, uint8_t in);
const EC_METHOD *EC_GFp_nistp256_method(void);
struct ec_key_st {
int version;

1948
crypto/ec/p256-64.c Normal file
View File

File diff suppressed because it is too large Load Diff

183
crypto/ec/util-64.c Normal file
View File

@ -0,0 +1,183 @@
/* Copyright (c) 2015, Google Inc.
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
#include <openssl/base.h>
#if defined(OPENSSL_64_BIT) && !defined(OPENSSL_WINDOWS)
#include <openssl/ec.h>
#include "internal.h"
/* Convert an array of points into affine coordinates. (If the point at
* infinity is found (Z = 0), it remains unchanged.) This function is
* essentially an equivalent to EC_POINTs_make_affine(), but works with the
* internal representation of points as used by ecp_nistp###.c rather than
* with (BIGNUM-based) EC_POINT data structures. point_array is the
* input/output buffer ('num' points in projective form, i.e. three
* coordinates each), based on an internal representation of field elements
* of size 'felem_size'. tmp_felems needs to point to a temporary array of
* 'num'+1 field elements for storage of intermediate values. */
void ec_GFp_nistp_points_make_affine_internal(
size_t num, void *point_array, size_t felem_size, void *tmp_felems,
void (*felem_one)(void *out), int (*felem_is_zero)(const void *in),
void (*felem_assign)(void *out, const void *in),
void (*felem_square)(void *out, const void *in),
void (*felem_mul)(void *out, const void *in1, const void *in2),
void (*felem_inv)(void *out, const void *in),
void (*felem_contract)(void *out, const void *in)) {
int i = 0;
#define tmp_felem(I) (&((char *)tmp_felems)[(I)*felem_size])
#define X(I) (&((char *)point_array)[3 * (I)*felem_size])
#define Y(I) (&((char *)point_array)[(3 * (I) + 1) * felem_size])
#define Z(I) (&((char *)point_array)[(3 * (I) + 2) * felem_size])
if (!felem_is_zero(Z(0))) {
felem_assign(tmp_felem(0), Z(0));
} else {
felem_one(tmp_felem(0));
}
for (i = 1; i < (int)num; i++) {
if (!felem_is_zero(Z(i))) {
felem_mul(tmp_felem(i), tmp_felem(i - 1), Z(i));
} else {
felem_assign(tmp_felem(i), tmp_felem(i - 1));
}
}
/* Now each tmp_felem(i) is the product of Z(0) .. Z(i), skipping any
* zero-valued factors: if Z(i) = 0, we essentially pretend that Z(i) = 1. */
felem_inv(tmp_felem(num - 1), tmp_felem(num - 1));
for (i = num - 1; i >= 0; i--) {
if (i > 0) {
/* tmp_felem(i-1) is the product of Z(0) .. Z(i-1), tmp_felem(i)
* is the inverse of the product of Z(0) .. Z(i). */
/* 1/Z(i) */
felem_mul(tmp_felem(num), tmp_felem(i - 1), tmp_felem(i));
} else {
felem_assign(tmp_felem(num), tmp_felem(0)); /* 1/Z(0) */
}
if (!felem_is_zero(Z(i))) {
if (i > 0) {
/* For next iteration, replace tmp_felem(i-1) by its inverse. */
felem_mul(tmp_felem(i - 1), tmp_felem(i), Z(i));
}
/* Convert point (X, Y, Z) into affine form (X/(Z^2), Y/(Z^3), 1). */
felem_square(Z(i), tmp_felem(num)); /* 1/(Z^2) */
felem_mul(X(i), X(i), Z(i)); /* X/(Z^2) */
felem_mul(Z(i), Z(i), tmp_felem(num)); /* 1/(Z^3) */
felem_mul(Y(i), Y(i), Z(i)); /* Y/(Z^3) */
felem_contract(X(i), X(i));
felem_contract(Y(i), Y(i));
felem_one(Z(i));
} else {
if (i > 0) {
/* For next iteration, replace tmp_felem(i-1) by its inverse. */
felem_assign(tmp_felem(i - 1), tmp_felem(i));
}
}
}
}
/* This function looks at 5+1 scalar bits (5 current, 1 adjacent less
* significant bit), and recodes them into a signed digit for use in fast point
* multiplication: the use of signed rather than unsigned digits means that
* fewer points need to be precomputed, given that point inversion is easy (a
* precomputed point dP makes -dP available as well).
*
* BACKGROUND:
*
* Signed digits for multiplication were introduced by Booth ("A signed binary
* multiplication technique", Quart. Journ. Mech. and Applied Math., vol. IV,
* pt. 2 (1951), pp. 236-240), in that case for multiplication of integers.
* Booth's original encoding did not generally improve the density of nonzero
* digits over the binary representation, and was merely meant to simplify the
* handling of signed factors given in two's complement; but it has since been
* shown to be the basis of various signed-digit representations that do have
* further advantages, including the wNAF, using the following general
* approach:
*
* (1) Given a binary representation
*
* b_k ... b_2 b_1 b_0,
*
* of a nonnegative integer (b_k in {0, 1}), rewrite it in digits 0, 1, -1
* by using bit-wise subtraction as follows:
*
* b_k b_(k-1) ... b_2 b_1 b_0
* - b_k ... b_3 b_2 b_1 b_0
* -------------------------------------
* s_k b_(k-1) ... s_3 s_2 s_1 s_0
*
* A left-shift followed by subtraction of the original value yields a new
* representation of the same value, using signed bits s_i = b_(i+1) - b_i.
* This representation from Booth's paper has since appeared in the
* literature under a variety of different names including "reversed binary
* form", "alternating greedy expansion", "mutual opposite form", and
* "sign-alternating {+-1}-representation".
*
* An interesting property is that among the nonzero bits, values 1 and -1
* strictly alternate.
*
* (2) Various window schemes can be applied to the Booth representation of
* integers: for example, right-to-left sliding windows yield the wNAF
* (a signed-digit encoding independently discovered by various researchers
* in the 1990s), and left-to-right sliding windows yield a left-to-right
* equivalent of the wNAF (independently discovered by various researchers
* around 2004).
*
* To prevent leaking information through side channels in point multiplication,
* we need to recode the given integer into a regular pattern: sliding windows
* as in wNAFs won't do, we need their fixed-window equivalent -- which is a few
* decades older: we'll be using the so-called "modified Booth encoding" due to
* MacSorley ("High-speed arithmetic in binary computers", Proc. IRE, vol. 49
* (1961), pp. 67-91), in a radix-2^5 setting. That is, we always combine five
* signed bits into a signed digit:
*
* s_(4j + 4) s_(4j + 3) s_(4j + 2) s_(4j + 1) s_(4j)
*
* The sign-alternating property implies that the resulting digit values are
* integers from -16 to 16.
*
* Of course, we don't actually need to compute the signed digits s_i as an
* intermediate step (that's just a nice way to see how this scheme relates
* to the wNAF): a direct computation obtains the recoded digit from the
* six bits b_(4j + 4) ... b_(4j - 1).
*
* This function takes those five bits as an integer (0 .. 63), writing the
* recoded digit to *sign (0 for positive, 1 for negative) and *digit (absolute
* value, in the range 0 .. 8). Note that this integer essentially provides the
* input bits "shifted to the left" by one position: for example, the input to
* compute the least significant recoded digit, given that there's no bit b_-1,
* has to be b_4 b_3 b_2 b_1 b_0 0. */
void ec_GFp_nistp_recode_scalar_bits(uint8_t *sign, uint8_t *digit,
uint8_t in) {
uint8_t s, d;
s = ~((in >> 5) - 1); /* sets all bits to MSB(in), 'in' seen as
* 6-bit value */
d = (1 << 6) - in - 1;
d = (d & s) | (in & ~s);
d = (d >> 1) + (d & 1);
*sign = s & 1;
*digit = d;
}
#endif /* 64_BIT && !WINDOWS */

8
crypto/err/ec.errordata
View File

@ -1,3 +1,4 @@
EC,function,159,BN_to_felem
EC,function,100,EC_GROUP_copy
EC,function,101,EC_GROUP_get_curve_GFp
EC,function,102,EC_GROUP_get_degree
@ -34,6 +35,9 @@ EC,function,132,ec_GFp_mont_field_mul
EC,function,133,ec_GFp_mont_field_set_to_one
EC,function,134,ec_GFp_mont_field_sqr
EC,function,135,ec_GFp_mont_group_set_curve
EC,function,160,ec_GFp_nistp256_group_set_curve
EC,function,161,ec_GFp_nistp256_point_get_affine_coordinates
EC,function,162,ec_GFp_nistp256_points_mul
EC,function,136,ec_GFp_simple_group_check_discriminant
EC,function,137,ec_GFp_simple_group_set_curve
EC,function,138,ec_GFp_simple_make_affine
@ -45,6 +49,7 @@ EC,function,143,ec_GFp_simple_points_make_affine
EC,function,144,ec_GFp_simple_set_compressed_coordinates
EC,function,145,ec_asn1_group2pkparameters
EC,function,146,ec_asn1_pkparameters2group
EC,function,163,ec_group_copy
EC,function,147,ec_group_new
EC,function,148,ec_group_new_curve_GFp
EC,function,149,ec_group_new_from_data
@ -56,7 +61,9 @@ EC,function,154,i2d_ECPKParameters
EC,function,155,i2d_ECParameters
EC,function,156,i2d_ECPrivateKey
EC,function,157,i2o_ECPublicKey
EC,function,164,nistp256_pre_comp_new
EC,function,158,o2i_ECPublicKey
EC,reason,126,BIGNUM_OUT_OF_RANGE
EC,reason,100,BUFFER_TOO_SMALL
EC,reason,101,COORDINATES_OUT_OF_RANGE
EC,reason,102,D2I_ECPKPARAMETERS_FAILURE
@ -82,4 +89,5 @@ EC,reason,121,SLOT_FULL
EC,reason,122,UNDEFINED_GENERATOR
EC,reason,123,UNKNOWN_GROUP
EC,reason,124,UNKNOWN_ORDER
EC,reason,127,WRONG_CURVE_PARAMETERS
EC,reason,125,WRONG_ORDER

1
crypto/test/scoped_types.h
View File

@ -80,6 +80,7 @@ using ScopedDH = ScopedOpenSSLType<DH, DH_free>;
using ScopedECDSA_SIG = ScopedOpenSSLType<ECDSA_SIG, ECDSA_SIG_free>;
using ScopedEC_GROUP = ScopedOpenSSLType<EC_GROUP, EC_GROUP_free>;
using ScopedEC_KEY = ScopedOpenSSLType<EC_KEY, EC_KEY_free>;
using ScopedEC_POINT = ScopedOpenSSLType<EC_POINT, EC_POINT_free>;
using ScopedEVP_PKEY = ScopedOpenSSLType<EVP_PKEY, EVP_PKEY_free>;
using ScopedPKCS8_PRIV_KEY_INFO = ScopedOpenSSLType<PKCS8_PRIV_KEY_INFO,
PKCS8_PRIV_KEY_INFO_free>;

8
include/openssl/ec.h
View File

@ -369,6 +369,12 @@ OPENSSL_EXPORT int EC_METHOD_get_field_type(const EC_METHOD *meth);
#define EC_F_i2d_ECPrivateKey 156
#define EC_F_i2o_ECPublicKey 157
#define EC_F_o2i_ECPublicKey 158
#define EC_F_BN_to_felem 159
#define EC_F_ec_GFp_nistp256_group_set_curve 160
#define EC_F_ec_GFp_nistp256_point_get_affine_coordinates 161
#define EC_F_ec_GFp_nistp256_points_mul 162
#define EC_F_ec_group_copy 163
#define EC_F_nistp256_pre_comp_new 164
#define EC_R_BUFFER_TOO_SMALL 100
#define EC_R_COORDINATES_OUT_OF_RANGE 101
#define EC_R_D2I_ECPKPARAMETERS_FAILURE 102
@ -395,5 +401,7 @@ OPENSSL_EXPORT int EC_METHOD_get_field_type(const EC_METHOD *meth);
#define EC_R_UNKNOWN_GROUP 123
#define EC_R_UNKNOWN_ORDER 124
#define EC_R_WRONG_ORDER 125
#define EC_R_BIGNUM_OUT_OF_RANGE 126
#define EC_R_WRONG_CURVE_PARAMETERS 127
#endif /* OPENSSL_HEADER_EC_H */

116
tool/speed.cc
View File

@ -20,13 +20,6 @@
#include <stdint.h>
#include <string.h>
#include <openssl/aead.h>
#include <openssl/digest.h>
#include <openssl/err.h>
#include <openssl/obj.h>
#include <openssl/rand.h>
#include <openssl/rsa.h>
#if defined(OPENSSL_WINDOWS)
#pragma warning(push, 3)
#include <windows.h>
@ -35,6 +28,15 @@
#include <sys/time.h>
#endif
#include <openssl/aead.h>
#include <openssl/digest.h>
#include <openssl/err.h>
#include <openssl/obj.h>
#include <openssl/rand.h>
#include <openssl/rsa.h>
#include "../crypto/test/scoped_types.h"
extern "C" {
// These values are DER encoded, RSA private keys.
@ -93,7 +95,7 @@ static uint64_t time_now() {
static bool TimeFunction(TimeResults *results, std::function<bool()> func) {
// kTotalMS is the total amount of time that we'll aim to measure a function
// for.
static const uint64_t kTotalUS = 3000000;
static const uint64_t kTotalUS = 1000000;
uint64_t start = time_now(), now, delta;
unsigned done = 0, iterations_between_time_checks;
@ -308,6 +310,100 @@ static bool SpeedRandom(const std::string &selected) {
SpeedRandomChunk("RNG (8192 bytes)", 8192);
}
static bool SpeedECDHCurve(const std::string &name, int nid,
const std::string &selected) {
if (!selected.empty() && name.find(selected) == std::string::npos) {
return true;
}
TimeResults results;
if (!TimeFunction(&results, [nid]() -> bool {
ScopedEC_KEY key(EC_KEY_new_by_curve_name(nid));
if (!key ||
!EC_KEY_generate_key(key.get())) {
return false;
}
const EC_GROUP *const group = EC_KEY_get0_group(key.get());
ScopedEC_POINT point(EC_POINT_new(group));
ScopedBN_CTX ctx(BN_CTX_new());
ScopedBIGNUM x(BN_new());
ScopedBIGNUM y(BN_new());
if (!point || !ctx || !x || !y ||
!EC_POINT_mul(group, point.get(), NULL,
EC_KEY_get0_public_key(key.get()),
EC_KEY_get0_private_key(key.get()), ctx.get()) ||
!EC_POINT_get_affine_coordinates_GFp(group, point.get(), x.get(),
y.get(), ctx.get())) {
return false;
}
return true;
})) {
return false;
}
results.Print(name);
return true;
}
static bool SpeedECDSACurve(const std::string &name, int nid,
const std::string &selected) {
if (!selected.empty() && name.find(selected) == std::string::npos) {
return true;
}
ScopedEC_KEY key(EC_KEY_new_by_curve_name(nid));
if (!key ||
!EC_KEY_generate_key(key.get())) {
return false;
}
uint8_t signature[256];
if (ECDSA_size(key.get()) > sizeof(signature)) {
return false;
}
uint8_t digest[20];
memset(digest, 42, sizeof(digest));
unsigned sig_len;
TimeResults results;
if (!TimeFunction(&results, [&key, &signature, &digest, &sig_len]() -> bool {
return ECDSA_sign(0, digest, sizeof(digest), signature, &sig_len,
key.get()) == 1;
})) {
return false;
}
results.Print(name + " signing");
if (!TimeFunction(&results, [&key, &signature, &digest, sig_len]() -> bool {
return ECDSA_verify(0, digest, sizeof(digest), signature, sig_len,
key.get()) == 1;
})) {
return false;
}
results.Print(name + " verify");
return true;
}
static bool SpeedECDH(const std::string &selected) {
return SpeedECDHCurve("ECDH P-224", NID_secp224r1, selected) &&
SpeedECDHCurve("ECDH P-256", NID_X9_62_prime256v1, selected) &&
SpeedECDHCurve("ECDH P-384", NID_secp384r1, selected) &&
SpeedECDHCurve("ECDH P-521", NID_secp521r1, selected);
}
static bool SpeedECDSA(const std::string &selected) {
return SpeedECDSACurve("ECDSA P-224", NID_secp224r1, selected) &&
SpeedECDSACurve("ECDSA P-256", NID_X9_62_prime256v1, selected) &&
SpeedECDSACurve("ECDSA P-384", NID_secp384r1, selected) &&
SpeedECDSACurve("ECDSA P-521", NID_secp521r1, selected);
}
bool Speed(const std::vector<std::string> &args) {
std::string selected;
if (args.size() > 1) {
@ -367,7 +463,9 @@ bool Speed(const std::vector<std::string> &args) {
!SpeedHash(EVP_sha1(), "SHA-1", selected) ||
!SpeedHash(EVP_sha256(), "SHA-256", selected) ||
!SpeedHash(EVP_sha512(), "SHA-512", selected) ||
!SpeedRandom(selected)) {
!SpeedRandom(selected) ||
!SpeedECDH(selected) ||
!SpeedECDSA(selected)) {
return false;
}