kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
287ac180ee
boringssl/crypto
History
David Benjamin ea52ec98a5 Perform the RSA CRT reductions with Montgomery reduction. 
The first step of RSA with the CRT optimization is to reduce our input
modulo p and q. We can do this in constant-time[*] with Montgomery
reduction. When p and q are the same size, Montgomery reduction's bounds
hold. We need two rounds of it because the first round gives us an
unwanted R^-1.

This does not appear to have a measurable impact on performance. Also
add a long TODO describing how to make the rest of the function
constant-time[*] which hopefully we'll get to later. RSA blinding should
protect us from it all, but make this constant-time anyway.

Since this and the follow-up work will special-case weird keys, add a
test that we don't break those unintentionally. (Though I am not above
breaking them intentionally someday...)

Thanks to Andres Erbsen for discussions on how to do this bit properly.

[*] Ignoring the pervasive bn_correct_top problem for the moment.

Change-Id: Ide099a9db8249cb6549be99c5f8791a39692ea81
Reviewed-on: https://boringssl-review.googlesource.com/24204
Reviewed-by: Adam Langley <agl@google.com>
2017-12-18 18:59:18 +00:00
..
asn1 Use uint32_t for unicode code points. 2017-12-08 17:51:34 +00:00
base64 Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
bio Add missing errno.h include to bio_test.cc 2017-12-04 01:32:37 +00:00
bn_extra Remove the buggy RSA parser. 2017-10-24 17:39:46 +00:00
buf Always process handshake records in full. 2017-10-17 14:53:11 +00:00
bytestring Revert "Support high tag numbers in CBS/CBB." 2017-11-30 21:57:17 +00:00
chacha Silence ARMv8 deprecated IT instruction warnings. 2017-12-14 01:56:22 +00:00
cipher_extra Explicit fallthrough on switch 2017-09-20 19:58:25 +00:00
cmac Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
conf Add more compatibility symbols for Node. 2017-11-03 01:31:50 +00:00
curve25519 Move curve25519 code to third_party/fiat. 2017-11-03 22:23:59 +00:00
dh Fx DH_set0_pqg. 2017-10-05 18:50:48 +00:00
digest_extra Export EVP_parse_digest_algorithm and add EVP_marshal_digest_algorithm. 2017-09-25 20:44:13 +00:00
dsa Remove DSA_sign_setup too. 2017-11-22 21:01:11 +00:00
ec_extra Support high tag numbers in CBS/CBB. 2017-11-22 22:34:05 +00:00
ecdh Check EC_POINT/EC_GROUP compatibility more accurately. 2017-10-28 08:02:50 +00:00
ecdsa_extra Remove ECDSA_sign_setup and friends. 2017-11-22 20:23:40 +00:00
engine Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
err SSL_export_keying_material should work in half-RTT. 2017-12-18 16:53:13 +00:00
evp Perform the RSA CRT reductions with Montgomery reduction. 2017-12-18 18:59:18 +00:00
fipsmodule Perform the RSA CRT reductions with Montgomery reduction. 2017-12-18 18:59:18 +00:00
hkdf Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
hmac_extra Convert a number of tests to GTest. 2017-06-01 17:02:13 +00:00
lhash Unexport more of lhash. 2017-10-25 04:17:18 +00:00
obj Also add a decoupled OBJ_obj2txt. 2017-11-30 18:21:48 +00:00
pem Clear some _CRT_SECURE_NO_WARNINGS warnings. 2017-10-25 04:14:28 +00:00
perlasm Revert assembly changes in "Hide CPU capability symbols in C." 2017-10-30 20:39:57 +00:00
pkcs7 Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
pkcs8 Export EVP_parse_digest_algorithm and add EVP_marshal_digest_algorithm. 2017-09-25 20:44:13 +00:00
poly1305 Remove custom memcpy and memset from poly1305_vec. 2017-11-10 20:53:30 +00:00
pool Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
rand_extra Remove CHROMIUM_ROLLING_MAGENTA_TO_ZIRCON scaffolding. 2017-09-18 21:34:32 +00:00
rc4
rsa_extra Make BN_generate_dsa_nonce internally constant-time. 2017-11-20 16:18:30 +00:00
stack Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
test Clarify ERR_print_errors_* clear the error queue. 2017-09-05 17:31:25 +00:00
x509 Use uint32_t for unicode code points. 2017-12-08 17:51:34 +00:00
x509v3 Pretty-print large INTEGERs and ENUMERATEDs in hex. 2017-11-27 18:38:50 +00:00
CMakeLists.txt Move curve25519 code to third_party/fiat. 2017-11-03 22:23:59 +00:00
compiler_test.cc Test that nullptr has the obvious memory representation. 2017-07-28 17:39:28 +00:00
constant_time_test.cc
cpu-aarch64-linux.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
cpu-arm-linux.c Add CRYPTO_needs_hwcap2_workaround. 2017-09-18 14:05:46 +00:00
cpu-arm.c
cpu-intel.c Use unsigned integers for masks. 2017-10-30 18:39:58 +00:00
cpu-ppc64le.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
crypto.c Hide CPU capability symbols in C. 2017-10-23 18:36:49 +00:00
ex_data.c Unexport more of lhash. 2017-10-25 04:17:18 +00:00
internal.h Enable __asm__ and uint128_t code in clang-cl. 2017-12-11 22:46:26 +00:00
mem.c Remove now unnecessary _POSIX_C_SOURCE bits to work around macOS bug. 2017-10-02 20:02:22 +00:00
refcount_c11.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
refcount_lock.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
refcount_test.cc Convert various tests to GTest. 2017-05-23 22:34:09 +00:00
thread_none.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread_pthread.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread_test.cc Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread_win.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread.c