32e0d10069
This introduces EC_FELEM, which is analogous to EC_SCALAR. It is used for EC_POINT's representation in the generic EC_METHOD, as well as random operations on tuned EC_METHODs that still are implemented genericly. Unlike EC_SCALAR, EC_FELEM's exact representation is awkwardly specific to the EC_METHOD, analogous to how the old values were BIGNUMs but may or may not have been in Montgomery form. This is kind of a nuisance, but no more than before. (If p224-64.c were easily convertable to Montgomery form, we could say |EC_FELEM| is always in Montgomery form. If we exposed the internal add and double implementations in each of the curves, we could give |EC_POINT| an |EC_METHOD|-specific representation and |EC_FELEM| is purely a |EC_GFp_mont_method| type. I'll leave this for later.) The generic add and doubling formulas are aligned with the formulas proved in fiat-crypto. Those only applied to a = -3, so I've proved a generic one in https://github.com/mit-plv/fiat-crypto/pull/356, in case someone uses a custom curve. The new formulas are verified, constant-time, and swap a multiply for a square. As expressed in fiat-crypto they do use more temporaries, but this seems to be fine with stack-allocated EC_FELEMs. (We can try to help the compiler later, but benchamrks below suggest this isn't necessary.) Unlike BIGNUM, EC_FELEM can be stack-allocated. It also captures the bounds in the type system and, in particular, that the width is correct, which will make it easier to select a point in constant-time in the future. (Indeed the old code did not always have the correct width. Its point formula involved halving and implemented this in variable time and variable width.) Before: Did 77274 ECDH P-256 operations in 10046087us (7692.0 ops/sec) Did 5959 ECDH P-384 operations in 10031701us (594.0 ops/sec) Did 10815 ECDSA P-384 signing operations in 10087892us (1072.1 ops/sec) Did 8976 ECDSA P-384 verify operations in 10071038us (891.3 ops/sec) Did 2600 ECDH P-521 operations in 10091688us (257.6 ops/sec) Did 4590 ECDSA P-521 signing operations in 10055195us (456.5 ops/sec) Did 3811 ECDSA P-521 verify operations in 10003574us (381.0 ops/sec) After: Did 77736 ECDH P-256 operations in 10029858us (7750.5 ops/sec) [+0.8%] Did 7519 ECDH P-384 operations in 10068076us (746.8 ops/sec) [+25.7%] Did 13335 ECDSA P-384 signing operations in 10029962us (1329.5 ops/sec) [+24.0%] Did 11021 ECDSA P-384 verify operations in 10088600us (1092.4 ops/sec) [+22.6%] Did 2912 ECDH P-521 operations in 10001325us (291.2 ops/sec) [+13.0%] Did 5150 ECDSA P-521 signing operations in 10027462us (513.6 ops/sec) [+12.5%] Did 4264 ECDSA P-521 verify operations in 10069694us (423.4 ops/sec) [+11.1%] This more than pays for removing points_make_affine previously and even speeds up ECDH P-256 slightly. (The point-on-curve check uses the generic code.) Next is to push the stack-allocating up to ec_wNAF_mul, followed by a constant-time single-point multiplication. Bug: 239 Change-Id: I44a2dff7c52522e491d0f8cffff64c4ab5cd353c Reviewed-on: https://boringssl-review.googlesource.com/27668 Reviewed-by: Adam Langley <agl@google.com>
82 lines
2.9 KiB
C
82 lines
2.9 KiB
C
/* Copyright (c) 2018, Google Inc.
|
|
*
|
|
* Permission to use, copy, modify, and/or distribute this software for any
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
* copyright notice and this permission notice appear in all copies.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
|
|
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
|
|
* OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
|
|
* CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
|
|
|
|
#include <openssl/ec.h>
|
|
|
|
#include <assert.h>
|
|
|
|
#include "internal.h"
|
|
#include "../bn/internal.h"
|
|
#include "../../internal.h"
|
|
|
|
|
|
int ec_bignum_to_felem(const EC_GROUP *group, EC_FELEM *out, const BIGNUM *in) {
|
|
if (BN_is_negative(in) || BN_cmp(in, &group->field) >= 0) {
|
|
OPENSSL_PUT_ERROR(EC, EC_R_COORDINATES_OUT_OF_RANGE);
|
|
return 0;
|
|
}
|
|
return group->meth->bignum_to_felem(group, out, in);
|
|
}
|
|
|
|
int ec_felem_to_bignum(const EC_GROUP *group, BIGNUM *out, const EC_FELEM *in) {
|
|
return group->meth->felem_to_bignum(group, out, in);
|
|
}
|
|
|
|
void ec_felem_neg(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a) {
|
|
// -a is zero if a is zero and p-a otherwise.
|
|
BN_ULONG mask = ec_felem_non_zero_mask(group, a);
|
|
BN_ULONG borrow =
|
|
bn_sub_words(out->words, group->field.d, a->words, group->field.width);
|
|
assert(borrow == 0);
|
|
(void)borrow;
|
|
for (int i = 0; i < group->field.width; i++) {
|
|
out->words[i] &= mask;
|
|
}
|
|
}
|
|
|
|
void ec_felem_add(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a,
|
|
const EC_FELEM *b) {
|
|
EC_FELEM tmp;
|
|
bn_mod_add_words(out->words, a->words, b->words, group->field.d, tmp.words,
|
|
group->field.width);
|
|
}
|
|
|
|
void ec_felem_sub(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a,
|
|
const EC_FELEM *b) {
|
|
EC_FELEM tmp;
|
|
bn_mod_sub_words(out->words, a->words, b->words, group->field.d, tmp.words,
|
|
group->field.width);
|
|
}
|
|
|
|
BN_ULONG ec_felem_non_zero_mask(const EC_GROUP *group, const EC_FELEM *a) {
|
|
BN_ULONG mask = 0;
|
|
for (int i = 0; i < group->field.width; i++) {
|
|
mask |= a->words[i];
|
|
}
|
|
return ~constant_time_is_zero_w(mask);
|
|
}
|
|
|
|
void ec_felem_select(const EC_GROUP *group, EC_FELEM *out, BN_ULONG mask,
|
|
const EC_FELEM *a, const EC_FELEM *b) {
|
|
bn_select_words(out->words, mask, a->words, b->words, group->field.width);
|
|
}
|
|
|
|
int ec_felem_equal(const EC_GROUP *group, const EC_FELEM *a,
|
|
const EC_FELEM *b) {
|
|
// Note this function is variable-time. Constant-time operations should use
|
|
// |ec_felem_non_zero_mask|.
|
|
return OPENSSL_memcmp(a->words, b->words,
|
|
group->field.width * sizeof(BN_ULONG)) == 0;
|
|
}
|