23e1a1f2d3
Calling conventions must specify how to handle arguments smaller than a
machine word. Should the caller pad them up to a machine word size with
predictable values (zero/sign-extended), or should the callee tolerate
an arbitrary bit pattern?
Annoyingly, I found no text in either SysV or Win64 ABI documentation
describing any of this and resorted to experiment. The short answer is
that callees must tolerate an arbitrary bit pattern on x86_64, which
means we must test this. See the comment in abi_test::internal::ToWord
for the long answer.
CHECK_ABI now, if the type of the parameter is smaller than
crypto_word_t, fills the remaining bytes with 0xaa. This is so the
number is out of bounds for code expecting either zero or sign
extension. (Not that crypto assembly has any business seeing negative
numbers.)
Doing so reveals a bug in ecp_nistz256_ord_sqr_mont. The rep parameter
is typed int, but the code expected uint64_t. In practice, the compiler
will always compile this correctly because:
- On both Win64 and SysV, rep is a register parameter.
- The rep parameter is always a constant, so the compiler has no reason
to leave garbage in the upper half.
However, I was indeed able to get a bug out of GCC via:
uint64_t foo = (1ull << 63) | 2; // Some global the compiler can't
// prove constant.
ecp_nistz256_ord_sqr_mont(res, a, foo >> 1);
Were ecp_nistz256_ord_sqr_mont a true int-taking function, this would
act like ecp_nistz256_ord_sqr_mont(res, a, 1). Instead, it hung. Fix
this by having it take a full-width word.
This mess has several consequences:
- ABI testing now ideally needs a functional testing component to fully cover
this case. A bad input might merely produce the wrong answer. Still,
this is fairly effective as it will cause most code to either segfault
or loop forever. (Not the enc parameter to AES however...)
- We cannot freely change the type of assembly function prototypes. If the
prototype says int or unsigned, it must be ignoring the upper half and
thus "fixing" it to size_t cannot have handled the full range. (Unless
it was simply wrong of the parameter is already bounded.) If the
prototype says size_t, switching to int or unsigned will hit this type
of bug. The former is a safer failure mode though.
- The simplest path out of this mess: new assembly code should *only*
ever take word-sized parameters. This is not a tall order as the bad
parameters are usually ints that should have been size_t.
Calling conventions are hard.
Change-Id: If8254aff8953844679fbce4bd3e345e5e2fa5213
Reviewed-on: https://boringssl-review.googlesource.com/c/34627
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
154 lines
5.6 KiB
C
154 lines
5.6 KiB
C
/*
|
|
* Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved.
|
|
* Copyright (c) 2014, Intel Corporation. All Rights Reserved.
|
|
*
|
|
* Licensed under the OpenSSL license (the "License"). You may not use
|
|
* this file except in compliance with the License. You can obtain a copy
|
|
* in the file LICENSE in the source distribution or at
|
|
* https://www.openssl.org/source/license.html
|
|
*
|
|
* Originally written by Shay Gueron (1, 2), and Vlad Krasnov (1)
|
|
* (1) Intel Corporation, Israel Development Center, Haifa, Israel
|
|
* (2) University of Haifa, Israel
|
|
*
|
|
* Reference:
|
|
* S.Gueron and V.Krasnov, "Fast Prime Field Elliptic Curve Cryptography with
|
|
* 256 Bit Primes"
|
|
*/
|
|
|
|
#ifndef OPENSSL_HEADER_EC_P256_X86_64_H
|
|
#define OPENSSL_HEADER_EC_P256_X86_64_H
|
|
|
|
#include <openssl/base.h>
|
|
|
|
#include <openssl/bn.h>
|
|
|
|
#include "../bn/internal.h"
|
|
|
|
#if defined(__cplusplus)
|
|
extern "C" {
|
|
#endif
|
|
|
|
|
|
#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \
|
|
!defined(OPENSSL_SMALL)
|
|
|
|
// P-256 field operations.
|
|
//
|
|
// An element mod P in P-256 is represented as a little-endian array of
|
|
// |P256_LIMBS| |BN_ULONG|s, spanning the full range of values.
|
|
//
|
|
// The following functions take fully-reduced inputs mod P and give
|
|
// fully-reduced outputs. They may be used in-place.
|
|
|
|
#define P256_LIMBS (256 / BN_BITS2)
|
|
|
|
// ecp_nistz256_neg sets |res| to -|a| mod P.
|
|
void ecp_nistz256_neg(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS]);
|
|
|
|
// ecp_nistz256_mul_mont sets |res| to |a| * |b| * 2^-256 mod P.
|
|
void ecp_nistz256_mul_mont(BN_ULONG res[P256_LIMBS],
|
|
const BN_ULONG a[P256_LIMBS],
|
|
const BN_ULONG b[P256_LIMBS]);
|
|
|
|
// ecp_nistz256_sqr_mont sets |res| to |a| * |a| * 2^-256 mod P.
|
|
void ecp_nistz256_sqr_mont(BN_ULONG res[P256_LIMBS],
|
|
const BN_ULONG a[P256_LIMBS]);
|
|
|
|
// ecp_nistz256_from_mont sets |res| to |in|, converted from Montgomery domain
|
|
// by multiplying with 1.
|
|
static inline void ecp_nistz256_from_mont(BN_ULONG res[P256_LIMBS],
|
|
const BN_ULONG in[P256_LIMBS]) {
|
|
static const BN_ULONG ONE[P256_LIMBS] = { 1 };
|
|
ecp_nistz256_mul_mont(res, in, ONE);
|
|
}
|
|
|
|
// ecp_nistz256_to_mont sets |res| to |in|, converted to Montgomery domain
|
|
// by multiplying with RR = 2^512 mod P precomputed for NIST P256 curve.
|
|
static inline void ecp_nistz256_to_mont(BN_ULONG res[P256_LIMBS],
|
|
const BN_ULONG in[P256_LIMBS]) {
|
|
static const BN_ULONG RR[P256_LIMBS] = {
|
|
TOBN(0x00000000, 0x00000003), TOBN(0xfffffffb, 0xffffffff),
|
|
TOBN(0xffffffff, 0xfffffffe), TOBN(0x00000004, 0xfffffffd)};
|
|
ecp_nistz256_mul_mont(res, in, RR);
|
|
}
|
|
|
|
|
|
// P-256 scalar operations.
|
|
//
|
|
// The following functions compute modulo N, where N is the order of P-256. They
|
|
// take fully-reduced inputs and give fully-reduced outputs.
|
|
|
|
// ecp_nistz256_ord_mul_mont sets |res| to |a| * |b| where inputs and outputs
|
|
// are in Montgomery form. That is, |res| is |a| * |b| * 2^-256 mod N.
|
|
void ecp_nistz256_ord_mul_mont(BN_ULONG res[P256_LIMBS],
|
|
const BN_ULONG a[P256_LIMBS],
|
|
const BN_ULONG b[P256_LIMBS]);
|
|
|
|
// ecp_nistz256_ord_sqr_mont sets |res| to |a|^(2*|rep|) where inputs and
|
|
// outputs are in Montgomery form. That is, |res| is
|
|
// (|a| * 2^-256)^(2*|rep|) * 2^256 mod N.
|
|
void ecp_nistz256_ord_sqr_mont(BN_ULONG res[P256_LIMBS],
|
|
const BN_ULONG a[P256_LIMBS], BN_ULONG rep);
|
|
|
|
// beeu_mod_inverse_vartime sets out = a^-1 mod p using a Euclidean algorithm.
|
|
// Assumption: 0 < a < p < 2^(256) and p is odd.
|
|
int beeu_mod_inverse_vartime(BN_ULONG out[P256_LIMBS],
|
|
const BN_ULONG a[P256_LIMBS],
|
|
const BN_ULONG p[P256_LIMBS]);
|
|
|
|
|
|
// P-256 point operations.
|
|
//
|
|
// The following functions may be used in-place. All coordinates are in the
|
|
// Montgomery domain.
|
|
|
|
// A P256_POINT represents a P-256 point in Jacobian coordinates.
|
|
typedef struct {
|
|
BN_ULONG X[P256_LIMBS];
|
|
BN_ULONG Y[P256_LIMBS];
|
|
BN_ULONG Z[P256_LIMBS];
|
|
} P256_POINT;
|
|
|
|
// A P256_POINT_AFFINE represents a P-256 point in affine coordinates. Infinity
|
|
// is encoded as (0, 0).
|
|
typedef struct {
|
|
BN_ULONG X[P256_LIMBS];
|
|
BN_ULONG Y[P256_LIMBS];
|
|
} P256_POINT_AFFINE;
|
|
|
|
// ecp_nistz256_select_w5 sets |*val| to |in_t[index-1]| if 1 <= |index| <= 16
|
|
// and all zeros (the point at infinity) if |index| is 0. This is done in
|
|
// constant time.
|
|
void ecp_nistz256_select_w5(P256_POINT *val, const P256_POINT in_t[16],
|
|
int index);
|
|
|
|
// ecp_nistz256_select_w7 sets |*val| to |in_t[index-1]| if 1 <= |index| <= 64
|
|
// and all zeros (the point at infinity) if |index| is 0. This is done in
|
|
// constant time.
|
|
void ecp_nistz256_select_w7(P256_POINT_AFFINE *val,
|
|
const P256_POINT_AFFINE in_t[64], int index);
|
|
|
|
// ecp_nistz256_point_double sets |r| to |a| doubled.
|
|
void ecp_nistz256_point_double(P256_POINT *r, const P256_POINT *a);
|
|
|
|
// ecp_nistz256_point_add adds |a| to |b| and places the result in |r|.
|
|
void ecp_nistz256_point_add(P256_POINT *r, const P256_POINT *a,
|
|
const P256_POINT *b);
|
|
|
|
// ecp_nistz256_point_add_affine adds |a| to |b| and places the result in
|
|
// |r|. |a| and |b| must not represent the same point unless they are both
|
|
// infinity.
|
|
void ecp_nistz256_point_add_affine(P256_POINT *r, const P256_POINT *a,
|
|
const P256_POINT_AFFINE *b);
|
|
|
|
#endif /* !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \
|
|
!defined(OPENSSL_SMALL) */
|
|
|
|
|
|
#if defined(__cplusplus)
|
|
} // extern C++
|
|
#endif
|
|
|
|
#endif // OPENSSL_HEADER_EC_P256_X86_64_H
|