kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
5,122 Commits 12 Branches 0 Tags 38 MiB
C 43.1%
C++ 23.5%
Go 13.6%
Raku 10.8%
Perl 4%
Other 4.9%
9af9b946d2
Go to file
David Benjamin 9af9b946d2 Restore the BN_mod codepath for public Montgomery moduli. 
https://boringssl-review.googlesource.com/10520 and then later
https://boringssl-review.googlesource.com/25285 made BN_MONT_CTX_set
constant-time, which is necessary for RSA's mont_p and mont_q. However,
due to a typo in the benchmark, they did not correctly measure.

Split BN_MONT_CTX creation into a constant-time and variable-time one.
The constant-time one uses our current algorithm and the latter restores
the original BN_mod codepath.

Should we wish to avoid BN_mod, I have an alternate version lying
around:

First, BN_set_bit + bn_mod_lshift1_consttime as now to count up to 2*R.
Next, observe that 2*R = BN_to_montgomery(2) and R*R =
BN_to_montgomery(R) = BN_to_montgomery(2^r_bits) Also observe that
BN_mod_mul_montgomery only needs n0, not RR. Split the core of
BN_mod_exp_mont into its own function so the caller handles conversion.
Raise 2*R to the r_bits power to get 2^r_bits*R = R*R.

The advantage of that algorithm is that it is still constant-time, so we
only need one BN_MONT_CTX_new. Additionally, it avoids BN_mod which is
otherwise (almost, but the remaining links should be easy to cut) out of
the critical path for correctness. One less operation to worry about.

The disadvantage is that it is gives a 25% (RSA-2048) or 32% (RSA-4096)
slower RSA verification speed. I went with the BN_mod one for the time
being.

Before:
Did 9204 RSA 2048 signing operations in 10052053us (915.6 ops/sec)
Did 326000 RSA 2048 verify (same key) operations in 10028823us (32506.3 ops/sec)
Did 50830 RSA 2048 verify (fresh key) operations in 10033794us (5065.9 ops/sec)
Did 1269 RSA 4096 signing operations in 10019204us (126.7 ops/sec)
Did 88435 RSA 4096 verify (same key) operations in 10031129us (8816.1 ops/sec)
Did 14552 RSA 4096 verify (fresh key) operations in 10053411us (1447.5 ops/sec)

After:
Did 9150 RSA 2048 signing operations in 10022831us (912.9 ops/sec)
Did 322000 RSA 2048 verify (same key) operations in 10028604us (32108.2 ops/sec)
Did 289000 RSA 2048 verify (fresh key) operations in 10017205us (28850.4 ops/sec)
Did 1270 RSA 4096 signing operations in 10072950us (126.1 ops/sec)
Did 87480 RSA 4096 verify (same key) operations in 10036328us (8716.3 ops/sec)
Did 80730 RSA 4096 verify (fresh key) operations in 10073614us (8014.0 ops/sec)

Change-Id: Ie8916d1634ccf8513ceda458fa302f09f3e93c07
Reviewed-on: https://boringssl-review.googlesource.com/27287
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
Reviewed-by: Adam Langley <agl@google.com>
2018-04-20 20:50:15 +00:00
.github Add a PULL_REQUEST_TEMPLATE. 2016-03-08 15:23:52 +00:00
crypto Restore the BN_mod codepath for public Montgomery moduli. 2018-04-20 20:50:15 +00:00
decrepit fix compilation error for non-english windows (like cjk) 2018-03-15 17:52:23 +00:00
fipstools Merge NIAP and FIPS test suites. 2018-02-20 19:41:45 +00:00
fuzz Add a function which folds BN_MONT_CTX_{new,set} together. 2018-02-02 20:23:25 +00:00
include/openssl Restore the BN_mod codepath for public Montgomery moduli. 2018-04-20 20:50:15 +00:00
infra/config CQ: use new luci.boringssl.try bucket. 2018-03-20 16:31:15 +00:00
ssl Test the high-order bit in X25519. 2018-04-19 00:56:35 +00:00
third_party Fix typo in point_add. 2018-03-23 21:12:29 +00:00
tool tool: Move the RSA specific code from |Speed| to |SpeedRSA|. 2018-04-13 17:35:13 +00:00
util delocate: put emitted labels in a specific file. 2018-04-19 17:54:31 +00:00
.clang-format Import `newhope' (post-quantum key exchange). 2016-04-26 22:53:59 +00:00
.gitignore [ndk] Change ndk deps in src and relocate to third_party/boringssl 2018-01-22 21:08:28 +00:00
API-CONVENTIONS.md Fix API-CONVENTIONS.md typos. 2017-01-04 01:46:32 +00:00
BUILDING.md Add -DOPENSSL_SMALL to CMake. 2018-03-23 21:07:48 +00:00
CMakeLists.txt Add -DOPENSSL_SMALL to CMake. 2018-03-23 21:07:48 +00:00
codereview.settings No-op change to trigger the new Bazel bot. 2016-07-07 12:07:04 -07:00
CONTRIBUTING.md Add a CONTRIBUTING.md file. 2016-02-10 21:38:19 +00:00
FUZZING.md Fix typo in FUZZING.md. 2017-07-06 18:25:07 +00:00
INCORPORATING.md Update links to Bazel's site. 2016-10-31 18:16:58 +00:00
LICENSE Note licenses for support code in the top-level LICENSE file. 2018-03-27 17:03:47 +00:00
PORTING.md Add cpu-aarch64-fuchsia.c 2018-02-13 20:12:47 +00:00
README.md Add an API-CONVENTIONS.md document. 2016-08-04 23:27:49 +00:00
sources.cmake Add some EC base point multiplication test vectors. 2018-03-27 23:33:24 +00:00
STYLE.md Fix some style guide samples. 2017-08-31 14:24:45 +00:00

README.md

BoringSSL

BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.

Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.

Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.

BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.

Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.

There are other files in this directory which might be helpful: