Coverage Report

Created: 2024-11-21 06:47

/src/openssl/crypto/bn/bn_shift.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License").  You may not use
5
 * this file except in compliance with the License.  You can obtain a copy
6
 * in the file LICENSE in the source distribution or at
7
 * https://www.openssl.org/source/license.html
8
 */
9
10
#include <assert.h>
11
#include "internal/cryptlib.h"
12
#include "bn_local.h"
13
14
int BN_lshift1(BIGNUM *r, const BIGNUM *a)
15
170k
{
16
170k
    register BN_ULONG *ap, *rp, t, c;
17
170k
    int i;
18
19
170k
    bn_check_top(r);
20
170k
    bn_check_top(a);
21
22
170k
    if (r != a) {
23
170k
        r->neg = a->neg;
24
170k
        if (bn_wexpand(r, a->top + 1) == NULL)
25
0
            return 0;
26
170k
        r->top = a->top;
27
170k
    } else {
28
0
        if (bn_wexpand(r, a->top + 1) == NULL)
29
0
            return 0;
30
0
    }
31
170k
    ap = a->d;
32
170k
    rp = r->d;
33
170k
    c = 0;
34
4.58M
    for (i = 0; i < a->top; i++) {
35
4.41M
        t = *(ap++);
36
4.41M
        *(rp++) = ((t << 1) | c) & BN_MASK2;
37
4.41M
        c = t >> (BN_BITS2 - 1);
38
4.41M
    }
39
170k
    *rp = c;
40
170k
    r->top += c;
41
170k
    bn_check_top(r);
42
170k
    return 1;
43
170k
}
44
45
int BN_rshift1(BIGNUM *r, const BIGNUM *a)
46
53.0M
{
47
53.0M
    BN_ULONG *ap, *rp, t, c;
48
53.0M
    int i;
49
50
53.0M
    bn_check_top(r);
51
53.0M
    bn_check_top(a);
52
53
53.0M
    if (BN_is_zero(a)) {
54
17.0M
        BN_zero(r);
55
17.0M
        return 1;
56
17.0M
    }
57
36.0M
    i = a->top;
58
36.0M
    ap = a->d;
59
36.0M
    if (a != r) {
60
2.01k
        if (bn_wexpand(r, i) == NULL)
61
0
            return 0;
62
2.01k
        r->neg = a->neg;
63
2.01k
    }
64
36.0M
    rp = r->d;
65
36.0M
    r->top = i;
66
36.0M
    t = ap[--i];
67
36.0M
    rp[i] = t >> 1;
68
36.0M
    c = t << (BN_BITS2 - 1);
69
36.0M
    r->top -= (t == 1);
70
1.02G
    while (i > 0) {
71
990M
        t = ap[--i];
72
990M
        rp[i] = ((t >> 1) & BN_MASK2) | c;
73
990M
        c = t << (BN_BITS2 - 1);
74
990M
    }
75
36.0M
    if (!r->top)
76
29
        r->neg = 0; /* don't allow negative zero */
77
36.0M
    bn_check_top(r);
78
36.0M
    return 1;
79
36.0M
}
80
81
int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
82
32.4M
{
83
32.4M
    int ret;
84
85
32.4M
    if (n < 0) {
86
0
        ERR_raise(ERR_LIB_BN, BN_R_INVALID_SHIFT);
87
0
        return 0;
88
0
    }
89
90
32.4M
    ret = bn_lshift_fixed_top(r, a, n);
91
92
32.4M
    bn_correct_top(r);
93
32.4M
    bn_check_top(r);
94
95
32.4M
    return ret;
96
32.4M
}
97
98
/*
99
 * In respect to shift factor the execution time is invariant of
100
 * |n % BN_BITS2|, but not |n / BN_BITS2|. Or in other words pre-condition
101
 * for constant-time-ness is |n < BN_BITS2| or |n / BN_BITS2| being
102
 * non-secret.
103
 */
104
int bn_lshift_fixed_top(BIGNUM *r, const BIGNUM *a, int n)
105
42.0M
{
106
42.0M
    int i, nw;
107
42.0M
    unsigned int lb, rb;
108
42.0M
    BN_ULONG *t, *f;
109
42.0M
    BN_ULONG l, m, rmask = 0;
110
111
42.0M
    assert(n >= 0);
112
113
42.0M
    bn_check_top(r);
114
42.0M
    bn_check_top(a);
115
116
42.0M
    nw = n / BN_BITS2;
117
42.0M
    if (bn_wexpand(r, a->top + nw + 1) == NULL)
118
0
        return 0;
119
120
42.0M
    if (a->top != 0) {
121
42.0M
        lb = (unsigned int)n % BN_BITS2;
122
42.0M
        rb = BN_BITS2 - lb;
123
42.0M
        rb %= BN_BITS2;            /* say no to undefined behaviour */
124
42.0M
        rmask = (BN_ULONG)0 - rb;  /* rmask = 0 - (rb != 0) */
125
42.0M
        rmask |= rmask >> 8;
126
42.0M
        f = &(a->d[0]);
127
42.0M
        t = &(r->d[nw]);
128
42.0M
        l = f[a->top - 1];
129
42.0M
        t[a->top] = (l >> rb) & rmask;
130
1.90G
        for (i = a->top - 1; i > 0; i--) {
131
1.86G
            m = l << lb;
132
1.86G
            l = f[i - 1];
133
1.86G
            t[i] = (m | ((l >> rb) & rmask)) & BN_MASK2;
134
1.86G
        }
135
42.0M
        t[0] = (l << lb) & BN_MASK2;
136
42.0M
    } else {
137
        /* shouldn't happen, but formally required */
138
33.2k
        r->d[nw] = 0;
139
33.2k
    }
140
42.0M
    if (nw != 0)
141
8.94k
        memset(r->d, 0, sizeof(*t) * nw);
142
143
42.0M
    r->neg = a->neg;
144
42.0M
    r->top = a->top + nw + 1;
145
42.0M
    r->flags |= BN_FLG_FIXED_TOP;
146
147
42.0M
    return 1;
148
42.0M
}
149
150
int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
151
8.89M
{
152
8.89M
    int ret = 0;
153
154
8.89M
    if (n < 0) {
155
0
        ERR_raise(ERR_LIB_BN, BN_R_INVALID_SHIFT);
156
0
        return 0;
157
0
    }
158
159
8.89M
    bn_check_top(r);
160
8.89M
    bn_check_top(a);
161
162
8.89M
    ret = bn_rshift_fixed_top(r, a, n);
163
164
8.89M
    bn_correct_top(r);
165
8.89M
    bn_check_top(r);
166
167
8.89M
    return ret;
168
8.89M
}
169
170
/*
171
 * In respect to shift factor the execution time is invariant of
172
 * |n % BN_BITS2|, but not |n / BN_BITS2|. Or in other words pre-condition
173
 * for constant-time-ness for sufficiently[!] zero-padded inputs is
174
 * |n < BN_BITS2| or |n / BN_BITS2| being non-secret.
175
 */
176
int bn_rshift_fixed_top(BIGNUM *r, const BIGNUM *a, int n)
177
18.5M
{
178
18.5M
    int i, top, nw;
179
18.5M
    unsigned int lb, rb;
180
18.5M
    BN_ULONG *t, *f;
181
18.5M
    BN_ULONG l, m, mask;
182
183
18.5M
    assert(n >= 0);
184
185
18.5M
    nw = n / BN_BITS2;
186
18.5M
    if (nw >= a->top) {
187
        /* shouldn't happen, but formally required */
188
20.1k
        BN_zero(r);
189
20.1k
        return 1;
190
20.1k
    }
191
192
18.4M
    rb = (unsigned int)n % BN_BITS2;
193
18.4M
    lb = BN_BITS2 - rb;
194
18.4M
    lb %= BN_BITS2;            /* say no to undefined behaviour */
195
18.4M
    mask = (BN_ULONG)0 - lb;   /* mask = 0 - (lb != 0) */
196
18.4M
    mask |= mask >> 8;
197
18.4M
    top = a->top - nw;
198
18.4M
    if (r != a && bn_wexpand(r, top) == NULL)
199
0
        return 0;
200
201
18.4M
    t = &(r->d[0]);
202
18.4M
    f = &(a->d[nw]);
203
18.4M
    l = f[0];
204
817M
    for (i = 0; i < top - 1; i++) {
205
799M
        m = f[i + 1];
206
799M
        t[i] = (l >> rb) | ((m << lb) & mask);
207
799M
        l = m;
208
799M
    }
209
18.4M
    t[i] = l >> rb;
210
211
18.4M
    r->neg = a->neg;
212
18.4M
    r->top = top;
213
18.4M
    r->flags |= BN_FLG_FIXED_TOP;
214
215
18.4M
    return 1;
216
18.4M
}