/*

 *  Copyright (C) 2017 - This file is part of libecc project

 *

 *  Authors:

 *      Ryad BENADJILA <ryadbenadjila@gmail.com>

 *      Arnaud EBALARD <arnaud.ebalard@ssi.gouv.fr>

 *      Jean-Pierre FLORI <jean-pierre.flori@ssi.gouv.fr>

 *

 *  Contributors:

 *      Nicolas VIVET <nicolas.vivet@ssi.gouv.fr>

 *      Karim KHALFALLAH <karim.khalfallah@ssi.gouv.fr>

 *

 *  This software is licensed under a dual BSD and GPL v2 license.

 *  See LICENSE file at the root folder of the project.

 */

#ifndef __NN_CONFIG_H__

#define __NN_CONFIG_H__

#include <libecc/words/words.h>

/*

 * We include the curves list to adapt the maximum NN size to P and Q

 * (prime and order of the curve).

 */

#include <libecc/curves/curves_list.h>

/*

 * We also include the hash layer to adapt the maximum NN size to the

 * maximum digest size as we have to import full digests as NN when dealing

 * with some signature algorithms.

 *

 */

#include <libecc/hash/hash_algs.h>

/*

 * All the big num used in the lib are statically allocated. This constant

 * must be defined (here or during build) to provide an upper limit on the

 * size in bits of the numbers the instance of the lib you will build will

 * handle. Note that this value does not prevent the declaration and use

 * of smaller numbers.

 *

 * Rationale for the default value: the main purpose of the lirary is to

 * support for an ECC implementation. ATM, a forseeable upper limit for the

 * numbers that will be dealt with is 521 bits.

 *

 * However, the user is allowed to overload the maximum bit length of the

 * numbers through the USER_NN_BIT_LEN macro definition (see below). A

 * hard limit 'nn_max' for this size depends on the word size and verifies

 * the following equation (with w being the word size):

 *

 *             floor((nn_max + w - 1) / w) * 3 = 255

 *

 * This equation is explained by elements given below, and by the fact that

 * the length in words of our big numbers are encoded on an u8. This yields

 * in max sizes of around 5300 bits for 64-bit words, around 2650 bits for

 * 32-bit words, and around 1300 bits for 16-bit words.

 *

 * Among all the functions we have, some need to handle something which

 * can be seen as a double, so we need twice the amount of bit above.

 * This is typically the case when two numbers are multiplied.

 * But then you usually want to divide this product by another number

 * of the initial size which generically requires shifting by the

 * original sized, whence the factor 3 below.

 *

 * Additionally, all numbers we handled are expected to have a length which

 * is a multiple of the word size we support, i.e. 64/32/16 bits. Hence the

 * rounding.

 */

/* Macro to round a bit length size to a word size */

#define BIT_LEN_ROUNDING(x, w) ((((x) + (w) - 1) / (w)) * (w))

/*

 * Macro to round a bit length size of a NN value to a word size, and

 * to a size compatible with the arithmetic operations of the library

 * (usually 3 times the size of the input numbers, see explanations above).

 */

#define MAX_BIT_LEN_ROUNDING(x, w) (((((x) + (w) - 1) / (w)) * (w)) * 3)

#ifndef USER_NN_BIT_LEN

/*

 * The user has not defined a specific bit length: we can infer our maximum

 * NN bit size from our curves.

 */

#ifndef NN_MAX_BIT_LEN

#if CURVES_MAX_P_BIT_LEN >= CURVES_MAX_CURVE_ORDER_BIT_LEN

#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(CURVES_MAX_P_BIT_LEN, WORD_BITS)

#define NN_MAX_BASE CURVES_MAX_P_BIT_LEN

#else

#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(CURVES_MAX_CURVE_ORDER_BIT_LEN, WORD_BITS)

#define NN_MAX_BASE CURVES_MAX_CURVE_ORDER_BIT_LEN

#endif

#endif

/****************/

#else

/*

 * If the USER_NN_BIT_LEN flag is defined by the user, we want to be sure that

 * we can also handle our curves, and we also want to round the size to the

 * words we have.

 */

#if CURVES_MAX_P_BIT_LEN >= CURVES_MAX_CURVE_ORDER_BIT_LEN

#if USER_NN_BIT_LEN >= CURVES_MAX_P_BIT_LEN

#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(USER_NN_BIT_LEN, WORD_BITS)

#define NN_MAX_BASE USER_NN_BIT_LEN

#else

#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(CURVES_MAX_P_BIT_LEN, WORD_BITS)

#define NN_MAX_BASE CURVES_MAX_P_BIT_LEN

#endif

#else

#if USER_NN_BIT_LEN >= CURVES_MAX_CURVE_ORDER_BIT_LEN

#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(USER_NN_BIT_LEN, WORD_BITS)

#define NN_MAX_BASE USER_NN_BIT_LEN

#else

#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(CURVES_MAX_CURVE_ORDER_BIT_LEN, WORD_BITS)

#define NN_MAX_BASE CURVES_MAX_CURVE_ORDER_BIT_LEN

#endif

#endif

#endif

/* Now adjust the maximum length with our maximum digest size as we

 * have to import full digests as big numbers in some signature algorithms.

 *

 * The division by 2 here is related to the fact that we usually import hash values

 * without performing much NN operations on them (immediately reducing them modulo q), so

 * it is safe to remove some additional space left for multiplications.

 */

#if NN_MAX_BIT_LEN < MAX_BIT_LEN_ROUNDING(((8 * MAX_DIGEST_SIZE) / 2), WORD_BITS)

#undef NN_MAX_BIT_LEN

#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING(((8 * MAX_DIGEST_SIZE) / 2), WORD_BITS)

#undef NN_MAX_BASE

#define NN_MAX_BASE MAX_DIGEST_SIZE_BITS

#endif

/*

 * NOTE: the only exception to the rule above (i.e. immediately reducing hash sized

 * values modulo q) is when we use blinding and EdDSA and there might be not enough

 * room for our computations. This is actually *specific to EdDSA 25519* as EdDSA 448

 * always uses SHAKE256 digest with 114 bytes hash output that has enough room for

 * computation when compared to the 448-bit size order of the curve.

 *

 * This is kind of ugly to have this specific case here, but

 * being too conservative always using the maximum size adapated to MAX_DIGEST_SIZE

 * sacrifices *ALL* the sognature performance only for the specific case of EdDSA 25519!

 *

 */

#if defined(WITH_SIG_EDDSA25519) && defined(USE_SIG_BLINDING)

#if NN_MAX_BIT_LEN < MAX_BIT_LEN_ROUNDING((8 * SHA512_DIGEST_SIZE), WORD_BITS)

#undef NN_MAX_BIT_LEN

#define NN_MAX_BIT_LEN MAX_BIT_LEN_ROUNDING((8 * SHA512_DIGEST_SIZE), WORD_BITS)

#undef NN_MAX_BASE

#define NN_MAX_BASE MAX_DIGEST_SIZE_BITS

#endif

#endif /* defined(WITH_SIG_EDDSA25519) && defined(USE_SIG_BLINDING) */

/************/

/* NN maximum internal lengths to be "safe" in our computations */

#define NN_MAX_BYTE_LEN (NN_MAX_BIT_LEN / 8)

#define NN_MAX_WORD_LEN (NN_MAX_BYTE_LEN / WORD_BYTES)

/* Usable maximum sizes, to be used by the end user to be "safe" in

 * all the computations.

 */

#define NN_USABLE_MAX_BIT_LEN  (NN_MAX_BASE)

#define NN_USABLE_MAX_BYTE_LEN ((BIT_LEN_ROUNDING(NN_USABLE_MAX_BIT_LEN, 8)) / 8)

#define NN_USABLE_MAX_WORD_LEN ((BIT_LEN_ROUNDING(NN_USABLE_MAX_BIT_LEN, WORD_BITS)) / WORD_BITS)

/* Sanity checks */

#if (NN_USABLE_MAX_BIT_LEN > NN_MAX_BIT_LEN) || (NN_USABLE_MAX_BYTE_LEN > NN_MAX_BYTE_LEN) || (NN_USABLE_MAX_WORD_LEN > NN_MAX_WORD_LEN)

#error "usable maximum length > internal maximum length, this should not happen!"

#endif

#if (NN_MAX_WORD_LEN > 255)

#error "nn.wlen is encoded on an u8. NN_MAX_WORD_LEN cannot be larger than 255!"

#endif

/* Add a (somehow 'dirty' but working and useful!) way to detect when our .a

 * library has been compiled with options (WORDSIZE and NN_MAX_BIT_LEN)

 * inconsistent with the 'final' binary we want to compile linking to the .a

 * archive. The 'magic' lies in the definition in nn.c of a function (symbol)

 * in our .a archive, consisting in a concatenation of WORDSIZE and

 * NN_MAX_BIT_LEN preprocessed values. On the other side, we force the use

 * of this symbol in other NN .c modules, yielding in a compile time error

 * if WORDSIZE or NN_MAX_BIT_LEN differ.

 * Update: we also check here the consistency of using complete formulas

 * or not.

 */

#ifdef NO_USE_COMPLETE_FORMULAS

#define _LIBECC_CONCATENATE(a, b, c, d, e) a##_##b##_##c##_##d##_##e

#define LIBECC_CONCATENATE(a, b, c, d, e) _LIBECC_CONCATENATE(a, b, c, d, e)

void LIBECC_CONCATENATE(nn_consistency_check_maxbitlen, NN_MAX_BASE, wordsize,

     WORDSIZE, MAX_DIGEST_SIZE) (void);

#ifdef NN_CONSISTENCY_CHECK

ATTRIBUTE_USED void LIBECC_CONCATENATE(nn_consistency_check_maxbitlen, NN_MAX_BASE,

        wordsize, WORDSIZE, MAX_DIGEST_SIZE) (void) {

  return;

}

#else

ATTRIBUTE_USED static inline void nn_check_libconsistency(void)

{

  LIBECC_CONCATENATE(nn_consistency_check_maxbitlen, NN_MAX_BASE, wordsize,

        WORDSIZE, MAX_DIGEST_SIZE) ();

  return;

}

#endif

#else /* NO_USE_COMPLETE_FORMULAS */

#define _LIBECC_CONCATENATE(a, b, c, d, e, f) a##_##b##_##c##_##d##_##e##_##f

#define LIBECC_CONCATENATE(a, b, c, d, e, f) _LIBECC_CONCATENATE(a, b, c, d, e, f)

void LIBECC_CONCATENATE(nn_consistency_check_maxbitlen, NN_MAX_BASE, wordsize,

     WORDSIZE, complete_formulas, MAX_DIGEST_SIZE) (void);

#ifdef NN_CONSISTENCY_CHECK

ATTRIBUTE_USED void LIBECC_CONCATENATE(nn_consistency_check_maxbitlen, NN_MAX_BASE,

        wordsize, WORDSIZE, complete_formulas, MAX_DIGEST_SIZE) (void) {

  return;

}

#else

ATTRIBUTE_USED static inline void nn_check_libconsistency(void)

{

  LIBECC_CONCATENATE(nn_consistency_check_maxbitlen, NN_MAX_BASE, wordsize,

        WORDSIZE, complete_formulas, MAX_DIGEST_SIZE) ();

  return;

}

Unexecuted instantiation: module.cpp:nn_check_libconsistency()

Unexecuted instantiation: aff_pt.c:nn_check_libconsistency

Unexecuted instantiation: curves.c:nn_check_libconsistency

Unexecuted instantiation: ec_key.c:nn_check_libconsistency

Unexecuted instantiation: ec_params.c:nn_check_libconsistency

Unexecuted instantiation: ec_shortw.c:nn_check_libconsistency

Unexecuted instantiation: ecccdh.c:nn_check_libconsistency

Unexecuted instantiation: ecdsa.c:nn_check_libconsistency

Unexecuted instantiation: ecdsa_common.c:nn_check_libconsistency

Unexecuted instantiation: ecgdsa.c:nn_check_libconsistency

Unexecuted instantiation: ecrdsa.c:nn_check_libconsistency

Unexecuted instantiation: eddsa.c:nn_check_libconsistency

Unexecuted instantiation: fp.c:nn_check_libconsistency

Unexecuted instantiation: fp_add.c:nn_check_libconsistency

Unexecuted instantiation: fp_mul.c:nn_check_libconsistency

Unexecuted instantiation: fp_mul_redc1.c:nn_check_libconsistency

Unexecuted instantiation: fp_sqrt.c:nn_check_libconsistency

Unexecuted instantiation: fuzzing_ecdsa.c:nn_check_libconsistency

Unexecuted instantiation: fuzzing_ecgdsa.c:nn_check_libconsistency

Unexecuted instantiation: fuzzing_ecrdsa.c:nn_check_libconsistency

Unexecuted instantiation: nn_add.c:nn_check_libconsistency

Unexecuted instantiation: nn_div.c:nn_check_libconsistency

Unexecuted instantiation: nn_logical.c:nn_check_libconsistency

Unexecuted instantiation: nn_mod_pow.c:nn_check_libconsistency

Unexecuted instantiation: nn_modinv.c:nn_check_libconsistency

Unexecuted instantiation: nn_mul.c:nn_check_libconsistency

Unexecuted instantiation: nn_mul_redc1.c:nn_check_libconsistency

Unexecuted instantiation: nn_rand.c:nn_check_libconsistency

Unexecuted instantiation: prj_pt.c:nn_check_libconsistency

Unexecuted instantiation: sig_algs.c:nn_check_libconsistency

Unexecuted instantiation: sm2.c:nn_check_libconsistency

Unexecuted instantiation: x25519_448.c:nn_check_libconsistency

Unexecuted instantiation: aff_pt_edwards.c:nn_check_libconsistency

Unexecuted instantiation: aff_pt_montgomery.c:nn_check_libconsistency

Unexecuted instantiation: bign.c:nn_check_libconsistency

Unexecuted instantiation: bign_common.c:nn_check_libconsistency

Unexecuted instantiation: bip0340.c:nn_check_libconsistency

Unexecuted instantiation: dbign.c:nn_check_libconsistency

Unexecuted instantiation: decdsa.c:nn_check_libconsistency

Unexecuted instantiation: ec_edwards.c:nn_check_libconsistency

Unexecuted instantiation: ec_montgomery.c:nn_check_libconsistency

Unexecuted instantiation: ecfsdsa.c:nn_check_libconsistency

Unexecuted instantiation: eckcdsa.c:nn_check_libconsistency

Unexecuted instantiation: ecosdsa.c:nn_check_libconsistency

Unexecuted instantiation: ecsdsa.c:nn_check_libconsistency

Unexecuted instantiation: ecsdsa_common.c:nn_check_libconsistency

Unexecuted instantiation: fp_montgomery.c:nn_check_libconsistency

Unexecuted instantiation: fp_pow.c:nn_check_libconsistency

Unexecuted instantiation: fp_rand.c:nn_check_libconsistency

#endif

#endif /* NO_USE_COMPLETE_FORMULAS */

#endif /* __NN_CONFIG_H__ */