/src/openssl111/crypto/ec/curve448/field.h
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * Copyright 2014 Cryptography Research, Inc. |
4 | | * |
5 | | * Licensed under the OpenSSL license (the "License"). You may not use |
6 | | * this file except in compliance with the License. You can obtain a copy |
7 | | * in the file LICENSE in the source distribution or at |
8 | | * https://www.openssl.org/source/license.html |
9 | | * |
10 | | * Originally written by Mike Hamburg |
11 | | */ |
12 | | |
13 | | #ifndef OSSL_CRYPTO_EC_CURVE448_FIELD_H |
14 | | # define OSSL_CRYPTO_EC_CURVE448_FIELD_H |
15 | | |
16 | | # include "internal/constant_time.h" |
17 | | # include <string.h> |
18 | | # include <assert.h> |
19 | | # include "word.h" |
20 | | |
21 | 852k | # define NLIMBS (64/sizeof(word_t)) |
22 | 1.62k | # define X_SER_BYTES 56 |
23 | 0 | # define SER_BYTES 56 |
24 | | |
25 | | # if defined(__GNUC__) || defined(__clang__) |
26 | | # define INLINE_UNUSED __inline__ __attribute__((__unused__,__always_inline__)) |
27 | | # define RESTRICT __restrict__ |
28 | | # define ALIGNED __attribute__((__aligned__(16))) |
29 | | # else |
30 | | # define INLINE_UNUSED ossl_inline |
31 | | # define RESTRICT |
32 | | # define ALIGNED |
33 | | # endif |
34 | | |
35 | | typedef struct gf_s { |
36 | | word_t limb[NLIMBS]; |
37 | | } ALIGNED gf_s, gf[1]; |
38 | | |
39 | | /* RFC 7748 support */ |
40 | 32 | # define X_PUBLIC_BYTES X_SER_BYTES |
41 | 32 | # define X_PRIVATE_BYTES X_PUBLIC_BYTES |
42 | 32 | # define X_PRIVATE_BITS 448 |
43 | | |
44 | | static INLINE_UNUSED void gf_copy(gf out, const gf a) |
45 | 124 | { |
46 | 124 | *out = *a; |
47 | 124 | } Line | Count | Source | 45 | 56 | { | 46 | 56 | *out = *a; | 47 | 56 | } |
Unexecuted instantiation: curve448_tables.c:gf_copy Unexecuted instantiation: eddsa.c:gf_copy Line | Count | Source | 45 | 68 | { | 46 | 68 | *out = *a; | 47 | 68 | } |
Unexecuted instantiation: scalar.c:gf_copy Unexecuted instantiation: f_impl.c:gf_copy |
48 | | |
49 | | static INLINE_UNUSED void gf_add_RAW(gf out, const gf a, const gf b); |
50 | | static INLINE_UNUSED void gf_sub_RAW(gf out, const gf a, const gf b); |
51 | | static INLINE_UNUSED void gf_bias(gf inout, int amount); |
52 | | static INLINE_UNUSED void gf_weak_reduce(gf inout); |
53 | | |
54 | | void gf_strong_reduce(gf inout); |
55 | | void gf_add(gf out, const gf a, const gf b); |
56 | | void gf_sub(gf out, const gf a, const gf b); |
57 | | void gf_mul(gf_s * RESTRICT out, const gf a, const gf b); |
58 | | void gf_mulw_unsigned(gf_s * RESTRICT out, const gf a, uint32_t b); |
59 | | void gf_sqr(gf_s * RESTRICT out, const gf a); |
60 | | mask_t gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0. Return true if successful */ |
61 | | mask_t gf_eq(const gf x, const gf y); |
62 | | mask_t gf_lobit(const gf x); |
63 | | mask_t gf_hibit(const gf x); |
64 | | |
65 | | void gf_serialize(uint8_t serial[SER_BYTES], const gf x, int with_highbit); |
66 | | mask_t gf_deserialize(gf x, const uint8_t serial[SER_BYTES], int with_hibit, |
67 | | uint8_t hi_nmask); |
68 | | |
69 | | # include "f_impl.h" /* Bring in the inline implementations */ |
70 | | |
71 | 7.42k | # define LIMBPERM(i) (i) |
72 | 2.17k | # define LIMB_MASK(i) (((1)<<LIMB_PLACE_VALUE(i))-1) |
73 | | |
74 | | static const gf ZERO = {{{0}}}, ONE = {{{1}}}; |
75 | | |
76 | | /* Square x, n times. */ |
77 | | static ossl_inline void gf_sqrn(gf_s * RESTRICT y, const gf x, int n) |
78 | 224 | { |
79 | 224 | gf tmp; |
80 | | |
81 | 224 | assert(n > 0); |
82 | 224 | if (n & 1) { |
83 | 196 | gf_sqr(y, x); |
84 | 196 | n--; |
85 | 196 | } else { |
86 | 28 | gf_sqr(tmp, x); |
87 | 28 | gf_sqr(y, tmp); |
88 | 28 | n -= 2; |
89 | 28 | } |
90 | 6.27k | for (; n; n -= 2) { |
91 | 6.04k | gf_sqr(tmp, y); |
92 | 6.04k | gf_sqr(y, tmp); |
93 | 6.04k | } |
94 | 224 | } Unexecuted instantiation: curve448.c:gf_sqrn Unexecuted instantiation: curve448_tables.c:gf_sqrn Unexecuted instantiation: eddsa.c:gf_sqrn Line | Count | Source | 78 | 224 | { | 79 | 224 | gf tmp; | 80 | | | 81 | 224 | assert(n > 0); | 82 | 224 | if (n & 1) { | 83 | 196 | gf_sqr(y, x); | 84 | 196 | n--; | 85 | 196 | } else { | 86 | 28 | gf_sqr(tmp, x); | 87 | 28 | gf_sqr(y, tmp); | 88 | 28 | n -= 2; | 89 | 28 | } | 90 | 6.27k | for (; n; n -= 2) { | 91 | 6.04k | gf_sqr(tmp, y); | 92 | 6.04k | gf_sqr(y, tmp); | 93 | 6.04k | } | 94 | 224 | } |
Unexecuted instantiation: scalar.c:gf_sqrn Unexecuted instantiation: f_impl.c:gf_sqrn |
95 | | |
96 | 8.90k | # define gf_add_nr gf_add_RAW |
97 | | |
98 | | /* Subtract mod p. Bias by 2 and don't reduce */ |
99 | | static ossl_inline void gf_sub_nr(gf c, const gf a, const gf b) |
100 | 7.95k | { |
101 | 7.95k | gf_sub_RAW(c, a, b); |
102 | 7.95k | gf_bias(c, 2); |
103 | 7.95k | if (GF_HEADROOM < 3) |
104 | 7.95k | gf_weak_reduce(c); |
105 | 7.95k | } Line | Count | Source | 100 | 7.95k | { | 101 | 7.95k | gf_sub_RAW(c, a, b); | 102 | 7.95k | gf_bias(c, 2); | 103 | 7.95k | if (GF_HEADROOM < 3) | 104 | 7.95k | gf_weak_reduce(c); | 105 | 7.95k | } |
Unexecuted instantiation: curve448_tables.c:gf_sub_nr Unexecuted instantiation: eddsa.c:gf_sub_nr Unexecuted instantiation: f_generic.c:gf_sub_nr Unexecuted instantiation: scalar.c:gf_sub_nr Unexecuted instantiation: f_impl.c:gf_sub_nr |
106 | | |
107 | | /* Subtract mod p. Bias by amt but don't reduce. */ |
108 | | static ossl_inline void gf_subx_nr(gf c, const gf a, const gf b, int amt) |
109 | 952 | { |
110 | 952 | gf_sub_RAW(c, a, b); |
111 | 952 | gf_bias(c, amt); |
112 | 952 | if (GF_HEADROOM < amt + 1) |
113 | 952 | gf_weak_reduce(c); |
114 | 952 | } Line | Count | Source | 109 | 952 | { | 110 | 952 | gf_sub_RAW(c, a, b); | 111 | 952 | gf_bias(c, amt); | 112 | 952 | if (GF_HEADROOM < amt + 1) | 113 | 952 | gf_weak_reduce(c); | 114 | 952 | } |
Unexecuted instantiation: curve448_tables.c:gf_subx_nr Unexecuted instantiation: eddsa.c:gf_subx_nr Unexecuted instantiation: f_generic.c:gf_subx_nr Unexecuted instantiation: scalar.c:gf_subx_nr Unexecuted instantiation: f_impl.c:gf_subx_nr |
115 | | |
116 | | /* Mul by signed int. Not constant-time WRT the sign of that int. */ |
117 | | static ossl_inline void gf_mulw(gf c, const gf a, int32_t w) |
118 | 0 | { |
119 | 0 | if (w > 0) { |
120 | 0 | gf_mulw_unsigned(c, a, w); |
121 | 0 | } else { |
122 | 0 | gf_mulw_unsigned(c, a, -w); |
123 | 0 | gf_sub(c, ZERO, c); |
124 | 0 | } |
125 | 0 | } Unexecuted instantiation: curve448.c:gf_mulw Unexecuted instantiation: curve448_tables.c:gf_mulw Unexecuted instantiation: eddsa.c:gf_mulw Unexecuted instantiation: f_generic.c:gf_mulw Unexecuted instantiation: scalar.c:gf_mulw Unexecuted instantiation: f_impl.c:gf_mulw |
126 | | |
127 | | /* Constant time, x = is_z ? z : y */ |
128 | | static ossl_inline void gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z) |
129 | 2.52k | { |
130 | 2.52k | size_t i; |
131 | | |
132 | 42.8k | for (i = 0; i < NLIMBS; i++) { |
133 | 40.3k | #if ARCH_WORD_BITS == 32 |
134 | 40.3k | x[0].limb[i] = constant_time_select_32(is_z, z[0].limb[i], |
135 | 40.3k | y[0].limb[i]); |
136 | | #else |
137 | | /* Must be 64 bit */ |
138 | | x[0].limb[i] = constant_time_select_64(is_z, z[0].limb[i], |
139 | | y[0].limb[i]); |
140 | | #endif |
141 | 40.3k | } |
142 | 2.52k | } Line | Count | Source | 129 | 2.52k | { | 130 | 2.52k | size_t i; | 131 | | | 132 | 42.8k | for (i = 0; i < NLIMBS; i++) { | 133 | 40.3k | #if ARCH_WORD_BITS == 32 | 134 | 40.3k | x[0].limb[i] = constant_time_select_32(is_z, z[0].limb[i], | 135 | 40.3k | y[0].limb[i]); | 136 | | #else | 137 | | /* Must be 64 bit */ | 138 | | x[0].limb[i] = constant_time_select_64(is_z, z[0].limb[i], | 139 | | y[0].limb[i]); | 140 | | #endif | 141 | 40.3k | } | 142 | 2.52k | } |
Unexecuted instantiation: curve448_tables.c:gf_cond_sel Unexecuted instantiation: eddsa.c:gf_cond_sel Unexecuted instantiation: f_generic.c:gf_cond_sel Unexecuted instantiation: scalar.c:gf_cond_sel Unexecuted instantiation: f_impl.c:gf_cond_sel |
143 | | |
144 | | /* Constant time, if (neg) x=-x; */ |
145 | | static ossl_inline void gf_cond_neg(gf x, mask_t neg) |
146 | 2.52k | { |
147 | 2.52k | gf y; |
148 | | |
149 | 2.52k | gf_sub(y, ZERO, x); |
150 | 2.52k | gf_cond_sel(x, x, y, neg); |
151 | 2.52k | } Line | Count | Source | 146 | 2.52k | { | 147 | 2.52k | gf y; | 148 | | | 149 | 2.52k | gf_sub(y, ZERO, x); | 150 | 2.52k | gf_cond_sel(x, x, y, neg); | 151 | 2.52k | } |
Unexecuted instantiation: curve448_tables.c:gf_cond_neg Unexecuted instantiation: eddsa.c:gf_cond_neg Unexecuted instantiation: f_generic.c:gf_cond_neg Unexecuted instantiation: scalar.c:gf_cond_neg Unexecuted instantiation: f_impl.c:gf_cond_neg |
152 | | |
153 | | /* Constant time, if (swap) (x,y) = (y,x); */ |
154 | | static ossl_inline void gf_cond_swap(gf x, gf_s * RESTRICT y, mask_t swap) |
155 | 2.52k | { |
156 | 2.52k | size_t i; |
157 | | |
158 | 42.8k | for (i = 0; i < NLIMBS; i++) { |
159 | 40.3k | #if ARCH_WORD_BITS == 32 |
160 | 40.3k | constant_time_cond_swap_32(swap, &(x[0].limb[i]), &(y->limb[i])); |
161 | | #else |
162 | | /* Must be 64 bit */ |
163 | | constant_time_cond_swap_64(swap, &(x[0].limb[i]), &(y->limb[i])); |
164 | | #endif |
165 | 40.3k | } |
166 | 2.52k | } Line | Count | Source | 155 | 2.52k | { | 156 | 2.52k | size_t i; | 157 | | | 158 | 42.8k | for (i = 0; i < NLIMBS; i++) { | 159 | 40.3k | #if ARCH_WORD_BITS == 32 | 160 | 40.3k | constant_time_cond_swap_32(swap, &(x[0].limb[i]), &(y->limb[i])); | 161 | | #else | 162 | | /* Must be 64 bit */ | 163 | | constant_time_cond_swap_64(swap, &(x[0].limb[i]), &(y->limb[i])); | 164 | | #endif | 165 | 40.3k | } | 166 | 2.52k | } |
Unexecuted instantiation: curve448_tables.c:gf_cond_swap Unexecuted instantiation: eddsa.c:gf_cond_swap Unexecuted instantiation: f_generic.c:gf_cond_swap Unexecuted instantiation: scalar.c:gf_cond_swap Unexecuted instantiation: f_impl.c:gf_cond_swap |
167 | | |
168 | | #endif /* OSSL_CRYPTO_EC_CURVE448_FIELD_H */ |