/src/openssl/crypto/ec/curve448/field.h

Source (jump to first uncovered line)
/*
 * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
 * Copyright 2014 Cryptography Research, Inc.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 *
 * Originally written by Mike Hamburg
 */

#ifndef HEADER_FIELD_H
# define HEADER_FIELD_H

# include "internal/constant_time_locl.h"
# include <string.h>
# include <assert.h>
# include "word.h"

# define NLIMBS (64/sizeof(word_t))
# define X_SER_BYTES 56
# define SER_BYTES 56

# if defined(__GNUC__) || defined(__clang__)
#  define INLINE_UNUSED __inline__ __attribute__((__unused__,__always_inline__))
#  define RESTRICT __restrict__
#  define ALIGNED __attribute__((__aligned__(16)))
# else
#  define INLINE_UNUSED ossl_inline
#  define RESTRICT
#  define ALIGNED
# endif

typedef struct gf_s {
    word_t limb[NLIMBS];
} ALIGNED gf_s, gf[1];

/* RFC 7748 support */
# define X_PUBLIC_BYTES  X_SER_BYTES
# define X_PRIVATE_BYTES X_PUBLIC_BYTES
# define X_PRIVATE_BITS  448

static INLINE_UNUSED void gf_copy(gf out, const gf a)
{
    *out = *a;
}

static INLINE_UNUSED void gf_add_RAW(gf out, const gf a, const gf b);
static INLINE_UNUSED void gf_sub_RAW(gf out, const gf a, const gf b);
static INLINE_UNUSED void gf_bias(gf inout, int amount);
static INLINE_UNUSED void gf_weak_reduce(gf inout);

void gf_strong_reduce(gf inout);
void gf_add(gf out, const gf a, const gf b);
void gf_sub(gf out, const gf a, const gf b);
void gf_mul(gf_s * RESTRICT out, const gf a, const gf b);
void gf_mulw_unsigned(gf_s * RESTRICT out, const gf a, uint32_t b);
void gf_sqr(gf_s * RESTRICT out, const gf a);
mask_t gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0.  Return true if successful */
mask_t gf_eq(const gf x, const gf y);
mask_t gf_lobit(const gf x);
mask_t gf_hibit(const gf x);

void gf_serialize(uint8_t *serial, const gf x, int with_highbit);
mask_t gf_deserialize(gf x, const uint8_t serial[SER_BYTES], int with_hibit,
                      uint8_t hi_nmask);

# include "f_impl.h"            /* Bring in the inline implementations */

# define LIMBPERM(i) (i)
# define LIMB_MASK(i) (((1)<<LIMB_PLACE_VALUE(i))-1)

static const gf ZERO = {{{0}}}, ONE = {{{1}}};

/* Square x, n times. */
static ossl_inline void gf_sqrn(gf_s * RESTRICT y, const gf x, int n)
{
    gf tmp;

    assert(n > 0);
    if (n & 1) {
        gf_sqr(y, x);
        n--;
    } else {
        gf_sqr(tmp, x);
        gf_sqr(y, tmp);
        n -= 2;
    }
    for (; n; n -= 2) {
        gf_sqr(tmp, y);
        gf_sqr(y, tmp);
    }
}

# define gf_add_nr gf_add_RAW

/* Subtract mod p.  Bias by 2 and don't reduce  */
static ossl_inline void gf_sub_nr(gf c, const gf a, const gf b)
{
    gf_sub_RAW(c, a, b);
    gf_bias(c, 2);
    if (GF_HEADROOM < 3)
        gf_weak_reduce(c);
}

/* Subtract mod p. Bias by amt but don't reduce.  */
static ossl_inline void gf_subx_nr(gf c, const gf a, const gf b, int amt)
{
    gf_sub_RAW(c, a, b);
    gf_bias(c, amt);
    if (GF_HEADROOM < amt + 1)
        gf_weak_reduce(c);
}

/* Mul by signed int.  Not constant-time WRT the sign of that int. */
static ossl_inline void gf_mulw(gf c, const gf a, int32_t w)
{
    if (w > 0) {
        gf_mulw_unsigned(c, a, w);
    } else {
        gf_mulw_unsigned(c, a, -w);
        gf_sub(c, ZERO, c);
    }
}

/* Constant time, x = is_z ? z : y */
static ossl_inline void gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z)
{
    size_t i;

    for (i = 0; i < NLIMBS; i++) {
#if ARCH_WORD_BITS == 32
        x[0].limb[i] = constant_time_select_32(is_z, z[0].limb[i],
                                               y[0].limb[i]);
#else
        /* Must be 64 bit */
        x[0].limb[i] = constant_time_select_64(is_z, z[0].limb[i],
                                               y[0].limb[i]);
#endif
    }
}

/* Constant time, if (neg) x=-x; */
static ossl_inline void gf_cond_neg(gf x, mask_t neg)
{
    gf y;

    gf_sub(y, ZERO, x);
    gf_cond_sel(x, x, y, neg);
}

/* Constant time, if (swap) (x,y) = (y,x); */
static ossl_inline void gf_cond_swap(gf x, gf_s * RESTRICT y, mask_t swap)
{
    size_t i;

    for (i = 0; i < NLIMBS; i++) {
#if ARCH_WORD_BITS == 32
        constant_time_cond_swap_32(swap, &(x[0].limb[i]), &(y->limb[i]));
#else
        /* Must be 64 bit */
        constant_time_cond_swap_64(swap, &(x[0].limb[i]), &(y->limb[i]));
#endif
    }
}

#endif                          /* HEADER_FIELD_H */

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
3		* Copyright 2014 Cryptography Research, Inc.
4		*
5		* Licensed under the OpenSSL license (the "License"). You may not use
6		* this file except in compliance with the License. You can obtain a copy
7		* in the file LICENSE in the source distribution or at
8		* https://www.openssl.org/source/license.html
9		*
10		* Originally written by Mike Hamburg
11		*/
12
13		#ifndef HEADER_FIELD_H
14		# define HEADER_FIELD_H
15
16		# include "internal/constant_time_locl.h"
17		# include <string.h>
18		# include <assert.h>
19		# include "word.h"
20
21	0	# define NLIMBS (64/sizeof(word_t))
22	0	# define X_SER_BYTES 56
23	0	# define SER_BYTES 56
24
25		# if defined(__GNUC__) \|\| defined(__clang__)
26		# define INLINE_UNUSED __inline__ __attribute__((__unused__,__always_inline__))
27		# define RESTRICT __restrict__
28		# define ALIGNED __attribute__((__aligned__(16)))
29		# else
30		# define INLINE_UNUSED ossl_inline
31		# define RESTRICT
32		# define ALIGNED
33		# endif
34
35		typedef struct gf_s {
36		word_t limb[NLIMBS];
37		} ALIGNED gf_s, gf[1];
38
39		/* RFC 7748 support */
40	0	# define X_PUBLIC_BYTES X_SER_BYTES
41	0	# define X_PRIVATE_BYTES X_PUBLIC_BYTES
42	0	# define X_PRIVATE_BITS 448
43
44		static INLINE_UNUSED void gf_copy(gf out, const gf a)
45	0	{
46	0	out = a;
47	0	} Unexecuted instantiation: curve448.c:gf_copy Unexecuted instantiation: curve448_tables.c:gf_copy Unexecuted instantiation: eddsa.c:gf_copy Unexecuted instantiation: f_generic.c:gf_copy Unexecuted instantiation: scalar.c:gf_copy Unexecuted instantiation: f_impl.c:gf_copy
48
49		static INLINE_UNUSED void gf_add_RAW(gf out, const gf a, const gf b);
50		static INLINE_UNUSED void gf_sub_RAW(gf out, const gf a, const gf b);
51		static INLINE_UNUSED void gf_bias(gf inout, int amount);
52		static INLINE_UNUSED void gf_weak_reduce(gf inout);
53
54		void gf_strong_reduce(gf inout);
55		void gf_add(gf out, const gf a, const gf b);
56		void gf_sub(gf out, const gf a, const gf b);
57		void gf_mul(gf_s * RESTRICT out, const gf a, const gf b);
58		void gf_mulw_unsigned(gf_s * RESTRICT out, const gf a, uint32_t b);
59		void gf_sqr(gf_s * RESTRICT out, const gf a);
60		mask_t gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0. Return true if successful */
61		mask_t gf_eq(const gf x, const gf y);
62		mask_t gf_lobit(const gf x);
63		mask_t gf_hibit(const gf x);
64
65		void gf_serialize(uint8_t *serial, const gf x, int with_highbit);
66		mask_t gf_deserialize(gf x, const uint8_t serial[SER_BYTES], int with_hibit,
67		uint8_t hi_nmask);
68
69		# include "f_impl.h" /* Bring in the inline implementations */
70
71	0	# define LIMBPERM(i) (i)
72	0	# define LIMB_MASK(i) (((1)<<LIMB_PLACE_VALUE(i))-1)
73
74		static const gf ZERO = {{{0}}}, ONE = {{{1}}};
75
76		/* Square x, n times. */
77		static ossl_inline void gf_sqrn(gf_s * RESTRICT y, const gf x, int n)
78	0	{
79	0	gf tmp;
80	0
81	0	assert(n > 0);
82	0	if (n & 1) {
83	0	gf_sqr(y, x);
84	0	n--;
85	0	} else {
86	0	gf_sqr(tmp, x);
87	0	gf_sqr(y, tmp);
88	0	n -= 2;
89	0	}
90	0	for (; n; n -= 2) {
91	0	gf_sqr(tmp, y);
92	0	gf_sqr(y, tmp);
93	0	}
94	0	} Unexecuted instantiation: curve448.c:gf_sqrn Unexecuted instantiation: curve448_tables.c:gf_sqrn Unexecuted instantiation: eddsa.c:gf_sqrn Unexecuted instantiation: f_generic.c:gf_sqrn Unexecuted instantiation: scalar.c:gf_sqrn Unexecuted instantiation: f_impl.c:gf_sqrn
95
96	0	# define gf_add_nr gf_add_RAW
97
98		/* Subtract mod p. Bias by 2 and don't reduce */
99		static ossl_inline void gf_sub_nr(gf c, const gf a, const gf b)
100	0	{
101	0	gf_sub_RAW(c, a, b);
102	0	gf_bias(c, 2);
103	0	if (GF_HEADROOM < 3)
104	0	gf_weak_reduce(c);
105	0	} Unexecuted instantiation: curve448.c:gf_sub_nr Unexecuted instantiation: curve448_tables.c:gf_sub_nr Unexecuted instantiation: eddsa.c:gf_sub_nr Unexecuted instantiation: f_generic.c:gf_sub_nr Unexecuted instantiation: scalar.c:gf_sub_nr Unexecuted instantiation: f_impl.c:gf_sub_nr
106
107		/* Subtract mod p. Bias by amt but don't reduce. */
108		static ossl_inline void gf_subx_nr(gf c, const gf a, const gf b, int amt)
109	0	{
110	0	gf_sub_RAW(c, a, b);
111	0	gf_bias(c, amt);
112	0	if (GF_HEADROOM < amt + 1)
113	0	gf_weak_reduce(c);
114	0	} Unexecuted instantiation: curve448.c:gf_subx_nr Unexecuted instantiation: curve448_tables.c:gf_subx_nr Unexecuted instantiation: eddsa.c:gf_subx_nr Unexecuted instantiation: f_generic.c:gf_subx_nr Unexecuted instantiation: scalar.c:gf_subx_nr Unexecuted instantiation: f_impl.c:gf_subx_nr
115
116		/* Mul by signed int. Not constant-time WRT the sign of that int. */
117		static ossl_inline void gf_mulw(gf c, const gf a, int32_t w)
118	0	{
119	0	if (w > 0) {
120	0	gf_mulw_unsigned(c, a, w);
121	0	} else {
122	0	gf_mulw_unsigned(c, a, -w);
123	0	gf_sub(c, ZERO, c);
124	0	}
125	0	} Unexecuted instantiation: curve448.c:gf_mulw Unexecuted instantiation: curve448_tables.c:gf_mulw Unexecuted instantiation: eddsa.c:gf_mulw Unexecuted instantiation: f_generic.c:gf_mulw Unexecuted instantiation: scalar.c:gf_mulw Unexecuted instantiation: f_impl.c:gf_mulw
126
127		/* Constant time, x = is_z ? z : y */
128		static ossl_inline void gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z)
129	0	{
130	0	size_t i;
131	0
132	0	for (i = 0; i < NLIMBS; i++) {
133	0	#if ARCH_WORD_BITS == 32
134	0	x[0].limb[i] = constant_time_select_32(is_z, z[0].limb[i],
135	0	y[0].limb[i]);
136		#else
137		/* Must be 64 bit */
138		x[0].limb[i] = constant_time_select_64(is_z, z[0].limb[i],
139		y[0].limb[i]);
140		#endif
141		}
142	0	} Unexecuted instantiation: curve448.c:gf_cond_sel Unexecuted instantiation: curve448_tables.c:gf_cond_sel Unexecuted instantiation: eddsa.c:gf_cond_sel Unexecuted instantiation: f_generic.c:gf_cond_sel Unexecuted instantiation: scalar.c:gf_cond_sel Unexecuted instantiation: f_impl.c:gf_cond_sel
143
144		/* Constant time, if (neg) x=-x; */
145		static ossl_inline void gf_cond_neg(gf x, mask_t neg)
146	0	{
147	0	gf y;
148	0
149	0	gf_sub(y, ZERO, x);
150	0	gf_cond_sel(x, x, y, neg);
151	0	} Unexecuted instantiation: curve448.c:gf_cond_neg Unexecuted instantiation: curve448_tables.c:gf_cond_neg Unexecuted instantiation: eddsa.c:gf_cond_neg Unexecuted instantiation: f_generic.c:gf_cond_neg Unexecuted instantiation: scalar.c:gf_cond_neg Unexecuted instantiation: f_impl.c:gf_cond_neg
152
153		/* Constant time, if (swap) (x,y) = (y,x); */
154		static ossl_inline void gf_cond_swap(gf x, gf_s * RESTRICT y, mask_t swap)
155	0	{
156	0	size_t i;
157	0
158	0	for (i = 0; i < NLIMBS; i++) {
159	0	#if ARCH_WORD_BITS == 32
160	0	constant_time_cond_swap_32(swap, &(x[0].limb[i]), &(y->limb[i]));
161		#else
162		/* Must be 64 bit */
163		constant_time_cond_swap_64(swap, &(x[0].limb[i]), &(y->limb[i]));
164		#endif
165		}
166	0	} Unexecuted instantiation: curve448.c:gf_cond_swap Unexecuted instantiation: curve448_tables.c:gf_cond_swap Unexecuted instantiation: eddsa.c:gf_cond_swap Unexecuted instantiation: f_generic.c:gf_cond_swap Unexecuted instantiation: scalar.c:gf_cond_swap Unexecuted instantiation: f_impl.c:gf_cond_swap
167
168		#endif /* HEADER_FIELD_H */

Coverage Report

Created: 2018-08-29 13:53