mirror of
https://boringssl.googlesource.com/boringssl
synced 2026-07-21 14:43:51 +00:00
Revert "Replace most of P-256 assembly code with C"
This reverts commitba76be9c75. This seems to have caused significant performance regressions in some configurations. See b/525050645 (internal). It was not a clean revert due to other changes that went in in the meantime. I had to revert the following other CLs: *85a291c0ef*28950bf42f*6bec274e2a*66370b6b93Then I resolved merge conflicts with the changes to put a symbol at the start of all the .rodata sections, and then reapplied28950bf42fand6bec274e2a, but to where the code used to be. I also kept the changes to: - crypto/ecdh/ecdh_test.cc - crypto/internal.h - third_party/fiat/bedrock_unverified_platform.c.inc Bug: 525050645 Change-Id: I1a016785dfa3da57ac07d26dd034a67d0bc14566 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/97607 Reviewed-by: Adam Langley <agl@google.com> Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> Commit-Queue: David Benjamin <davidben@google.com>
This commit is contained in:
David Benjamin
committed by
boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com
boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com
parent
ba1fa13f7e
commit
b11b2c5a7f
+5
-2
@@ -62,6 +62,7 @@
|
||||
"crypto/fipsmodule/ec/ec_montgomery.cc.inc",
|
||||
"crypto/fipsmodule/ec/felem.cc.inc",
|
||||
"crypto/fipsmodule/ec/oct.cc.inc",
|
||||
"crypto/fipsmodule/ec/p256-nistz.cc.inc",
|
||||
"crypto/fipsmodule/ec/p256.cc.inc",
|
||||
"crypto/fipsmodule/ec/scalar.cc.inc",
|
||||
"crypto/fipsmodule/ec/simple.cc.inc",
|
||||
@@ -524,8 +525,8 @@
|
||||
"crypto/fipsmodule/digest/md32_common.h",
|
||||
"crypto/fipsmodule/ec/builtin_curves.h",
|
||||
"crypto/fipsmodule/ec/internal.h",
|
||||
"crypto/fipsmodule/ec/p256_internal.h",
|
||||
"crypto/fipsmodule/ec/p256-nistz-table.h",
|
||||
"crypto/fipsmodule/ec/p256-nistz.h",
|
||||
"crypto/fipsmodule/ec/p256_table.h",
|
||||
"crypto/fipsmodule/ecdsa/internal.h",
|
||||
"crypto/fipsmodule/entropy/internal.h",
|
||||
@@ -567,6 +568,7 @@
|
||||
"third_party/fiat/p256_32.h",
|
||||
"third_party/fiat/p256_64.h",
|
||||
"third_party/fiat/p256_64_msvc.h",
|
||||
"third_party/fiat/p256_field.c.inc",
|
||||
"third_party/fiat/p256_field_32.br.c.inc",
|
||||
"third_party/fiat/p256_field_64.br.c.inc",
|
||||
"third_party/fiat/p256_point.br.c.inc",
|
||||
@@ -852,6 +854,7 @@
|
||||
"crypto/fipsmodule/bn/bn_test.cc",
|
||||
"crypto/fipsmodule/cmac/cmac_test.cc",
|
||||
"crypto/fipsmodule/ec/ec_test.cc",
|
||||
"crypto/fipsmodule/ec/p256-nistz_test.cc",
|
||||
"crypto/fipsmodule/ec/p256_test.cc",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_test.cc",
|
||||
"crypto/fipsmodule/entropy/jitter_test.cc",
|
||||
@@ -910,7 +913,7 @@
|
||||
"crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt",
|
||||
"crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt",
|
||||
"crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt",
|
||||
"crypto/fipsmodule/ec/p256-tests.txt",
|
||||
"crypto/fipsmodule/ec/p256-nistz_tests.txt",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt",
|
||||
"crypto/fipsmodule/keccak/keccak_tests.txt",
|
||||
|
||||
@@ -87,6 +87,7 @@ OPENSSL_CLANG_PRAGMA("clang diagnostic ignored \"-Wheader-hygiene\"")
|
||||
#include "ec/ec_montgomery.cc.inc"
|
||||
#include "ec/felem.cc.inc"
|
||||
#include "ec/oct.cc.inc"
|
||||
#include "ec/p256-nistz.cc.inc"
|
||||
#include "ec/p256.cc.inc"
|
||||
#include "ec/scalar.cc.inc"
|
||||
#include "ec/simple.cc.inc"
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -99,7 +99,13 @@ DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p256) {
|
||||
ec_group_init_static_mont(&out->order, std::size(kP256Order), kP256Order,
|
||||
kP256OrderRR, kP256OrderN0);
|
||||
|
||||
#if !defined(OPENSSL_NO_ASM) && \
|
||||
(defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) && \
|
||||
!defined(OPENSSL_SMALL)
|
||||
out->meth = EC_GFp_nistz256_method();
|
||||
#else
|
||||
out->meth = EC_GFp_nistp256_method();
|
||||
#endif
|
||||
out->generator.group = out;
|
||||
OPENSSL_memcpy(out->generator.raw.X.words, kP256MontGX, sizeof(kP256MontGX));
|
||||
OPENSSL_memcpy(out->generator.raw.Y.words, kP256MontGY, sizeof(kP256MontGY));
|
||||
@@ -762,7 +768,7 @@ int bssl::ec_point_mul_scalar(const EC_GROUP *group, EC_JACOBIAN *r,
|
||||
|
||||
// Check the result is on the curve to defend against fault attacks or bugs.
|
||||
// This has negligible cost compared to the multiplication.
|
||||
if (!constant_time_declassify_int(ec_GFp_simple_is_on_curve(group, r))) {
|
||||
if (!ec_GFp_simple_is_on_curve(group, r)) {
|
||||
OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -666,6 +666,10 @@ void ec_GFp_nistp_recode_scalar_bits(crypto_word_t *sign, crypto_word_t *digit,
|
||||
|
||||
const EC_METHOD *EC_GFp_nistp256_method();
|
||||
|
||||
// EC_GFp_nistz256_method is a GFp method using montgomery multiplication, with
|
||||
// x86-64 optimized P256. See http://eprint.iacr.org/2013/816.
|
||||
const EC_METHOD *EC_GFp_nistz256_method();
|
||||
|
||||
// An EC_WRAPPED_SCALAR is an `EC_SCALAR` with a parallel `BIGNUM`
|
||||
// representation. It exists to support the `EC_KEY_get0_private_key` API.
|
||||
typedef struct {
|
||||
|
||||
@@ -0,0 +1,740 @@
|
||||
// Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
// Copyright (c) 2014, Intel Corporation. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// https://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
// Originally written by Shay Gueron (1, 2), and Vlad Krasnov (1)
|
||||
// (1) Intel Corporation, Israel Development Center, Haifa, Israel
|
||||
// (2) University of Haifa, Israel
|
||||
//
|
||||
// Reference:
|
||||
// S.Gueron and V.Krasnov, "Fast Prime Field Elliptic Curve Cryptography with
|
||||
// 256 Bit Primes"
|
||||
|
||||
#include <openssl/ec.h>
|
||||
|
||||
#include <assert.h>
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/crypto.h>
|
||||
#include <openssl/err.h>
|
||||
|
||||
#include "../../internal.h"
|
||||
#include "../bn/internal.h"
|
||||
#include "../delocate.h"
|
||||
#include "internal.h"
|
||||
#include "p256-nistz.h"
|
||||
|
||||
|
||||
using namespace bssl;
|
||||
|
||||
#if !defined(OPENSSL_NO_ASM) && \
|
||||
(defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) && \
|
||||
!defined(OPENSSL_SMALL)
|
||||
|
||||
typedef P256_POINT_AFFINE PRECOMP256_ROW[64];
|
||||
|
||||
// One converted into the Montgomery domain
|
||||
static const BN_ULONG ONE_MONT[P256_LIMBS] = {
|
||||
TOBN(0x00000000, 0x00000001),
|
||||
TOBN(0xffffffff, 0x00000000),
|
||||
TOBN(0xffffffff, 0xffffffff),
|
||||
TOBN(0x00000000, 0xfffffffe),
|
||||
};
|
||||
|
||||
// Precomputed tables for the default generator
|
||||
#include "p256-nistz-table.h"
|
||||
|
||||
// Recode window to a signed digit, see `ec_GFp_nistp_recode_scalar_bits` in
|
||||
// util.c for details
|
||||
static crypto_word_t booth_recode_w5(crypto_word_t in) {
|
||||
crypto_word_t s, d;
|
||||
|
||||
s = ~((in >> 5) - 1);
|
||||
d = (1 << 6) - in - 1;
|
||||
d = (d & s) | (in & ~s);
|
||||
d = (d >> 1) + (d & 1);
|
||||
|
||||
return (d << 1) + (s & 1);
|
||||
}
|
||||
|
||||
static crypto_word_t booth_recode_w7(crypto_word_t in) {
|
||||
crypto_word_t s, d;
|
||||
|
||||
s = ~((in >> 7) - 1);
|
||||
d = (1 << 8) - in - 1;
|
||||
d = (d & s) | (in & ~s);
|
||||
d = (d >> 1) + (d & 1);
|
||||
|
||||
return (d << 1) + (s & 1);
|
||||
}
|
||||
|
||||
// copy_conditional copies `src` to `dst` if `move` is one and leaves it as-is
|
||||
// if `move` is zero.
|
||||
//
|
||||
// WARNING: this breaks the usual convention of constant-time functions
|
||||
// returning masks.
|
||||
static void copy_conditional(BN_ULONG dst[P256_LIMBS],
|
||||
const BN_ULONG src[P256_LIMBS], BN_ULONG move) {
|
||||
BN_ULONG mask1 = ((BN_ULONG)0) - move;
|
||||
BN_ULONG mask2 = ~mask1;
|
||||
|
||||
dst[0] = (src[0] & mask1) ^ (dst[0] & mask2);
|
||||
dst[1] = (src[1] & mask1) ^ (dst[1] & mask2);
|
||||
dst[2] = (src[2] & mask1) ^ (dst[2] & mask2);
|
||||
dst[3] = (src[3] & mask1) ^ (dst[3] & mask2);
|
||||
if (P256_LIMBS == 8) {
|
||||
dst[4] = (src[4] & mask1) ^ (dst[4] & mask2);
|
||||
dst[5] = (src[5] & mask1) ^ (dst[5] & mask2);
|
||||
dst[6] = (src[6] & mask1) ^ (dst[6] & mask2);
|
||||
dst[7] = (src[7] & mask1) ^ (dst[7] & mask2);
|
||||
}
|
||||
}
|
||||
|
||||
// is_not_zero returns one iff in != 0 and zero otherwise.
|
||||
//
|
||||
// WARNING: this breaks the usual convention of constant-time functions
|
||||
// returning masks.
|
||||
//
|
||||
// (define-fun is_not_zero ((in (_ BitVec 64))) (_ BitVec 64)
|
||||
// (bvlshr (bvor in (bvsub #x0000000000000000 in)) #x000000000000003f)
|
||||
// )
|
||||
//
|
||||
// (declare-fun x () (_ BitVec 64))
|
||||
//
|
||||
// (assert (and (= x #x0000000000000000) (= (is_not_zero x)
|
||||
// #x0000000000000001))) (check-sat)
|
||||
//
|
||||
// (assert (and (not (= x #x0000000000000000)) (= (is_not_zero x)
|
||||
// #x0000000000000000))) (check-sat)
|
||||
//
|
||||
static BN_ULONG is_not_zero(BN_ULONG in) {
|
||||
in |= (0 - in);
|
||||
in >>= BN_BITS2 - 1;
|
||||
return in;
|
||||
}
|
||||
|
||||
#if defined(OPENSSL_X86_64)
|
||||
// Dispatch between CPU variations. The "_adx" suffixed functions use MULX in
|
||||
// addition to ADCX/ADOX. MULX is part of BMI2, not ADX, so we must check both
|
||||
// capabilities.
|
||||
static void ecp_nistz256_mul_mont(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG b[P256_LIMBS]) {
|
||||
if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
|
||||
ecp_nistz256_mul_mont_adx(res, a, b);
|
||||
} else {
|
||||
ecp_nistz256_mul_mont_nohw(res, a, b);
|
||||
}
|
||||
}
|
||||
|
||||
static void ecp_nistz256_sqr_mont(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS]) {
|
||||
if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
|
||||
ecp_nistz256_sqr_mont_adx(res, a);
|
||||
} else {
|
||||
ecp_nistz256_sqr_mont_nohw(res, a);
|
||||
}
|
||||
}
|
||||
|
||||
static void ecp_nistz256_ord_mul_mont(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG b[P256_LIMBS]) {
|
||||
if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
|
||||
ecp_nistz256_ord_mul_mont_adx(res, a, b);
|
||||
} else {
|
||||
ecp_nistz256_ord_mul_mont_nohw(res, a, b);
|
||||
}
|
||||
}
|
||||
|
||||
static void ecp_nistz256_ord_sqr_mont(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS],
|
||||
BN_ULONG rep) {
|
||||
if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
|
||||
ecp_nistz256_ord_sqr_mont_adx(res, a, rep);
|
||||
} else {
|
||||
ecp_nistz256_ord_sqr_mont_nohw(res, a, rep);
|
||||
}
|
||||
}
|
||||
|
||||
static void ecp_nistz256_select_w5(P256_POINT *val, const P256_POINT in_t[16],
|
||||
int index) {
|
||||
if (CRYPTO_is_AVX2_capable()) {
|
||||
ecp_nistz256_select_w5_avx2(val, in_t, index);
|
||||
} else {
|
||||
ecp_nistz256_select_w5_nohw(val, in_t, index);
|
||||
}
|
||||
}
|
||||
|
||||
static void ecp_nistz256_select_w7(P256_POINT_AFFINE *val,
|
||||
const P256_POINT_AFFINE in_t[64],
|
||||
int index) {
|
||||
if (CRYPTO_is_AVX2_capable()) {
|
||||
ecp_nistz256_select_w7_avx2(val, in_t, index);
|
||||
} else {
|
||||
ecp_nistz256_select_w7_nohw(val, in_t, index);
|
||||
}
|
||||
}
|
||||
|
||||
static void ecp_nistz256_point_double(P256_POINT *r, const P256_POINT *a) {
|
||||
if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
|
||||
ecp_nistz256_point_double_adx(r, a);
|
||||
} else {
|
||||
ecp_nistz256_point_double_nohw(r, a);
|
||||
}
|
||||
}
|
||||
|
||||
static void ecp_nistz256_point_add(P256_POINT *r, const P256_POINT *a,
|
||||
const P256_POINT *b) {
|
||||
if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
|
||||
ecp_nistz256_point_add_adx(r, a, b);
|
||||
} else {
|
||||
ecp_nistz256_point_add_nohw(r, a, b);
|
||||
}
|
||||
}
|
||||
|
||||
static void ecp_nistz256_point_add_affine(P256_POINT *r, const P256_POINT *a,
|
||||
const P256_POINT_AFFINE *b) {
|
||||
if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
|
||||
ecp_nistz256_point_add_affine_adx(r, a, b);
|
||||
} else {
|
||||
ecp_nistz256_point_add_affine_nohw(r, a, b);
|
||||
}
|
||||
}
|
||||
#endif // OPENSSL_X86_64
|
||||
|
||||
// ecp_nistz256_from_mont sets `res` to `in`, converted from Montgomery domain
|
||||
// by multiplying with 1.
|
||||
static void ecp_nistz256_from_mont(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG in[P256_LIMBS]) {
|
||||
static const BN_ULONG ONE[P256_LIMBS] = {1};
|
||||
ecp_nistz256_mul_mont(res, in, ONE);
|
||||
}
|
||||
|
||||
// ecp_nistz256_mod_inverse_sqr_mont sets `r` to (`in` * 2^-256)^-2 * 2^256 mod
|
||||
// p. That is, `r` is the modular inverse square of `in` for input and output in
|
||||
// the Montgomery domain.
|
||||
static void ecp_nistz256_mod_inverse_sqr_mont(BN_ULONG r[P256_LIMBS],
|
||||
const BN_ULONG in[P256_LIMBS]) {
|
||||
// This implements the addition chain described in
|
||||
// https://briansmith.org/ecc-inversion-addition-chains-01#p256_field_inversion
|
||||
BN_ULONG x2[P256_LIMBS], x3[P256_LIMBS], x6[P256_LIMBS], x12[P256_LIMBS],
|
||||
x15[P256_LIMBS], x30[P256_LIMBS], x32[P256_LIMBS];
|
||||
ecp_nistz256_sqr_mont(x2, in); // 2^2 - 2^1
|
||||
ecp_nistz256_mul_mont(x2, x2, in); // 2^2 - 2^0
|
||||
|
||||
ecp_nistz256_sqr_mont(x3, x2); // 2^3 - 2^1
|
||||
ecp_nistz256_mul_mont(x3, x3, in); // 2^3 - 2^0
|
||||
|
||||
ecp_nistz256_sqr_mont(x6, x3);
|
||||
for (int i = 1; i < 3; i++) {
|
||||
ecp_nistz256_sqr_mont(x6, x6);
|
||||
} // 2^6 - 2^3
|
||||
ecp_nistz256_mul_mont(x6, x6, x3); // 2^6 - 2^0
|
||||
|
||||
ecp_nistz256_sqr_mont(x12, x6);
|
||||
for (int i = 1; i < 6; i++) {
|
||||
ecp_nistz256_sqr_mont(x12, x12);
|
||||
} // 2^12 - 2^6
|
||||
ecp_nistz256_mul_mont(x12, x12, x6); // 2^12 - 2^0
|
||||
|
||||
ecp_nistz256_sqr_mont(x15, x12);
|
||||
for (int i = 1; i < 3; i++) {
|
||||
ecp_nistz256_sqr_mont(x15, x15);
|
||||
} // 2^15 - 2^3
|
||||
ecp_nistz256_mul_mont(x15, x15, x3); // 2^15 - 2^0
|
||||
|
||||
ecp_nistz256_sqr_mont(x30, x15);
|
||||
for (int i = 1; i < 15; i++) {
|
||||
ecp_nistz256_sqr_mont(x30, x30);
|
||||
} // 2^30 - 2^15
|
||||
ecp_nistz256_mul_mont(x30, x30, x15); // 2^30 - 2^0
|
||||
|
||||
ecp_nistz256_sqr_mont(x32, x30);
|
||||
ecp_nistz256_sqr_mont(x32, x32); // 2^32 - 2^2
|
||||
ecp_nistz256_mul_mont(x32, x32, x2); // 2^32 - 2^0
|
||||
|
||||
BN_ULONG ret[P256_LIMBS];
|
||||
ecp_nistz256_sqr_mont(ret, x32);
|
||||
for (int i = 1; i < 31 + 1; i++) {
|
||||
ecp_nistz256_sqr_mont(ret, ret);
|
||||
} // 2^64 - 2^32
|
||||
ecp_nistz256_mul_mont(ret, ret, in); // 2^64 - 2^32 + 2^0
|
||||
|
||||
for (int i = 0; i < 96 + 32; i++) {
|
||||
ecp_nistz256_sqr_mont(ret, ret);
|
||||
} // 2^192 - 2^160 + 2^128
|
||||
ecp_nistz256_mul_mont(ret, ret, x32); // 2^192 - 2^160 + 2^128 + 2^32 - 2^0
|
||||
|
||||
for (int i = 0; i < 32; i++) {
|
||||
ecp_nistz256_sqr_mont(ret, ret);
|
||||
} // 2^224 - 2^192 + 2^160 + 2^64 - 2^32
|
||||
ecp_nistz256_mul_mont(ret, ret, x32); // 2^224 - 2^192 + 2^160 + 2^64 - 2^0
|
||||
|
||||
for (int i = 0; i < 30; i++) {
|
||||
ecp_nistz256_sqr_mont(ret, ret);
|
||||
} // 2^254 - 2^222 + 2^190 + 2^94 - 2^30
|
||||
ecp_nistz256_mul_mont(ret, ret, x30); // 2^254 - 2^222 + 2^190 + 2^94 - 2^0
|
||||
|
||||
ecp_nistz256_sqr_mont(ret, ret);
|
||||
ecp_nistz256_sqr_mont(r, ret); // 2^256 - 2^224 + 2^192 + 2^96 - 2^2
|
||||
}
|
||||
|
||||
// r = p * p_scalar
|
||||
static void ecp_nistz256_windowed_mul(const EC_GROUP *group, P256_POINT *r,
|
||||
const EC_JACOBIAN *p,
|
||||
const EC_SCALAR *p_scalar) {
|
||||
assert(p != nullptr);
|
||||
assert(p_scalar != nullptr);
|
||||
assert(group->field.N.width == P256_LIMBS);
|
||||
|
||||
static const size_t kWindowSize = 5;
|
||||
static const crypto_word_t kMask = (1 << (5 /* kWindowSize */ + 1)) - 1;
|
||||
|
||||
// A `P256_POINT` is (3 * 32) = 96 bytes, and the 64-byte alignment should
|
||||
// add no more than 63 bytes of overhead. Thus, `table` should require
|
||||
// ~1599 ((96 * 16) + 63) bytes of stack space.
|
||||
alignas(64) P256_POINT table[16];
|
||||
uint8_t p_str[33];
|
||||
OPENSSL_memcpy(p_str, p_scalar->words, 32);
|
||||
p_str[32] = 0;
|
||||
|
||||
// table[0] is implicitly (0,0,0) (the point at infinity), therefore it is
|
||||
// not stored. All other values are actually stored with an offset of -1 in
|
||||
// table.
|
||||
P256_POINT *row = table;
|
||||
assert(group->field.N.width == P256_LIMBS);
|
||||
OPENSSL_memcpy(row[1 - 1].X, p->X.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(row[1 - 1].Y, p->Y.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(row[1 - 1].Z, p->Z.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
|
||||
ecp_nistz256_point_double(&row[2 - 1], &row[1 - 1]);
|
||||
ecp_nistz256_point_add(&row[3 - 1], &row[2 - 1], &row[1 - 1]);
|
||||
ecp_nistz256_point_double(&row[4 - 1], &row[2 - 1]);
|
||||
ecp_nistz256_point_double(&row[6 - 1], &row[3 - 1]);
|
||||
ecp_nistz256_point_double(&row[8 - 1], &row[4 - 1]);
|
||||
ecp_nistz256_point_double(&row[12 - 1], &row[6 - 1]);
|
||||
ecp_nistz256_point_add(&row[5 - 1], &row[4 - 1], &row[1 - 1]);
|
||||
ecp_nistz256_point_add(&row[7 - 1], &row[6 - 1], &row[1 - 1]);
|
||||
ecp_nistz256_point_add(&row[9 - 1], &row[8 - 1], &row[1 - 1]);
|
||||
ecp_nistz256_point_add(&row[13 - 1], &row[12 - 1], &row[1 - 1]);
|
||||
ecp_nistz256_point_double(&row[14 - 1], &row[7 - 1]);
|
||||
ecp_nistz256_point_double(&row[10 - 1], &row[5 - 1]);
|
||||
ecp_nistz256_point_add(&row[15 - 1], &row[14 - 1], &row[1 - 1]);
|
||||
ecp_nistz256_point_add(&row[11 - 1], &row[10 - 1], &row[1 - 1]);
|
||||
ecp_nistz256_point_double(&row[16 - 1], &row[8 - 1]);
|
||||
|
||||
BN_ULONG tmp[P256_LIMBS];
|
||||
alignas(32) P256_POINT h;
|
||||
size_t index = 255;
|
||||
crypto_word_t wvalue = p_str[(index - 1) / 8];
|
||||
wvalue = (wvalue >> ((index - 1) % 8)) & kMask;
|
||||
|
||||
ecp_nistz256_select_w5(r, table, booth_recode_w5(wvalue) >> 1);
|
||||
|
||||
while (index >= 5) {
|
||||
if (index != 255) {
|
||||
size_t off = (index - 1) / 8;
|
||||
|
||||
wvalue = (crypto_word_t)p_str[off] | (crypto_word_t)p_str[off + 1] << 8;
|
||||
wvalue = (wvalue >> ((index - 1) % 8)) & kMask;
|
||||
|
||||
wvalue = booth_recode_w5(wvalue);
|
||||
|
||||
ecp_nistz256_select_w5(&h, table, wvalue >> 1);
|
||||
|
||||
ecp_nistz256_neg(tmp, h.Y);
|
||||
copy_conditional(h.Y, tmp, (wvalue & 1));
|
||||
|
||||
ecp_nistz256_point_add(r, r, &h);
|
||||
}
|
||||
|
||||
index -= kWindowSize;
|
||||
|
||||
ecp_nistz256_point_double(r, r);
|
||||
ecp_nistz256_point_double(r, r);
|
||||
ecp_nistz256_point_double(r, r);
|
||||
ecp_nistz256_point_double(r, r);
|
||||
ecp_nistz256_point_double(r, r);
|
||||
}
|
||||
|
||||
// Final window
|
||||
wvalue = p_str[0];
|
||||
wvalue = (wvalue << 1) & kMask;
|
||||
|
||||
wvalue = booth_recode_w5(wvalue);
|
||||
|
||||
ecp_nistz256_select_w5(&h, table, wvalue >> 1);
|
||||
|
||||
ecp_nistz256_neg(tmp, h.Y);
|
||||
copy_conditional(h.Y, tmp, wvalue & 1);
|
||||
|
||||
ecp_nistz256_point_add(r, r, &h);
|
||||
}
|
||||
|
||||
static crypto_word_t calc_first_wvalue(size_t *index, const uint8_t p_str[33]) {
|
||||
static const size_t kWindowSize = 7;
|
||||
static const crypto_word_t kMask = (1 << (7 /* kWindowSize */ + 1)) - 1;
|
||||
*index = kWindowSize;
|
||||
|
||||
crypto_word_t wvalue = (p_str[0] << 1) & kMask;
|
||||
return booth_recode_w7(wvalue);
|
||||
}
|
||||
|
||||
static crypto_word_t calc_wvalue(size_t *index, const uint8_t p_str[33]) {
|
||||
static const size_t kWindowSize = 7;
|
||||
static const crypto_word_t kMask = (1 << (7 /* kWindowSize */ + 1)) - 1;
|
||||
|
||||
const size_t off = (*index - 1) / 8;
|
||||
crypto_word_t wvalue =
|
||||
(crypto_word_t)p_str[off] | (crypto_word_t)p_str[off + 1] << 8;
|
||||
wvalue = (wvalue >> ((*index - 1) % 8)) & kMask;
|
||||
*index += kWindowSize;
|
||||
|
||||
return booth_recode_w7(wvalue);
|
||||
}
|
||||
|
||||
static void ecp_nistz256_point_mul(const EC_GROUP *group, EC_JACOBIAN *r,
|
||||
const EC_JACOBIAN *p,
|
||||
const EC_SCALAR *scalar) {
|
||||
alignas(32) P256_POINT out;
|
||||
ecp_nistz256_windowed_mul(group, &out, p, scalar);
|
||||
|
||||
assert(group->field.N.width == P256_LIMBS);
|
||||
OPENSSL_memcpy(r->X.words, out.X, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(r->Y.words, out.Y, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(r->Z.words, out.Z, P256_LIMBS * sizeof(BN_ULONG));
|
||||
}
|
||||
|
||||
static void ecp_nistz256_point_mul_base(const EC_GROUP *group, EC_JACOBIAN *r,
|
||||
const EC_SCALAR *scalar) {
|
||||
uint8_t p_str[33];
|
||||
OPENSSL_memcpy(p_str, scalar->words, 32);
|
||||
p_str[32] = 0;
|
||||
|
||||
// First window
|
||||
size_t index = 0;
|
||||
crypto_word_t wvalue = calc_first_wvalue(&index, p_str);
|
||||
|
||||
alignas(32) P256_POINT_AFFINE t;
|
||||
alignas(32) P256_POINT p;
|
||||
ecp_nistz256_select_w7(&t, ecp_nistz256_precomputed[0], wvalue >> 1);
|
||||
ecp_nistz256_neg(p.Z, t.Y);
|
||||
copy_conditional(t.Y, p.Z, wvalue & 1);
|
||||
|
||||
// Convert `t` from affine to Jacobian coordinates. We set Z to zero if `t`
|
||||
// is infinity and `ONE_MONT` otherwise. `t` was computed from the table, so
|
||||
// it is infinity iff `wvalue >> 1` is zero.
|
||||
OPENSSL_memcpy(p.X, t.X, sizeof(p.X));
|
||||
OPENSSL_memcpy(p.Y, t.Y, sizeof(p.Y));
|
||||
OPENSSL_memset(p.Z, 0, sizeof(p.Z));
|
||||
copy_conditional(p.Z, ONE_MONT, is_not_zero(wvalue >> 1));
|
||||
|
||||
for (int i = 1; i < 37; i++) {
|
||||
wvalue = calc_wvalue(&index, p_str);
|
||||
|
||||
ecp_nistz256_select_w7(&t, ecp_nistz256_precomputed[i], wvalue >> 1);
|
||||
|
||||
alignas(32) BN_ULONG neg_Y[P256_LIMBS];
|
||||
ecp_nistz256_neg(neg_Y, t.Y);
|
||||
copy_conditional(t.Y, neg_Y, wvalue & 1);
|
||||
|
||||
// Note `ecp_nistz256_point_add_affine` does not work if `p` and `t` are the
|
||||
// same non-infinity point.
|
||||
ecp_nistz256_point_add_affine(&p, &p, &t);
|
||||
}
|
||||
|
||||
assert(group->field.N.width == P256_LIMBS);
|
||||
OPENSSL_memcpy(r->X.words, p.X, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(r->Y.words, p.Y, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(r->Z.words, p.Z, P256_LIMBS * sizeof(BN_ULONG));
|
||||
}
|
||||
|
||||
static void ecp_nistz256_points_mul_public(const EC_GROUP *group,
|
||||
EC_JACOBIAN *r,
|
||||
const EC_SCALAR *g_scalar,
|
||||
const EC_JACOBIAN *p_,
|
||||
const EC_SCALAR *p_scalar) {
|
||||
assert(p_ != nullptr && p_scalar != nullptr && g_scalar != nullptr);
|
||||
|
||||
alignas(32) P256_POINT p;
|
||||
uint8_t p_str[33];
|
||||
OPENSSL_memcpy(p_str, g_scalar->words, 32);
|
||||
p_str[32] = 0;
|
||||
|
||||
// First window
|
||||
size_t index = 0;
|
||||
size_t wvalue = calc_first_wvalue(&index, p_str);
|
||||
|
||||
// Convert `p` from affine to Jacobian coordinates. We set Z to zero if `p`
|
||||
// is infinity and `ONE_MONT` otherwise. `p` was computed from the table, so
|
||||
// it is infinity iff `wvalue >> 1` is zero.
|
||||
if ((wvalue >> 1) != 0) {
|
||||
OPENSSL_memcpy(p.X, &ecp_nistz256_precomputed[0][(wvalue >> 1) - 1].X,
|
||||
sizeof(p.X));
|
||||
OPENSSL_memcpy(p.Y, &ecp_nistz256_precomputed[0][(wvalue >> 1) - 1].Y,
|
||||
sizeof(p.Y));
|
||||
OPENSSL_memcpy(p.Z, ONE_MONT, sizeof(p.Z));
|
||||
} else {
|
||||
OPENSSL_memset(p.X, 0, sizeof(p.X));
|
||||
OPENSSL_memset(p.Y, 0, sizeof(p.Y));
|
||||
OPENSSL_memset(p.Z, 0, sizeof(p.Z));
|
||||
}
|
||||
|
||||
if ((wvalue & 1) == 1) {
|
||||
ecp_nistz256_neg(p.Y, p.Y);
|
||||
}
|
||||
|
||||
for (int i = 1; i < 37; i++) {
|
||||
wvalue = calc_wvalue(&index, p_str);
|
||||
if ((wvalue >> 1) == 0) {
|
||||
continue;
|
||||
}
|
||||
|
||||
alignas(32) P256_POINT_AFFINE t;
|
||||
OPENSSL_memcpy(&t, &ecp_nistz256_precomputed[i][(wvalue >> 1) - 1],
|
||||
sizeof(t));
|
||||
if ((wvalue & 1) == 1) {
|
||||
ecp_nistz256_neg(t.Y, t.Y);
|
||||
}
|
||||
|
||||
// Note `ecp_nistz256_point_add_affine` does not work if `p` and `t` are
|
||||
// the same non-infinity point, so it is important that we compute the
|
||||
// `g_scalar` term before the `p_scalar` term.
|
||||
ecp_nistz256_point_add_affine(&p, &p, &t);
|
||||
}
|
||||
|
||||
alignas(32) P256_POINT tmp;
|
||||
ecp_nistz256_windowed_mul(group, &tmp, p_, p_scalar);
|
||||
ecp_nistz256_point_add(&p, &p, &tmp);
|
||||
|
||||
assert(group->field.N.width == P256_LIMBS);
|
||||
OPENSSL_memcpy(r->X.words, p.X, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(r->Y.words, p.Y, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(r->Z.words, p.Z, P256_LIMBS * sizeof(BN_ULONG));
|
||||
}
|
||||
|
||||
static int ecp_nistz256_get_affine(const EC_GROUP *group,
|
||||
const EC_JACOBIAN *point, EC_FELEM *x,
|
||||
EC_FELEM *y) {
|
||||
if (constant_time_declassify_int(
|
||||
ec_GFp_simple_is_at_infinity(group, point))) {
|
||||
OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY);
|
||||
return 0;
|
||||
}
|
||||
|
||||
BN_ULONG z_inv2[P256_LIMBS];
|
||||
assert(group->field.N.width == P256_LIMBS);
|
||||
ecp_nistz256_mod_inverse_sqr_mont(z_inv2, point->Z.words);
|
||||
|
||||
if (x != nullptr) {
|
||||
ecp_nistz256_mul_mont(x->words, z_inv2, point->X.words);
|
||||
}
|
||||
|
||||
if (y != nullptr) {
|
||||
ecp_nistz256_sqr_mont(z_inv2, z_inv2); // z^-4
|
||||
ecp_nistz256_mul_mont(y->words, point->Y.words, point->Z.words); // y * z
|
||||
ecp_nistz256_mul_mont(y->words, y->words, z_inv2); // y * z^-3
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static void ecp_nistz256_add(const EC_GROUP *group, EC_JACOBIAN *r,
|
||||
const EC_JACOBIAN *a_, const EC_JACOBIAN *b_) {
|
||||
P256_POINT a, b;
|
||||
OPENSSL_memcpy(a.X, a_->X.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(a.Y, a_->Y.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(a.Z, a_->Z.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(b.X, b_->X.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(b.Y, b_->Y.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(b.Z, b_->Z.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
ecp_nistz256_point_add(&a, &a, &b);
|
||||
OPENSSL_memcpy(r->X.words, a.X, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(r->Y.words, a.Y, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(r->Z.words, a.Z, P256_LIMBS * sizeof(BN_ULONG));
|
||||
}
|
||||
|
||||
static void ecp_nistz256_dbl(const EC_GROUP *group, EC_JACOBIAN *r,
|
||||
const EC_JACOBIAN *a_) {
|
||||
P256_POINT a;
|
||||
OPENSSL_memcpy(a.X, a_->X.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(a.Y, a_->Y.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(a.Z, a_->Z.words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
ecp_nistz256_point_double(&a, &a);
|
||||
OPENSSL_memcpy(r->X.words, a.X, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(r->Y.words, a.Y, P256_LIMBS * sizeof(BN_ULONG));
|
||||
OPENSSL_memcpy(r->Z.words, a.Z, P256_LIMBS * sizeof(BN_ULONG));
|
||||
}
|
||||
|
||||
static void ecp_nistz256_inv0_mod_ord(const EC_GROUP *group, EC_SCALAR *out,
|
||||
const EC_SCALAR *in) {
|
||||
// table[i] stores a power of `in` corresponding to the matching enum value.
|
||||
enum {
|
||||
// The following indices specify the power in binary.
|
||||
i_1 = 0,
|
||||
i_10,
|
||||
i_11,
|
||||
i_101,
|
||||
i_111,
|
||||
i_1010,
|
||||
i_1111,
|
||||
i_10101,
|
||||
i_101010,
|
||||
i_101111,
|
||||
// The following indices specify 2^N-1, or N ones in a row.
|
||||
i_x6,
|
||||
i_x8,
|
||||
i_x16,
|
||||
i_x32
|
||||
};
|
||||
BN_ULONG table[15][P256_LIMBS];
|
||||
|
||||
// https://briansmith.org/ecc-inversion-addition-chains-01#p256_scalar_inversion
|
||||
//
|
||||
// Even though this code path spares 12 squarings, 4.5%, and 13
|
||||
// multiplications, 25%, the overall sign operation is not that much faster,
|
||||
// not more that 2%. Most of the performance of this function comes from the
|
||||
// scalar operations.
|
||||
|
||||
// Pre-calculate powers.
|
||||
OPENSSL_memcpy(table[i_1], in->words, P256_LIMBS * sizeof(BN_ULONG));
|
||||
|
||||
ecp_nistz256_ord_sqr_mont(table[i_10], table[i_1], 1);
|
||||
|
||||
ecp_nistz256_ord_mul_mont(table[i_11], table[i_1], table[i_10]);
|
||||
|
||||
ecp_nistz256_ord_mul_mont(table[i_101], table[i_11], table[i_10]);
|
||||
|
||||
ecp_nistz256_ord_mul_mont(table[i_111], table[i_101], table[i_10]);
|
||||
|
||||
ecp_nistz256_ord_sqr_mont(table[i_1010], table[i_101], 1);
|
||||
|
||||
ecp_nistz256_ord_mul_mont(table[i_1111], table[i_1010], table[i_101]);
|
||||
|
||||
ecp_nistz256_ord_sqr_mont(table[i_10101], table[i_1010], 1);
|
||||
ecp_nistz256_ord_mul_mont(table[i_10101], table[i_10101], table[i_1]);
|
||||
|
||||
ecp_nistz256_ord_sqr_mont(table[i_101010], table[i_10101], 1);
|
||||
|
||||
ecp_nistz256_ord_mul_mont(table[i_101111], table[i_101010], table[i_101]);
|
||||
|
||||
ecp_nistz256_ord_mul_mont(table[i_x6], table[i_101010], table[i_10101]);
|
||||
|
||||
ecp_nistz256_ord_sqr_mont(table[i_x8], table[i_x6], 2);
|
||||
ecp_nistz256_ord_mul_mont(table[i_x8], table[i_x8], table[i_11]);
|
||||
|
||||
ecp_nistz256_ord_sqr_mont(table[i_x16], table[i_x8], 8);
|
||||
ecp_nistz256_ord_mul_mont(table[i_x16], table[i_x16], table[i_x8]);
|
||||
|
||||
ecp_nistz256_ord_sqr_mont(table[i_x32], table[i_x16], 16);
|
||||
ecp_nistz256_ord_mul_mont(table[i_x32], table[i_x32], table[i_x16]);
|
||||
|
||||
// Compute `in` raised to the order-2.
|
||||
ecp_nistz256_ord_sqr_mont(out->words, table[i_x32], 64);
|
||||
ecp_nistz256_ord_mul_mont(out->words, out->words, table[i_x32]);
|
||||
static const struct {
|
||||
uint8_t p, i;
|
||||
} kChain[27] = {{32, i_x32}, {6, i_101111}, {5, i_111}, {4, i_11},
|
||||
{5, i_1111}, {5, i_10101}, {4, i_101}, {3, i_101},
|
||||
{3, i_101}, {5, i_111}, {9, i_101111}, {6, i_1111},
|
||||
{2, i_1}, {5, i_1}, {6, i_1111}, {5, i_111},
|
||||
{4, i_111}, {5, i_111}, {5, i_101}, {3, i_11},
|
||||
{10, i_101111}, {2, i_11}, {5, i_11}, {5, i_11},
|
||||
{3, i_1}, {7, i_10101}, {6, i_1111}};
|
||||
for (const auto &step : kChain) {
|
||||
ecp_nistz256_ord_sqr_mont(out->words, out->words, step.p);
|
||||
ecp_nistz256_ord_mul_mont(out->words, out->words, table[step.i]);
|
||||
}
|
||||
}
|
||||
|
||||
static int ecp_nistz256_scalar_to_montgomery_inv_vartime(const EC_GROUP *group,
|
||||
EC_SCALAR *out,
|
||||
const EC_SCALAR *in) {
|
||||
#if defined(OPENSSL_X86_64)
|
||||
if (!CRYPTO_is_AVX_capable()) {
|
||||
// No AVX support; fallback to generic code.
|
||||
return ec_simple_scalar_to_montgomery_inv_vartime(group, out, in);
|
||||
}
|
||||
#endif
|
||||
|
||||
assert(group->order.N.width == P256_LIMBS);
|
||||
if (!beeu_mod_inverse_vartime(out->words, in->words, group->order.N.d)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
// The result should be returned in the Montgomery domain.
|
||||
ec_scalar_to_montgomery(group, out, out);
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int ecp_nistz256_cmp_x_coordinate(const EC_GROUP *group,
|
||||
const EC_JACOBIAN *p,
|
||||
const EC_SCALAR *r) {
|
||||
if (ec_GFp_simple_is_at_infinity(group, p)) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
assert(group->order.N.width == P256_LIMBS);
|
||||
assert(group->field.N.width == P256_LIMBS);
|
||||
|
||||
// We wish to compare X/Z^2 with r. This is equivalent to comparing X with
|
||||
// r*Z^2. Note that X and Z are represented in Montgomery form, while r is
|
||||
// not.
|
||||
BN_ULONG r_Z2[P256_LIMBS], Z2_mont[P256_LIMBS], X[P256_LIMBS];
|
||||
ecp_nistz256_mul_mont(Z2_mont, p->Z.words, p->Z.words);
|
||||
ecp_nistz256_mul_mont(r_Z2, r->words, Z2_mont);
|
||||
ecp_nistz256_from_mont(X, p->X.words);
|
||||
|
||||
if (OPENSSL_memcmp(r_Z2, X, sizeof(r_Z2)) == 0) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
// During signing the x coefficient is reduced modulo the group order.
|
||||
// Therefore there is a small possibility, less than 1/2^128, that group_order
|
||||
// < p.x < P. in that case we need not only to compare against `r` but also to
|
||||
// compare against r+group_order.
|
||||
BN_ULONG carry = bn_add_words(r_Z2, r->words, group->order.N.d, P256_LIMBS);
|
||||
if (carry == 0 && bn_less_than_words(r_Z2, group->field.N.d, P256_LIMBS)) {
|
||||
// r + group_order < p, so compare (r + group_order) * Z^2 against X.
|
||||
ecp_nistz256_mul_mont(r_Z2, r_Z2, Z2_mont);
|
||||
if (OPENSSL_memcmp(r_Z2, X, sizeof(r_Z2)) == 0) {
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
BSSL_NAMESPACE_BEGIN
|
||||
|
||||
DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_nistz256_method) {
|
||||
out->point_get_affine_coordinates = ecp_nistz256_get_affine;
|
||||
out->add = ecp_nistz256_add;
|
||||
out->dbl = ecp_nistz256_dbl;
|
||||
out->mul = ecp_nistz256_point_mul;
|
||||
out->mul_base = ecp_nistz256_point_mul_base;
|
||||
out->mul_public = ecp_nistz256_points_mul_public;
|
||||
out->scalar_inv0_montgomery = ecp_nistz256_inv0_mod_ord;
|
||||
out->scalar_to_montgomery_inv_vartime =
|
||||
ecp_nistz256_scalar_to_montgomery_inv_vartime;
|
||||
out->cmp_x_coordinate = ecp_nistz256_cmp_x_coordinate;
|
||||
}
|
||||
|
||||
BSSL_NAMESPACE_END
|
||||
|
||||
#endif /* !defined(OPENSSL_NO_ASM) && \
|
||||
(defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) && \
|
||||
!defined(OPENSSL_SMALL) */
|
||||
@@ -0,0 +1,207 @@
|
||||
// Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
// Copyright (c) 2014, Intel Corporation. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// https://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
// Originally written by Shay Gueron (1, 2), and Vlad Krasnov (1)
|
||||
// (1) Intel Corporation, Israel Development Center, Haifa, Israel
|
||||
// (2) University of Haifa, Israel
|
||||
//
|
||||
// Reference:
|
||||
// S.Gueron and V.Krasnov, "Fast Prime Field Elliptic Curve Cryptography with
|
||||
// 256 Bit Primes"
|
||||
|
||||
#ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_EC_P256_NISTZ_H
|
||||
#define OPENSSL_HEADER_CRYPTO_FIPSMODULE_EC_P256_NISTZ_H
|
||||
|
||||
#include <openssl/base.h>
|
||||
|
||||
#include <openssl/bn.h>
|
||||
|
||||
#include "../bn/internal.h"
|
||||
|
||||
#if defined(__cplusplus)
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
|
||||
#if !defined(OPENSSL_NO_ASM) && \
|
||||
(defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) && \
|
||||
!defined(OPENSSL_SMALL)
|
||||
|
||||
// P-256 field operations.
|
||||
//
|
||||
// An element mod P in P-256 is represented as a little-endian array of
|
||||
// `P256_LIMBS` `BN_ULONG`s, spanning the full range of values.
|
||||
//
|
||||
// The following functions take fully-reduced inputs mod P and give
|
||||
// fully-reduced outputs. They may be used in-place.
|
||||
|
||||
#define P256_LIMBS (256 / BN_BITS2)
|
||||
|
||||
// ecp_nistz256_neg sets `res` to -`a` mod P.
|
||||
void ecp_nistz256_neg(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS]);
|
||||
|
||||
// ecp_nistz256_mul_mont sets `res` to `a` * `b` * 2^-256 mod P.
|
||||
#if defined(OPENSSL_X86_64)
|
||||
void ecp_nistz256_mul_mont_nohw(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG b[P256_LIMBS]);
|
||||
void ecp_nistz256_mul_mont_adx(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG b[P256_LIMBS]);
|
||||
#else
|
||||
void ecp_nistz256_mul_mont(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG b[P256_LIMBS]);
|
||||
#endif
|
||||
|
||||
// ecp_nistz256_sqr_mont sets `res` to `a` * `a` * 2^-256 mod P.
|
||||
#if defined(OPENSSL_X86_64)
|
||||
void ecp_nistz256_sqr_mont_nohw(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS]);
|
||||
void ecp_nistz256_sqr_mont_adx(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS]);
|
||||
#else
|
||||
void ecp_nistz256_sqr_mont(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS]);
|
||||
#endif
|
||||
|
||||
|
||||
// P-256 scalar operations.
|
||||
//
|
||||
// The following functions compute modulo N, where N is the order of P-256. They
|
||||
// take fully-reduced inputs and give fully-reduced outputs.
|
||||
|
||||
// ecp_nistz256_ord_mul_mont sets `res` to `a` * `b` where inputs and outputs
|
||||
// are in Montgomery form. That is, `res` is `a` * `b` * 2^-256 mod N.
|
||||
#if defined(OPENSSL_X86_64)
|
||||
void ecp_nistz256_ord_mul_mont_nohw(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG b[P256_LIMBS]);
|
||||
void ecp_nistz256_ord_mul_mont_adx(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG b[P256_LIMBS]);
|
||||
#else
|
||||
void ecp_nistz256_ord_mul_mont(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG b[P256_LIMBS]);
|
||||
#endif
|
||||
|
||||
// ecp_nistz256_ord_sqr_mont sets `res` to `a`^(2*`rep`) where inputs and
|
||||
// outputs are in Montgomery form. That is, `res` is
|
||||
// (`a` * 2^-256)^(2*`rep`) * 2^256 mod N.
|
||||
#if defined(OPENSSL_X86_64)
|
||||
void ecp_nistz256_ord_sqr_mont_nohw(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS], BN_ULONG rep);
|
||||
void ecp_nistz256_ord_sqr_mont_adx(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS], BN_ULONG rep);
|
||||
#else
|
||||
void ecp_nistz256_ord_sqr_mont(BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS], BN_ULONG rep);
|
||||
#endif
|
||||
|
||||
// beeu_mod_inverse_vartime sets out = a^-1 mod p using a Euclidean algorithm.
|
||||
// Assumption: 0 < a < p < 2^(256) and p is odd.
|
||||
int beeu_mod_inverse_vartime(BN_ULONG out[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG p[P256_LIMBS]);
|
||||
|
||||
|
||||
// P-256 point operations.
|
||||
//
|
||||
// The following functions may be used in-place. All coordinates are in the
|
||||
// Montgomery domain.
|
||||
|
||||
// A P256_POINT represents a P-256 point in Jacobian coordinates.
|
||||
typedef struct {
|
||||
BN_ULONG X[P256_LIMBS];
|
||||
BN_ULONG Y[P256_LIMBS];
|
||||
BN_ULONG Z[P256_LIMBS];
|
||||
} P256_POINT;
|
||||
|
||||
// A P256_POINT_AFFINE represents a P-256 point in affine coordinates. Infinity
|
||||
// is encoded as (0, 0).
|
||||
typedef struct {
|
||||
BN_ULONG X[P256_LIMBS];
|
||||
BN_ULONG Y[P256_LIMBS];
|
||||
} P256_POINT_AFFINE;
|
||||
|
||||
// ecp_nistz256_select_w5 sets `*val` to `in_t[index-1]` if 1 <= `index` <= 16
|
||||
// and all zeros (the point at infinity) if `index` is 0. This is done in
|
||||
// constant time.
|
||||
#if defined(OPENSSL_X86_64)
|
||||
void ecp_nistz256_select_w5_nohw(P256_POINT *val, const P256_POINT in_t[16],
|
||||
int index);
|
||||
void ecp_nistz256_select_w5_avx2(P256_POINT *val, const P256_POINT in_t[16],
|
||||
int index);
|
||||
#else
|
||||
void ecp_nistz256_select_w5(P256_POINT *val, const P256_POINT in_t[16],
|
||||
int index);
|
||||
#endif
|
||||
|
||||
// ecp_nistz256_select_w7 sets `*val` to `in_t[index-1]` if 1 <= `index` <= 64
|
||||
// and all zeros (the point at infinity) if `index` is 0. This is done in
|
||||
// constant time.
|
||||
#if defined(OPENSSL_X86_64)
|
||||
void ecp_nistz256_select_w7_nohw(P256_POINT_AFFINE *val,
|
||||
const P256_POINT_AFFINE in_t[64], int index);
|
||||
void ecp_nistz256_select_w7_avx2(P256_POINT_AFFINE *val,
|
||||
const P256_POINT_AFFINE in_t[64], int index);
|
||||
#else
|
||||
void ecp_nistz256_select_w7(P256_POINT_AFFINE *val,
|
||||
const P256_POINT_AFFINE in_t[64], int index);
|
||||
#endif
|
||||
|
||||
// ecp_nistz256_point_double sets `r` to `a` doubled.
|
||||
#if defined(OPENSSL_X86_64)
|
||||
void ecp_nistz256_point_double_nohw(P256_POINT *r, const P256_POINT *a);
|
||||
void ecp_nistz256_point_double_adx(P256_POINT *r, const P256_POINT *a);
|
||||
#else
|
||||
void ecp_nistz256_point_double(P256_POINT *r, const P256_POINT *a);
|
||||
#endif
|
||||
|
||||
// ecp_nistz256_point_add adds `a` to `b` and places the result in `r`.
|
||||
#if defined(OPENSSL_X86_64)
|
||||
void ecp_nistz256_point_add_nohw(P256_POINT *r, const P256_POINT *a,
|
||||
const P256_POINT *b);
|
||||
void ecp_nistz256_point_add_adx(P256_POINT *r, const P256_POINT *a,
|
||||
const P256_POINT *b);
|
||||
#else
|
||||
void ecp_nistz256_point_add(P256_POINT *r, const P256_POINT *a,
|
||||
const P256_POINT *b);
|
||||
#endif
|
||||
|
||||
// ecp_nistz256_point_add_affine adds `a` to `b` and places the result in
|
||||
// `r`. `a` and `b` must not represent the same point unless they are both
|
||||
// infinity.
|
||||
#if defined(OPENSSL_X86_64)
|
||||
void ecp_nistz256_point_add_affine_adx(P256_POINT *r, const P256_POINT *a,
|
||||
const P256_POINT_AFFINE *b);
|
||||
void ecp_nistz256_point_add_affine_nohw(P256_POINT *r, const P256_POINT *a,
|
||||
const P256_POINT_AFFINE *b);
|
||||
#else
|
||||
void ecp_nistz256_point_add_affine(P256_POINT *r, const P256_POINT *a,
|
||||
const P256_POINT_AFFINE *b);
|
||||
#endif
|
||||
|
||||
#endif /* !defined(OPENSSL_NO_ASM) && \
|
||||
(defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) && \
|
||||
!defined(OPENSSL_SMALL) */
|
||||
|
||||
|
||||
#if defined(__cplusplus)
|
||||
} // extern C
|
||||
#endif
|
||||
|
||||
#endif // OPENSSL_HEADER_CRYPTO_FIPSMODULE_EC_P256_NISTZ_H
|
||||
@@ -0,0 +1,690 @@
|
||||
// Copyright 2016 The BoringSSL Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// https://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include <openssl/base.h>
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
#include <gtest/gtest.h>
|
||||
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/ec.h>
|
||||
#include <openssl/mem.h>
|
||||
#include <openssl/nid.h>
|
||||
|
||||
#include "../../internal.h"
|
||||
#include "../../test/abi_test.h"
|
||||
#include "../../test/file_test.h"
|
||||
#include "../../test/test_util.h"
|
||||
#include "../bn/internal.h"
|
||||
#include "internal.h"
|
||||
#include "p256-nistz.h"
|
||||
|
||||
|
||||
BSSL_NAMESPACE_BEGIN
|
||||
namespace {
|
||||
|
||||
// Disable tests if BORINGSSL_SHARED_LIBRARY is defined. These tests need access
|
||||
// to internal functions.
|
||||
#if !defined(OPENSSL_NO_ASM) && \
|
||||
(defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) && \
|
||||
!defined(OPENSSL_SMALL) && !defined(BORINGSSL_SHARED_LIBRARY)
|
||||
|
||||
struct P256NistzSelectImpl {
|
||||
const char *name;
|
||||
void (*select_w5)(P256_POINT *val, const P256_POINT in_t[16], int index);
|
||||
void (*select_w7)(P256_POINT_AFFINE *val, const P256_POINT_AFFINE in_t[64],
|
||||
int index);
|
||||
};
|
||||
|
||||
static std::vector<P256NistzSelectImpl> AllP256NistzSelectImpls() {
|
||||
std::vector<P256NistzSelectImpl> impls;
|
||||
#if defined(OPENSSL_X86_64)
|
||||
impls.push_back({
|
||||
"NoHW",
|
||||
ecp_nistz256_select_w5_nohw,
|
||||
ecp_nistz256_select_w7_nohw,
|
||||
});
|
||||
if (CRYPTO_is_AVX2_capable()) {
|
||||
impls.push_back({
|
||||
"AVX2",
|
||||
ecp_nistz256_select_w5_nohw,
|
||||
ecp_nistz256_select_w7_nohw,
|
||||
});
|
||||
}
|
||||
#else
|
||||
impls.push_back({
|
||||
"Impl",
|
||||
ecp_nistz256_select_w5,
|
||||
ecp_nistz256_select_w7,
|
||||
});
|
||||
#endif
|
||||
return impls;
|
||||
}
|
||||
|
||||
class P256NistzSelectImplTest : public testing::TestWithParam<P256NistzSelectImpl> {
|
||||
protected:
|
||||
const P256NistzSelectImpl &impl() const { return GetParam(); }
|
||||
};
|
||||
|
||||
INSTANTIATE_TEST_SUITE_P(All, P256NistzSelectImplTest,
|
||||
testing::ValuesIn(AllP256NistzSelectImpls()),
|
||||
[](const testing::TestParamInfo<P256NistzSelectImpl> ¶ms)
|
||||
-> std::string { return params.param.name; });
|
||||
|
||||
TEST_P(P256NistzSelectImplTest, SelectW5) {
|
||||
// Fill a table with some garbage input.
|
||||
alignas(64) P256_POINT table[16];
|
||||
for (size_t i = 0; i < 16; i++) {
|
||||
OPENSSL_memset(table[i].X, static_cast<uint8_t>(3 * i), sizeof(table[i].X));
|
||||
OPENSSL_memset(table[i].Y, static_cast<uint8_t>(3 * i + 1),
|
||||
sizeof(table[i].Y));
|
||||
OPENSSL_memset(table[i].Z, static_cast<uint8_t>(3 * i + 2),
|
||||
sizeof(table[i].Z));
|
||||
}
|
||||
|
||||
for (int i = 0; i <= 16; i++) {
|
||||
P256_POINT val;
|
||||
impl().select_w5(&val, table, i);
|
||||
|
||||
P256_POINT expected;
|
||||
if (i == 0) {
|
||||
OPENSSL_memset(&expected, 0, sizeof(expected));
|
||||
} else {
|
||||
expected = table[i-1];
|
||||
}
|
||||
|
||||
EXPECT_EQ(Bytes(reinterpret_cast<const char *>(&expected), sizeof(expected)),
|
||||
Bytes(reinterpret_cast<const char *>(&val), sizeof(val)));
|
||||
}
|
||||
|
||||
// This is a constant-time function, so it is only necessary to instrument one
|
||||
// index for ABI checking.
|
||||
P256_POINT val;
|
||||
CHECK_ABI(impl().select_w5, &val, table, 7);
|
||||
}
|
||||
|
||||
TEST_P(P256NistzSelectImplTest, SelectW7) {
|
||||
// Fill a table with some garbage input.
|
||||
alignas(64) P256_POINT_AFFINE table[64];
|
||||
for (size_t i = 0; i < 64; i++) {
|
||||
OPENSSL_memset(table[i].X, static_cast<uint8_t>(2 * i), sizeof(table[i].X));
|
||||
OPENSSL_memset(table[i].Y, static_cast<uint8_t>(2 * i + 1),
|
||||
sizeof(table[i].Y));
|
||||
}
|
||||
|
||||
for (int i = 0; i <= 64; i++) {
|
||||
P256_POINT_AFFINE val;
|
||||
impl().select_w7(&val, table, i);
|
||||
|
||||
P256_POINT_AFFINE expected;
|
||||
if (i == 0) {
|
||||
OPENSSL_memset(&expected, 0, sizeof(expected));
|
||||
} else {
|
||||
expected = table[i-1];
|
||||
}
|
||||
|
||||
EXPECT_EQ(Bytes(reinterpret_cast<const char *>(&expected), sizeof(expected)),
|
||||
Bytes(reinterpret_cast<const char *>(&val), sizeof(val)));
|
||||
}
|
||||
|
||||
// This is a constant-time function, so it is only necessary to instrument one
|
||||
// index for ABI checking.
|
||||
P256_POINT_AFFINE val;
|
||||
CHECK_ABI(impl().select_w7, &val, table, 42);
|
||||
}
|
||||
|
||||
|
||||
static std::string FieldElementToString(const BN_ULONG a[P256_LIMBS]) {
|
||||
std::string ret;
|
||||
for (size_t i = P256_LIMBS-1; i < P256_LIMBS; i--) {
|
||||
char buf[2 * BN_BYTES + 1];
|
||||
snprintf(buf, sizeof(buf), BN_HEX_FMT2, a[i]);
|
||||
ret += buf;
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
static testing::AssertionResult ExpectFieldElementsEqual(
|
||||
const char *expected_expr, const char *actual_expr,
|
||||
const BN_ULONG expected[P256_LIMBS], const BN_ULONG actual[P256_LIMBS]) {
|
||||
if (OPENSSL_memcmp(expected, actual, sizeof(BN_ULONG) * P256_LIMBS) == 0) {
|
||||
return testing::AssertionSuccess();
|
||||
}
|
||||
|
||||
return testing::AssertionFailure()
|
||||
<< "Expected: " << FieldElementToString(expected) << " ("
|
||||
<< expected_expr << ")\n"
|
||||
<< "Actual: " << FieldElementToString(actual) << " (" << actual_expr
|
||||
<< ")";
|
||||
}
|
||||
|
||||
#define EXPECT_FIELD_ELEMENTS_EQUAL(a, b) \
|
||||
EXPECT_PRED_FORMAT2(ExpectFieldElementsEqual, a, b)
|
||||
|
||||
// P-256 scalars and field elements are the same size.
|
||||
#define EXPECT_SCALARS_EQUAL(a, b) EXPECT_FIELD_ELEMENTS_EQUAL(a, b)
|
||||
|
||||
TEST(P256_NistzTest, BEEU) {
|
||||
#if defined(OPENSSL_X86_64)
|
||||
if (!CRYPTO_is_AVX_capable()) {
|
||||
// No AVX support; cannot run the BEEU code.
|
||||
return;
|
||||
}
|
||||
#endif
|
||||
|
||||
const EC_GROUP *group = EC_group_p256();
|
||||
BN_ULONG order_words[P256_LIMBS];
|
||||
ASSERT_TRUE(
|
||||
bn_copy_words(order_words, P256_LIMBS, EC_GROUP_get0_order(group)));
|
||||
|
||||
BN_ULONG in[P256_LIMBS], out[P256_LIMBS];
|
||||
EC_SCALAR in_scalar, out_scalar, result;
|
||||
OPENSSL_memset(in, 0, sizeof(in));
|
||||
|
||||
// Trying to find the inverse of zero should fail.
|
||||
ASSERT_FALSE(beeu_mod_inverse_vartime(out, in, order_words));
|
||||
// This is not a constant-time function, so instrument both zero and a few
|
||||
// inputs below.
|
||||
ASSERT_FALSE(CHECK_ABI(beeu_mod_inverse_vartime, out, in, order_words));
|
||||
|
||||
BN_ULONG kOne[P256_LIMBS] = {};
|
||||
kOne[0] = 1;
|
||||
|
||||
auto beeu_test = [&] {
|
||||
EXPECT_TRUE(bn_less_than_words(in, order_words, P256_LIMBS));
|
||||
ASSERT_TRUE(beeu_mod_inverse_vartime(out, in, order_words));
|
||||
EXPECT_TRUE(bn_less_than_words(out, order_words, P256_LIMBS));
|
||||
|
||||
// Calculate out*in and confirm that it equals one, modulo the order. We
|
||||
// only have Montgomery multiplication, but if we convert one input, and not
|
||||
// the other, this gives the result outside the Montgomery domain.
|
||||
OPENSSL_memcpy(in_scalar.words, in, sizeof(in));
|
||||
OPENSSL_memcpy(out_scalar.words, out, sizeof(out));
|
||||
ec_scalar_to_montgomery(group, &in_scalar, &in_scalar);
|
||||
ec_scalar_mul_montgomery(group, &result, &in_scalar, &out_scalar);
|
||||
EXPECT_SCALARS_EQUAL(kOne, result.words);
|
||||
|
||||
// Invert the result and expect to get back to the original value.
|
||||
ASSERT_TRUE(beeu_mod_inverse_vartime(out, out, order_words));
|
||||
EXPECT_SCALARS_EQUAL(in, out);
|
||||
};
|
||||
|
||||
for (BN_ULONG i = 1; i < 2000; i++) {
|
||||
SCOPED_TRACE(i);
|
||||
in[0] = i;
|
||||
if (i >= 1000) {
|
||||
in[1] = i << 8;
|
||||
in[2] = i << 32;
|
||||
in[3] = i << 48;
|
||||
} else {
|
||||
in[1] = in[2] = in[3] = 0;
|
||||
}
|
||||
|
||||
beeu_test();
|
||||
if (i < 5) {
|
||||
EXPECT_TRUE(CHECK_ABI(beeu_mod_inverse_vartime, out, in, order_words));
|
||||
}
|
||||
}
|
||||
|
||||
for (int i = 0; i < 255; i++) {
|
||||
SCOPED_TRACE(i);
|
||||
// Test `in` = 2^i.
|
||||
OPENSSL_memset(in, 0, sizeof(in));
|
||||
in[i / BN_BITS2] = BN_ULONG{1} << (i % BN_BITS2);
|
||||
beeu_test();
|
||||
|
||||
// Test `in` = N - 2^i.
|
||||
bn_sub_words(in, order_words, in, P256_LIMBS);
|
||||
beeu_test();
|
||||
}
|
||||
}
|
||||
|
||||
static bool GetFieldElement(FileTest *t, BN_ULONG out[P256_LIMBS],
|
||||
const char *name) {
|
||||
std::vector<uint8_t> bytes;
|
||||
if (!t->GetBytes(&bytes, name)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (bytes.size() != BN_BYTES * P256_LIMBS) {
|
||||
ADD_FAILURE() << "Invalid length: " << name;
|
||||
return false;
|
||||
}
|
||||
|
||||
// `byte` contains bytes in big-endian while `out` should contain `BN_ULONG`s
|
||||
// in little-endian.
|
||||
OPENSSL_memset(out, 0, P256_LIMBS * sizeof(BN_ULONG));
|
||||
for (size_t i = 0; i < bytes.size(); i++) {
|
||||
out[P256_LIMBS - 1 - (i / BN_BYTES)] <<= 8;
|
||||
out[P256_LIMBS - 1 - (i / BN_BYTES)] |= bytes[i];
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
static bool PointToAffine(P256_POINT_AFFINE *out, const P256_POINT *in) {
|
||||
static const uint8_t kP[] = {
|
||||
0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff,
|
||||
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
||||
};
|
||||
|
||||
UniquePtr<BIGNUM> x(BN_new()), y(BN_new()), z(BN_new());
|
||||
UniquePtr<BIGNUM> p(BN_bin2bn(kP, sizeof(kP), nullptr));
|
||||
if (!x || !y || !z || !p || !bn_set_words(x.get(), in->X, P256_LIMBS) ||
|
||||
!bn_set_words(y.get(), in->Y, P256_LIMBS) ||
|
||||
!bn_set_words(z.get(), in->Z, P256_LIMBS)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Coordinates must be fully-reduced.
|
||||
if (BN_cmp(x.get(), p.get()) >= 0 ||
|
||||
BN_cmp(y.get(), p.get()) >= 0 ||
|
||||
BN_cmp(z.get(), p.get()) >= 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (BN_is_zero(z.get())) {
|
||||
// The point at infinity is represented as (0, 0).
|
||||
OPENSSL_memset(out, 0, sizeof(P256_POINT_AFFINE));
|
||||
return true;
|
||||
}
|
||||
|
||||
UniquePtr<BN_CTX> ctx(BN_CTX_new());
|
||||
UniquePtr<BN_MONT_CTX> mont(BN_MONT_CTX_new_for_modulus(p.get(), ctx.get()));
|
||||
if (!ctx || !mont ||
|
||||
// Invert Z.
|
||||
!BN_from_montgomery(z.get(), z.get(), mont.get(), ctx.get()) ||
|
||||
!BN_mod_inverse(z.get(), z.get(), p.get(), ctx.get()) ||
|
||||
!BN_to_montgomery(z.get(), z.get(), mont.get(), ctx.get()) ||
|
||||
// Convert (X, Y, Z) to (X/Z^2, Y/Z^3).
|
||||
!BN_mod_mul_montgomery(x.get(), x.get(), z.get(), mont.get(),
|
||||
ctx.get()) ||
|
||||
!BN_mod_mul_montgomery(x.get(), x.get(), z.get(), mont.get(),
|
||||
ctx.get()) ||
|
||||
!BN_mod_mul_montgomery(y.get(), y.get(), z.get(), mont.get(),
|
||||
ctx.get()) ||
|
||||
!BN_mod_mul_montgomery(y.get(), y.get(), z.get(), mont.get(),
|
||||
ctx.get()) ||
|
||||
!BN_mod_mul_montgomery(y.get(), y.get(), z.get(), mont.get(),
|
||||
ctx.get()) ||
|
||||
!bn_copy_words(out->X, P256_LIMBS, x.get()) ||
|
||||
!bn_copy_words(out->Y, P256_LIMBS, y.get())) {
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
static testing::AssertionResult ExpectPointsEqual(
|
||||
const char *expected_expr, const char *actual_expr,
|
||||
const P256_POINT_AFFINE *expected, const P256_POINT *actual) {
|
||||
// There are multiple representations of the same `P256_POINT`, so convert to
|
||||
// `P256_POINT_AFFINE` and compare.
|
||||
P256_POINT_AFFINE affine;
|
||||
if (!PointToAffine(&affine, actual)) {
|
||||
return testing::AssertionFailure()
|
||||
<< "Could not convert " << actual_expr << " to affine: ("
|
||||
<< FieldElementToString(actual->X) << ", "
|
||||
<< FieldElementToString(actual->Y) << ", "
|
||||
<< FieldElementToString(actual->Z) << ")";
|
||||
}
|
||||
|
||||
if (OPENSSL_memcmp(expected, &affine, sizeof(P256_POINT_AFFINE)) != 0) {
|
||||
return testing::AssertionFailure()
|
||||
<< "Expected: (" << FieldElementToString(expected->X) << ", "
|
||||
<< FieldElementToString(expected->Y) << ") (" << expected_expr
|
||||
<< "; affine)\n"
|
||||
<< "Actual: (" << FieldElementToString(affine.X) << ", "
|
||||
<< FieldElementToString(affine.Y) << ") (" << actual_expr << ")";
|
||||
}
|
||||
|
||||
return testing::AssertionSuccess();
|
||||
}
|
||||
|
||||
#define EXPECT_POINTS_EQUAL(a, b) EXPECT_PRED_FORMAT2(ExpectPointsEqual, a, b)
|
||||
|
||||
struct P256NistzImpl {
|
||||
const char *name;
|
||||
void (*neg)(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS]);
|
||||
void (*mul_mont)(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG b[P256_LIMBS]);
|
||||
void (*sqr_mont)(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS]);
|
||||
void (*ord_mul_mont)(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG b[P256_LIMBS]);
|
||||
void (*ord_sqr_mont)(BN_ULONG res[P256_LIMBS], const BN_ULONG a[P256_LIMBS],
|
||||
BN_ULONG rep);
|
||||
void (*point_double)(P256_POINT *r, const P256_POINT *a);
|
||||
void (*point_add)(P256_POINT *r, const P256_POINT *a, const P256_POINT *b);
|
||||
void (*point_add_affine)(P256_POINT *r, const P256_POINT *a,
|
||||
const P256_POINT_AFFINE *b);
|
||||
};
|
||||
|
||||
static std::vector<P256NistzImpl> AllP256NistzImpls() {
|
||||
std::vector<P256NistzImpl> impls;
|
||||
#if defined(OPENSSL_X86_64)
|
||||
impls.push_back({
|
||||
"NoHW",
|
||||
ecp_nistz256_neg,
|
||||
ecp_nistz256_mul_mont_nohw,
|
||||
ecp_nistz256_sqr_mont_nohw,
|
||||
ecp_nistz256_ord_mul_mont_nohw,
|
||||
ecp_nistz256_ord_sqr_mont_nohw,
|
||||
ecp_nistz256_point_double_nohw,
|
||||
ecp_nistz256_point_add_nohw,
|
||||
ecp_nistz256_point_add_affine_nohw,
|
||||
});
|
||||
if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
|
||||
impls.push_back({
|
||||
"ADX",
|
||||
ecp_nistz256_neg,
|
||||
ecp_nistz256_mul_mont_adx,
|
||||
ecp_nistz256_sqr_mont_adx,
|
||||
ecp_nistz256_ord_mul_mont_adx,
|
||||
ecp_nistz256_ord_sqr_mont_adx,
|
||||
ecp_nistz256_point_double_adx,
|
||||
ecp_nistz256_point_add_adx,
|
||||
ecp_nistz256_point_add_affine_adx,
|
||||
});
|
||||
}
|
||||
#else
|
||||
impls.push_back({
|
||||
"Impl",
|
||||
ecp_nistz256_neg,
|
||||
ecp_nistz256_mul_mont,
|
||||
ecp_nistz256_sqr_mont,
|
||||
ecp_nistz256_ord_mul_mont,
|
||||
ecp_nistz256_ord_sqr_mont,
|
||||
ecp_nistz256_point_double,
|
||||
ecp_nistz256_point_add,
|
||||
ecp_nistz256_point_add_affine,
|
||||
});
|
||||
#endif
|
||||
return impls;
|
||||
}
|
||||
|
||||
class P256NistzImplTest : public testing::TestWithParam<P256NistzImpl> {
|
||||
protected:
|
||||
const P256NistzImpl &impl() const { return GetParam(); }
|
||||
};
|
||||
|
||||
INSTANTIATE_TEST_SUITE_P(All, P256NistzImplTest,
|
||||
testing::ValuesIn(AllP256NistzImpls()),
|
||||
[](const testing::TestParamInfo<P256NistzImpl> ¶ms)
|
||||
-> std::string { return params.param.name; });
|
||||
|
||||
static void TestNegate(FileTest *t, const P256NistzImpl &impl) {
|
||||
BN_ULONG a[P256_LIMBS], b[P256_LIMBS];
|
||||
ASSERT_TRUE(GetFieldElement(t, a, "A"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b, "B"));
|
||||
|
||||
// Test that -A = B.
|
||||
BN_ULONG ret[P256_LIMBS];
|
||||
impl.neg(ret, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(b, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
impl.neg(ret, ret /* a */);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(b, ret);
|
||||
|
||||
// Test that -B = A.
|
||||
impl.neg(ret, b);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(a, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
impl.neg(ret, ret /* b */);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(a, ret);
|
||||
}
|
||||
|
||||
static void TestMulMont(FileTest *t, const P256NistzImpl &impl) {
|
||||
BN_ULONG a[P256_LIMBS], b[P256_LIMBS], result[P256_LIMBS];
|
||||
ASSERT_TRUE(GetFieldElement(t, a, "A"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b, "B"));
|
||||
ASSERT_TRUE(GetFieldElement(t, result, "Result"));
|
||||
|
||||
BN_ULONG ret[P256_LIMBS];
|
||||
impl.mul_mont(ret, a, b);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
impl.mul_mont(ret, b, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
impl.mul_mont(ret, ret /* a */, b);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
impl.mul_mont(ret, b, ret);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
impl.mul_mont(ret, a, ret /* b */);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
impl.mul_mont(ret, ret /* b */, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
if (OPENSSL_memcmp(a, b, sizeof(a)) == 0) {
|
||||
impl.sqr_mont(ret, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
impl.sqr_mont(ret, ret /* a */);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
}
|
||||
}
|
||||
|
||||
static void TestPointAdd(FileTest *t, const P256NistzImpl &impl) {
|
||||
P256_POINT a, b;
|
||||
P256_POINT_AFFINE result;
|
||||
ASSERT_TRUE(GetFieldElement(t, a.X, "A.X"));
|
||||
ASSERT_TRUE(GetFieldElement(t, a.Y, "A.Y"));
|
||||
ASSERT_TRUE(GetFieldElement(t, a.Z, "A.Z"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b.X, "B.X"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b.Y, "B.Y"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b.Z, "B.Z"));
|
||||
ASSERT_TRUE(GetFieldElement(t, result.X, "Result.X"));
|
||||
ASSERT_TRUE(GetFieldElement(t, result.Y, "Result.Y"));
|
||||
|
||||
P256_POINT ret;
|
||||
impl.point_add(&ret, &a, &b);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
|
||||
impl.point_add(&ret, &b, &a);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
|
||||
OPENSSL_memcpy(&ret, &a, sizeof(ret));
|
||||
impl.point_add(&ret, &ret /* a */, &b);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
|
||||
OPENSSL_memcpy(&ret, &a, sizeof(ret));
|
||||
impl.point_add(&ret, &b, &ret /* a */);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
|
||||
OPENSSL_memcpy(&ret, &b, sizeof(ret));
|
||||
impl.point_add(&ret, &a, &ret /* b */);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
|
||||
OPENSSL_memcpy(&ret, &b, sizeof(ret));
|
||||
impl.point_add(&ret, &ret /* b */, &a);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
|
||||
P256_POINT_AFFINE a_affine, b_affine, infinity;
|
||||
OPENSSL_memset(&infinity, 0, sizeof(infinity));
|
||||
ASSERT_TRUE(PointToAffine(&a_affine, &a));
|
||||
ASSERT_TRUE(PointToAffine(&b_affine, &b));
|
||||
|
||||
// ecp_nistz256_point_add_affine does not work when a == b unless doubling the
|
||||
// point at infinity.
|
||||
if (OPENSSL_memcmp(&a_affine, &b_affine, sizeof(a_affine)) != 0 ||
|
||||
OPENSSL_memcmp(&a_affine, &infinity, sizeof(a_affine)) == 0) {
|
||||
impl.point_add_affine(&ret, &a, &b_affine);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
|
||||
OPENSSL_memcpy(&ret, &a, sizeof(ret));
|
||||
impl.point_add_affine(&ret, &ret /* a */, &b_affine);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
|
||||
impl.point_add_affine(&ret, &b, &a_affine);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
|
||||
OPENSSL_memcpy(&ret, &b, sizeof(ret));
|
||||
impl.point_add_affine(&ret, &ret /* b */, &a_affine);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
}
|
||||
|
||||
if (OPENSSL_memcmp(&a, &b, sizeof(a)) == 0) {
|
||||
impl.point_double(&ret, &a);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
|
||||
ret = a;
|
||||
impl.point_double(&ret, &ret /* a */);
|
||||
EXPECT_POINTS_EQUAL(&result, &ret);
|
||||
}
|
||||
}
|
||||
|
||||
static void TestOrdMulMont(FileTest *t, const P256NistzImpl &impl) {
|
||||
// This test works on scalars rather than field elements, but the
|
||||
// representation is the same.
|
||||
BN_ULONG a[P256_LIMBS], b[P256_LIMBS], result[P256_LIMBS];
|
||||
ASSERT_TRUE(GetFieldElement(t, a, "A"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b, "B"));
|
||||
ASSERT_TRUE(GetFieldElement(t, result, "Result"));
|
||||
|
||||
BN_ULONG ret[P256_LIMBS];
|
||||
impl.ord_mul_mont(ret, a, b);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
impl.ord_mul_mont(ret, b, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
impl.ord_mul_mont(ret, ret /* a */, b);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
impl.ord_mul_mont(ret, b, ret);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
impl.ord_mul_mont(ret, a, ret /* b */);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
impl.ord_mul_mont(ret, ret /* b */, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
if (OPENSSL_memcmp(a, b, sizeof(a)) == 0) {
|
||||
impl.ord_sqr_mont(ret, a, 1);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
impl.ord_sqr_mont(ret, ret /* a */, 1);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
}
|
||||
}
|
||||
|
||||
TEST_P(P256NistzImplTest, TestVectors) {
|
||||
return FileTestGTest("crypto/fipsmodule/ec/p256-nistz_tests.txt",
|
||||
[&](FileTest *t) {
|
||||
if (t->GetParameter() == "Negate") {
|
||||
TestNegate(t, impl());
|
||||
} else if (t->GetParameter() == "MulMont") {
|
||||
TestMulMont(t, impl());
|
||||
} else if (t->GetParameter() == "PointAdd") {
|
||||
TestPointAdd(t, impl());
|
||||
} else if (t->GetParameter() == "OrdMulMont") {
|
||||
TestOrdMulMont(t, impl());
|
||||
} else {
|
||||
FAIL() << "Unknown test type:" << t->GetParameter();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// Instrument the functions covered in TestVectors for ABI checking.
|
||||
TEST_P(P256NistzImplTest, ABI) {
|
||||
BN_ULONG a[P256_LIMBS], b[P256_LIMBS], c[P256_LIMBS];
|
||||
OPENSSL_memset(a, 0x01, sizeof(a));
|
||||
// These functions are all branchless, so it is only necessary to
|
||||
// instrument one call each for ABI checking.
|
||||
CHECK_ABI(impl().neg, b, a);
|
||||
CHECK_ABI(impl().mul_mont, c, a, b);
|
||||
CHECK_ABI(impl().sqr_mont, c, a);
|
||||
CHECK_ABI(impl().ord_mul_mont, c, a, b);
|
||||
|
||||
// Check a few different loop counts.
|
||||
CHECK_ABI(impl().ord_sqr_mont, b, a, 1);
|
||||
CHECK_ABI(impl().ord_sqr_mont, b, a, 3);
|
||||
|
||||
// Point addition has some special cases around infinity and doubling. Test
|
||||
// a few different scenarios.
|
||||
static const P256_POINT kA = {
|
||||
{TOBN(0x60559ac7, 0xc8d0d89d), TOBN(0x6cda3400, 0x545f7e2c),
|
||||
TOBN(0x9b5159e0, 0x323e6048), TOBN(0xcb8dea33, 0x27057fe6)},
|
||||
{TOBN(0x81a2d3bc, 0xc93a2d53), TOBN(0x81f40762, 0xa4f33ccf),
|
||||
TOBN(0xc3c3300a, 0xa8ad50ea), TOBN(0x553de89b, 0x31719830)},
|
||||
{TOBN(0x3fd9470f, 0xb277d181), TOBN(0xc191b8d5, 0x6376f206),
|
||||
TOBN(0xb2572c1f, 0x45eda26f), TOBN(0x4589e40d, 0xf2efc546)},
|
||||
};
|
||||
static const P256_POINT kB = {
|
||||
{TOBN(0x3cf0b0aa, 0x92054341), TOBN(0xb949bb80, 0xdab57807),
|
||||
TOBN(0x99de6814, 0xefd21b3e), TOBN(0x32ad5649, 0x7c6c6e83)},
|
||||
{TOBN(0x06afaa02, 0x688399e0), TOBN(0x75f2d096, 0x2a3ce65c),
|
||||
TOBN(0xf6a31eb7, 0xca0244b3), TOBN(0x57b33b7a, 0xcfeee75e)},
|
||||
{TOBN(0x7617d2e0, 0xb4f1d35f), TOBN(0xa922cb10, 0x7f592b65),
|
||||
TOBN(0x12fd6c7a, 0x51a2f474), TOBN(0x337d5e1e, 0xc2fc711b)},
|
||||
};
|
||||
// This file represents Jacobian infinity as (*, *, 0).
|
||||
static const P256_POINT kInfinity = {
|
||||
{TOBN(0, 0), TOBN(0, 0), TOBN(0, 0), TOBN(0, 0)},
|
||||
{TOBN(0, 0), TOBN(0, 0), TOBN(0, 0), TOBN(0, 0)},
|
||||
{TOBN(0, 0), TOBN(0, 0), TOBN(0, 0), TOBN(0, 0)},
|
||||
};
|
||||
|
||||
P256_POINT p;
|
||||
CHECK_ABI(impl().point_add, &p, &kA, &kB);
|
||||
CHECK_ABI(impl().point_add, &p, &kA, &kA);
|
||||
OPENSSL_memcpy(&p, &kA, sizeof(P256_POINT));
|
||||
impl().neg(p.Y, p.Y);
|
||||
CHECK_ABI(impl().point_add, &p, &kA, &p); // A + -A
|
||||
CHECK_ABI(impl().point_add, &p, &kA, &kInfinity);
|
||||
CHECK_ABI(impl().point_add, &p, &kInfinity, &kA);
|
||||
CHECK_ABI(impl().point_add, &p, &kInfinity, &kInfinity);
|
||||
CHECK_ABI(impl().point_double, &p, &kA);
|
||||
CHECK_ABI(impl().point_double, &p, &kInfinity);
|
||||
|
||||
static const P256_POINT_AFFINE kC = {
|
||||
{TOBN(0x7e3ad339, 0xfb3fa5f0), TOBN(0x559d669d, 0xe3a047b2),
|
||||
TOBN(0x8883b298, 0x7042e595), TOBN(0xfabada65, 0x7e477f08)},
|
||||
{TOBN(0xd9cfceb8, 0xda1c3e85), TOBN(0x80863761, 0x0ce6d6bc),
|
||||
TOBN(0xa8409d84, 0x66034f02), TOBN(0x05519925, 0x31a68d55)},
|
||||
};
|
||||
// This file represents affine infinity as (0, 0).
|
||||
static const P256_POINT_AFFINE kInfinityAffine = {
|
||||
{TOBN(0, 0), TOBN(0, 0), TOBN(0, 0), TOBN(0, 0)},
|
||||
{TOBN(0, 0), TOBN(0, 0), TOBN(0, 0), TOBN(0, 0)},
|
||||
};
|
||||
|
||||
CHECK_ABI(impl().point_add_affine, &p, &kA, &kC);
|
||||
CHECK_ABI(impl().point_add_affine, &p, &kA, &kInfinityAffine);
|
||||
CHECK_ABI(impl().point_add_affine, &p, &kInfinity, &kInfinityAffine);
|
||||
CHECK_ABI(impl().point_add_affine, &p, &kInfinity, &kC);
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
} // namespace
|
||||
BSSL_NAMESPACE_END
|
||||
+404
-516
File diff suppressed because it is too large
Load Diff
@@ -1,193 +0,0 @@
|
||||
// Copyright 2026 The BoringSSL Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// https://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#ifndef OPENSSL_HEADER_EC_P256_INTERNAL_H
|
||||
#define OPENSSL_HEADER_EC_P256_INTERNAL_H
|
||||
|
||||
#include <openssl/base.h>
|
||||
#include <openssl/bn.h>
|
||||
|
||||
#include "../../internal.h"
|
||||
#include "../../../third_party/fiat/bedrock_unverified_platform.c.inc"
|
||||
|
||||
#define P256_LIMBS (32 / sizeof(bssl::crypto_word_t))
|
||||
typedef bssl::crypto_word_t fiat_p256_felem[P256_LIMBS];
|
||||
|
||||
|
||||
// Choose implementation of arithmetic in the coordinate field.
|
||||
|
||||
#if defined(BORINGSSL_HAS_UINT128)
|
||||
#include "../../../third_party/fiat/p256_field_64.br.c.inc"
|
||||
|
||||
#include "../../../third_party/fiat/p256_64.h"
|
||||
#elif defined(OPENSSL_64_BIT)
|
||||
#include "../../../third_party/fiat/p256_field_64.br.c.inc"
|
||||
|
||||
#include "../../../third_party/fiat/p256_64_msvc.h"
|
||||
#else
|
||||
#include "../../../third_party/fiat/p256_field_32.br.c.inc"
|
||||
|
||||
#include "../../../third_party/fiat/p256_32.h"
|
||||
// Add Bedrock versions of p256_32.h functions for p256_point.br.c.inc to call.
|
||||
static inline void p256_coord_add(br_word_t out, br_word_t x, br_word_t y) {
|
||||
fiat_p256_add((uint32_t *)out, (const uint32_t *)x, (const uint32_t *)y);
|
||||
}
|
||||
static inline void p256_coord_sub(br_word_t out, br_word_t x, br_word_t y) {
|
||||
fiat_p256_sub((uint32_t *)out, (const uint32_t *)x, (const uint32_t *)y);
|
||||
}
|
||||
#endif
|
||||
|
||||
extern "C" {
|
||||
#if !defined(OPENSSL_NO_ASM) && (defined(__ELF__) || defined(__APPLE__)) && \
|
||||
defined(OPENSSL_X86_64) && !defined(OPENSSL_NANOLIBC)
|
||||
// These functions are only available with gas and SysV ABI, used by Apple and
|
||||
// ELF-based platforms. Unlike most of our SysV assembly, they currently rely on
|
||||
// the SysV redzone. This trips one target which looks like it targets SysV but
|
||||
// has no redzone. This happens to define `OPENSSL_NANOLIBC`, so gate on that.
|
||||
//
|
||||
// TODO(crbug.com/522255483): Come up with a clearer story for the redzone
|
||||
// situation.
|
||||
#define FIAT_P256_ADX_ASM
|
||||
void fiat_p256_adx_mul(uint64_t x0[4], const uint64_t x1[4],
|
||||
const uint64_t x2[4]);
|
||||
void fiat_p256_adx_sqr(uint64_t x0[4], const uint64_t x1[4]);
|
||||
#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
|
||||
void ecp_nistz256_mul_mont(uint64_t pr[4], const uint64_t py[4], uint64_t y0,
|
||||
uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3);
|
||||
void ecp_nistz256_sqr_mont(uint64_t pr[4], const uint64_t py[4], uint64_t y0,
|
||||
uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3);
|
||||
#endif
|
||||
}
|
||||
|
||||
static inline void p256_coord_mul(fiat_p256_felem out, const fiat_p256_felem x,
|
||||
const fiat_p256_felem y) {
|
||||
#if defined(FIAT_P256_ADX_ASM)
|
||||
if (bssl::CRYPTO_is_BMI1_capable() && bssl::CRYPTO_is_BMI2_capable() &&
|
||||
bssl::CRYPTO_is_ADX_capable()) {
|
||||
return fiat_p256_adx_mul(out, x, y);
|
||||
}
|
||||
fiat_p256_mul(out, x, y);
|
||||
#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
|
||||
ecp_nistz256_mul_mont(out, y, y[0], x[0], x[1], x[2], x[3]);
|
||||
#else
|
||||
fiat_p256_mul(out, x, y);
|
||||
#endif
|
||||
}
|
||||
|
||||
static inline void p256_coord_sqr(fiat_p256_felem out,
|
||||
const fiat_p256_felem x) {
|
||||
#if defined(FIAT_P256_ADX_ASM)
|
||||
if (bssl::CRYPTO_is_BMI1_capable() && bssl::CRYPTO_is_BMI2_capable() &&
|
||||
bssl::CRYPTO_is_ADX_capable()) {
|
||||
return fiat_p256_adx_sqr(out, x);
|
||||
}
|
||||
fiat_p256_square(out, x);
|
||||
#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
|
||||
ecp_nistz256_sqr_mont(out, x, x[0], x[0], x[1], x[2], x[3]);
|
||||
#else
|
||||
fiat_p256_square(out, x);
|
||||
#endif
|
||||
}
|
||||
|
||||
// Add Bedrock versions of these functions for p256_point.br.c.inc to call.
|
||||
static inline void p256_coord_mul(br_word_t out, br_word_t x, br_word_t y) {
|
||||
p256_coord_mul((br_word_t *)out, (const br_word_t *)x, (const br_word_t *)y);
|
||||
}
|
||||
|
||||
static inline void p256_coord_sqr(br_word_t out, br_word_t x) {
|
||||
p256_coord_sqr((br_word_t *)out, (const br_word_t *)x);
|
||||
}
|
||||
|
||||
|
||||
// Choose implementation of arithmetic in the field modulo curve order.
|
||||
|
||||
extern "C" {
|
||||
|
||||
#if !defined(OPENSSL_NO_ASM) && \
|
||||
(defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64))
|
||||
// beeu_mod_inverse_vartime sets out = a^-1 mod p using a Euclidean algorithm.
|
||||
// Assumption: 0 < a < p < 2^(256) and p is odd.
|
||||
int beeu_mod_inverse_vartime(BN_ULONG out[4], const BN_ULONG a[4],
|
||||
const BN_ULONG p[4]);
|
||||
#endif
|
||||
|
||||
// P-256 scalar operations.
|
||||
//
|
||||
// The following functions compute modulo N, where N is the order of P-256. They
|
||||
// take fully-reduced inputs and give fully-reduced outputs.
|
||||
|
||||
#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
|
||||
// ecp_nistz256_ord_mul_mont sets `res` to `a` * `b` where inputs and outputs
|
||||
// are in Montgomery form. That is, `res` is `a` * `b` * 2^-256 mod N.
|
||||
void ecp_nistz256_ord_mul_mont(BN_ULONG res[4], const BN_ULONG a[4],
|
||||
const BN_ULONG b[4]);
|
||||
|
||||
// ecp_nistz256_ord_sqr_mont sets `res` to `a`^(2*`rep`) where inputs and
|
||||
// outputs are in Montgomery form. That is, `res` is
|
||||
// (`a` * 2^-256)^(2*`rep`) * 2^256 mod N.
|
||||
void ecp_nistz256_ord_sqr_mont(BN_ULONG res[4], const BN_ULONG a[4],
|
||||
BN_ULONG rep);
|
||||
|
||||
#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64)
|
||||
void ecp_nistz256_ord_mul_mont_nohw(BN_ULONG res[4], const BN_ULONG a[4],
|
||||
const BN_ULONG b[4]);
|
||||
void ecp_nistz256_ord_mul_mont_adx(BN_ULONG res[4], const BN_ULONG a[4],
|
||||
const BN_ULONG b[4]);
|
||||
|
||||
void ecp_nistz256_ord_sqr_mont_nohw(BN_ULONG res[4], const BN_ULONG a[4],
|
||||
BN_ULONG rep);
|
||||
void ecp_nistz256_ord_sqr_mont_adx(BN_ULONG res[4], const BN_ULONG a[4],
|
||||
BN_ULONG rep);
|
||||
#endif
|
||||
|
||||
} // extern C
|
||||
|
||||
static inline void p256_order_mul(const EC_GROUP *group,
|
||||
BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS],
|
||||
const BN_ULONG b[P256_LIMBS]) {
|
||||
#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
|
||||
return ecp_nistz256_ord_mul_mont(res, a, b);
|
||||
#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64)
|
||||
if (bssl::CRYPTO_is_BMI2_capable() && bssl::CRYPTO_is_ADX_capable()) {
|
||||
return ecp_nistz256_ord_mul_mont_adx(res, a, b);
|
||||
}
|
||||
return ecp_nistz256_ord_mul_mont_nohw(res, a, b);
|
||||
#else
|
||||
const BIGNUM *order = &group->order.N;
|
||||
bssl::bn_mod_mul_montgomery_small(res, a, b, order->width, &group->order);
|
||||
#endif
|
||||
}
|
||||
|
||||
static inline void p256_order_sqr(const EC_GROUP *group,
|
||||
BN_ULONG res[P256_LIMBS],
|
||||
const BN_ULONG a[P256_LIMBS], BN_ULONG rep) {
|
||||
#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
|
||||
return ecp_nistz256_ord_sqr_mont(res, a, rep);
|
||||
#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64)
|
||||
if (bssl::CRYPTO_is_BMI2_capable() && bssl::CRYPTO_is_ADX_capable()) {
|
||||
return ecp_nistz256_ord_sqr_mont_adx(res, a, rep);
|
||||
}
|
||||
return ecp_nistz256_ord_sqr_mont_nohw(res, a, rep);
|
||||
#else
|
||||
bssl::OPENSSL_memmove(res, a, sizeof(BN_ULONG) * P256_LIMBS);
|
||||
for (BN_ULONG i = 0; i < rep; i++) {
|
||||
p256_order_mul(group, res, res, res);
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
#include "../../../third_party/fiat/p256_point.br.c.inc"
|
||||
|
||||
#endif // OPENSSL_HEADER_EC_P256_INTERNAL_H
|
||||
@@ -12,26 +12,21 @@
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#if !defined(BORINGSSL_SHARED_LIBRARY) // These tests use p256_internal.h
|
||||
|
||||
#include <openssl/base.h>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/ec.h>
|
||||
#include <openssl/mem.h>
|
||||
#include <openssl/nid.h>
|
||||
|
||||
#include <gtest/gtest.h>
|
||||
#include "../../internal.h"
|
||||
#include "../../test/abi_test.h"
|
||||
#include "../../test/file_test.h"
|
||||
#include "internal.h"
|
||||
#include "p256_internal.h"
|
||||
|
||||
|
||||
BSSL_NAMESPACE_BEGIN
|
||||
namespace {
|
||||
|
||||
#if defined(FIAT_P256_ADX_ASM) && defined(SUPPORTS_ABI_TEST)
|
||||
#if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) && defined(__x86_64__) && \
|
||||
defined(SUPPORTS_ABI_TEST)
|
||||
extern "C" {
|
||||
#include "../../../third_party/fiat/p256_field.c.inc"
|
||||
}
|
||||
|
||||
TEST(P256Test, CoordMulAdxABI) {
|
||||
TEST(P256Test, AdxMulABI) {
|
||||
static const uint64_t in1[4] = {0}, in2[4] = {0};
|
||||
uint64_t out[4];
|
||||
if (CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable() &&
|
||||
@@ -42,7 +37,8 @@ TEST(P256Test, CoordMulAdxABI) {
|
||||
}
|
||||
}
|
||||
|
||||
TEST(P256Test, CoordSqrAdxABI) {
|
||||
#include <assert.h>
|
||||
TEST(P256Test, AdxSquareABI) {
|
||||
static const uint64_t in[4] = {0};
|
||||
uint64_t out[4];
|
||||
if (CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable() &&
|
||||
@@ -52,505 +48,7 @@ TEST(P256Test, CoordSqrAdxABI) {
|
||||
GTEST_SKIP() << "Can't test ABI of ADX code without ADX";
|
||||
}
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64) && \
|
||||
defined(SUPPORTS_ABI_TEST)
|
||||
|
||||
TEST(P256Test, CoordMulABI) {
|
||||
static const uint64_t x[4] = {0}, y[4] = {0};
|
||||
uint64_t out[4];
|
||||
CHECK_ABI(ecp_nistz256_mul_mont, out, y, y[0], x[0], x[1], x[2], x[3]);
|
||||
}
|
||||
|
||||
TEST(P256Test, CoordSqrABI) {
|
||||
static const uint64_t x[4] = {0};
|
||||
uint64_t out[4];
|
||||
CHECK_ABI(ecp_nistz256_sqr_mont, out, x, x[0], x[0], x[1], x[2], x[3]);
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \
|
||||
defined(SUPPORTS_ABI_TEST)
|
||||
|
||||
TEST(P256Test, OrdMulAdxABI) {
|
||||
static const uint64_t in1[4] = {0}, in2[4] = {0};
|
||||
uint64_t out[4];
|
||||
if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
|
||||
CHECK_ABI(ecp_nistz256_ord_mul_mont_adx, out, in1, in2);
|
||||
} else {
|
||||
GTEST_SKIP() << "Can't test ABI of ADX code without ADX";
|
||||
}
|
||||
}
|
||||
|
||||
TEST(P256Test, OrdSqrAdxABI) {
|
||||
static const uint64_t in[4] = {0};
|
||||
uint64_t out[4];
|
||||
if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) {
|
||||
CHECK_ABI(ecp_nistz256_ord_sqr_mont_adx, out, in, 1);
|
||||
} else {
|
||||
GTEST_SKIP() << "Can't test ABI of ADX code without ADX";
|
||||
}
|
||||
}
|
||||
|
||||
TEST(P256Test, OrdMulNohwABI) {
|
||||
static const uint64_t in1[4] = {0}, in2[4] = {0};
|
||||
uint64_t out[4];
|
||||
CHECK_ABI(ecp_nistz256_ord_mul_mont_nohw, out, in1, in2);
|
||||
}
|
||||
|
||||
TEST(P256Test, OrdSqrNohwABI) {
|
||||
static const uint64_t in[4] = {0};
|
||||
uint64_t out[4];
|
||||
CHECK_ABI(ecp_nistz256_ord_sqr_mont_nohw, out, in, 1);
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
typedef fiat_p256_felem P256_POINT_AFFINE[2];
|
||||
typedef fiat_p256_felem P256_POINT[3];
|
||||
|
||||
static inline void point_add(P256_POINT ret, P256_POINT p, P256_POINT q) {
|
||||
p256_point_add_vartime_if_doubling((uintptr_t)ret, (uintptr_t)p,
|
||||
(uintptr_t)q);
|
||||
}
|
||||
|
||||
static inline void point_add_affine(P256_POINT ret, P256_POINT a,
|
||||
P256_POINT b_affine) {
|
||||
uintptr_t bnz = 0;
|
||||
bnz |= b_affine[0][0] | b_affine[0][1] | b_affine[0][2] | b_affine[0][3];
|
||||
bnz |= b_affine[1][0] | b_affine[1][1] | b_affine[1][2] | b_affine[1][3];
|
||||
p256_point_add_affinenz_conditional_vartime_if_doubling(
|
||||
(uintptr_t)ret, (uintptr_t)a, (uintptr_t)b_affine, (uintptr_t)bnz);
|
||||
}
|
||||
|
||||
static inline void point_double(P256_POINT ret, P256_POINT a) {
|
||||
p256_point_double((uintptr_t)ret, (uintptr_t)a);
|
||||
}
|
||||
|
||||
static bool GetFieldElement(FileTest *t, BN_ULONG out[P256_LIMBS],
|
||||
const char *name) {
|
||||
std::vector<uint8_t> bytes;
|
||||
if (!t->GetBytes(&bytes, name)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (bytes.size() != BN_BYTES * P256_LIMBS) {
|
||||
ADD_FAILURE() << "Invalid length: " << name;
|
||||
return false;
|
||||
}
|
||||
|
||||
// `byte` contains bytes in big-endian while `out` should contain `BN_ULONG`s
|
||||
// in little-endian.
|
||||
OPENSSL_memset(out, 0, P256_LIMBS * sizeof(BN_ULONG));
|
||||
for (size_t i = 0; i < bytes.size(); i++) {
|
||||
out[P256_LIMBS - 1 - (i / BN_BYTES)] <<= 8;
|
||||
out[P256_LIMBS - 1 - (i / BN_BYTES)] |= bytes[i];
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
static std::string FieldElementToString(const BN_ULONG a[P256_LIMBS]) {
|
||||
std::string ret;
|
||||
for (size_t i = P256_LIMBS - 1; i < P256_LIMBS; i--) {
|
||||
char buf[2 * BN_BYTES + 1];
|
||||
snprintf(buf, sizeof(buf), BN_HEX_FMT2, a[i]);
|
||||
ret += buf;
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
static testing::AssertionResult ExpectFieldElementsEqual(
|
||||
const char *expected_expr, const char *actual_expr,
|
||||
const BN_ULONG expected[P256_LIMBS], const BN_ULONG actual[P256_LIMBS]) {
|
||||
if (OPENSSL_memcmp(expected, actual, sizeof(BN_ULONG) * P256_LIMBS) == 0) {
|
||||
return testing::AssertionSuccess();
|
||||
}
|
||||
|
||||
return testing::AssertionFailure()
|
||||
<< "Expected: " << FieldElementToString(expected) << " ("
|
||||
<< expected_expr << ")\n"
|
||||
<< "Actual: " << FieldElementToString(actual) << " (" << actual_expr
|
||||
<< ")";
|
||||
}
|
||||
|
||||
#define EXPECT_FIELD_ELEMENTS_EQUAL(a, b) \
|
||||
EXPECT_PRED_FORMAT2(ExpectFieldElementsEqual, a, b)
|
||||
|
||||
// P-256 scalars and field elements are the same size.
|
||||
#define EXPECT_SCALARS_EQUAL(a, b) EXPECT_FIELD_ELEMENTS_EQUAL(a, b)
|
||||
|
||||
#if !defined(OPENSSL_NO_ASM) && \
|
||||
(defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64))
|
||||
TEST(P256Test, BEEU) {
|
||||
#if defined(OPENSSL_X86_64)
|
||||
if (!CRYPTO_is_AVX_capable()) {
|
||||
// No AVX support; cannot run the BEEU code.
|
||||
return;
|
||||
}
|
||||
#endif
|
||||
|
||||
const EC_GROUP *group = EC_group_p256();
|
||||
BN_ULONG order_words[P256_LIMBS];
|
||||
ASSERT_TRUE(
|
||||
bn_copy_words(order_words, P256_LIMBS, EC_GROUP_get0_order(group)));
|
||||
|
||||
BN_ULONG in[P256_LIMBS], out[P256_LIMBS];
|
||||
EC_SCALAR in_scalar, out_scalar, result;
|
||||
OPENSSL_memset(in, 0, sizeof(in));
|
||||
|
||||
// Trying to find the inverse of zero should fail.
|
||||
ASSERT_FALSE(beeu_mod_inverse_vartime(out, in, order_words));
|
||||
// This is not a constant-time function, so instrument both zero and a few
|
||||
// inputs below.
|
||||
ASSERT_FALSE(CHECK_ABI(beeu_mod_inverse_vartime, out, in, order_words));
|
||||
|
||||
BN_ULONG kOne[P256_LIMBS] = {};
|
||||
kOne[0] = 1;
|
||||
|
||||
auto beeu_test = [&] {
|
||||
EXPECT_TRUE(bn_less_than_words(in, order_words, P256_LIMBS));
|
||||
ASSERT_TRUE(beeu_mod_inverse_vartime(out, in, order_words));
|
||||
EXPECT_TRUE(bn_less_than_words(out, order_words, P256_LIMBS));
|
||||
|
||||
// Calculate out*in and confirm that it equals one, modulo the order. We
|
||||
// only have Montgomery multiplication, but if we convert one input, and not
|
||||
// the other, this gives the result outside the Montgomery domain.
|
||||
OPENSSL_memcpy(in_scalar.words, in, sizeof(in));
|
||||
OPENSSL_memcpy(out_scalar.words, out, sizeof(out));
|
||||
ec_scalar_to_montgomery(group, &in_scalar, &in_scalar);
|
||||
ec_scalar_mul_montgomery(group, &result, &in_scalar, &out_scalar);
|
||||
EXPECT_SCALARS_EQUAL(kOne, result.words);
|
||||
|
||||
// Invert the result and expect to get back to the original value.
|
||||
ASSERT_TRUE(beeu_mod_inverse_vartime(out, out, order_words));
|
||||
EXPECT_SCALARS_EQUAL(in, out);
|
||||
};
|
||||
|
||||
for (BN_ULONG i = 1; i < 2000; i++) {
|
||||
SCOPED_TRACE(i);
|
||||
in[0] = i;
|
||||
if (i >= 1000) {
|
||||
in[1] = i << 8;
|
||||
in[2] = i << 32;
|
||||
in[3] = i << 48;
|
||||
} else {
|
||||
in[1] = in[2] = in[3] = 0;
|
||||
}
|
||||
|
||||
beeu_test();
|
||||
if (i < 5) {
|
||||
EXPECT_TRUE(CHECK_ABI(beeu_mod_inverse_vartime, out, in, order_words));
|
||||
}
|
||||
}
|
||||
|
||||
for (int i = 0; i < 255; i++) {
|
||||
SCOPED_TRACE(i);
|
||||
// Test `in` = 2^i.
|
||||
OPENSSL_memset(in, 0, sizeof(in));
|
||||
in[i / BN_BITS2] = BN_ULONG{1} << (i % BN_BITS2);
|
||||
beeu_test();
|
||||
|
||||
// Test `in` = N - 2^i.
|
||||
bn_sub_words(in, order_words, in, P256_LIMBS);
|
||||
beeu_test();
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
static void TestNegate(FileTest *t) {
|
||||
fiat_p256_felem a, b;
|
||||
ASSERT_TRUE(GetFieldElement(t, a, "A"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b, "B"));
|
||||
|
||||
// Test that -A = B.
|
||||
BN_ULONG ret[P256_LIMBS];
|
||||
fiat_p256_opp(ret, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(b, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
fiat_p256_opp(ret, ret /* a */);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(b, ret);
|
||||
|
||||
// Test that -B = A.
|
||||
fiat_p256_opp(ret, b);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(a, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
fiat_p256_opp(ret, ret /* b */);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(a, ret);
|
||||
}
|
||||
|
||||
static void TestMulMont(FileTest *t) {
|
||||
BN_ULONG a[P256_LIMBS], b[P256_LIMBS], result[P256_LIMBS];
|
||||
ASSERT_TRUE(GetFieldElement(t, a, "A"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b, "B"));
|
||||
ASSERT_TRUE(GetFieldElement(t, result, "Result"));
|
||||
|
||||
BN_ULONG ret[P256_LIMBS];
|
||||
p256_coord_mul(ret, a, b);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
p256_coord_mul(ret, b, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
p256_coord_mul(ret, ret /* a */, b);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
p256_coord_mul(ret, b, ret);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
p256_coord_mul(ret, a, ret /* b */);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
p256_coord_mul(ret, ret /* b */, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
if (OPENSSL_memcmp(a, b, sizeof(a)) == 0) {
|
||||
p256_coord_sqr(ret, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
p256_coord_sqr(ret, ret /* a */);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
}
|
||||
}
|
||||
|
||||
static void TestFromMont(FileTest *t) {
|
||||
BN_ULONG a[P256_LIMBS], result[P256_LIMBS];
|
||||
ASSERT_TRUE(GetFieldElement(t, a, "A"));
|
||||
ASSERT_TRUE(GetFieldElement(t, result, "Result"));
|
||||
|
||||
BN_ULONG ret[P256_LIMBS];
|
||||
fiat_p256_from_montgomery(ret, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
fiat_p256_from_montgomery(ret, ret /* a */);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
}
|
||||
|
||||
static void TestOrdMulMont(FileTest *t) {
|
||||
// This test works on scalars rather than field elements, but the
|
||||
// representation is the same.
|
||||
BN_ULONG a[P256_LIMBS], b[P256_LIMBS], result[P256_LIMBS];
|
||||
ASSERT_TRUE(GetFieldElement(t, a, "A"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b, "B"));
|
||||
ASSERT_TRUE(GetFieldElement(t, result, "Result"));
|
||||
SCOPED_TRACE(FieldElementToString(a));
|
||||
SCOPED_TRACE(FieldElementToString(b));
|
||||
|
||||
const EC_GROUP *group = EC_group_p256();
|
||||
BN_ULONG ret[P256_LIMBS];
|
||||
p256_order_mul(group, ret, a, b);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
p256_order_mul(group, ret, b, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
p256_order_mul(group, ret, ret /* a */, b);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
p256_order_mul(group, ret, b, ret);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
p256_order_mul(group, ret, a, ret /* b */);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
p256_order_mul(group, ret, ret /* b */, a);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
if (OPENSSL_memcmp(a, b, sizeof(a)) == 0) {
|
||||
p256_order_sqr(group, ret, a, 1);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
p256_order_sqr(group, ret, ret /* a */, 1);
|
||||
EXPECT_FIELD_ELEMENTS_EQUAL(result, ret);
|
||||
}
|
||||
}
|
||||
|
||||
static bool PointToAffine(P256_POINT_AFFINE out, const P256_POINT in) {
|
||||
static const uint8_t kP[] = {
|
||||
0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
|
||||
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff,
|
||||
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
|
||||
};
|
||||
|
||||
UniquePtr<BIGNUM> x(BN_new()), y(BN_new()), z(BN_new());
|
||||
UniquePtr<BIGNUM> p(BN_bin2bn(kP, sizeof(kP), nullptr));
|
||||
if (!x || !y || !z || !p || !bn_set_words(x.get(), in[0], P256_LIMBS) ||
|
||||
!bn_set_words(y.get(), in[1], P256_LIMBS) ||
|
||||
!bn_set_words(z.get(), in[2], P256_LIMBS)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Coordinates must be fully-reduced.
|
||||
if (BN_cmp(x.get(), p.get()) >= 0 || BN_cmp(y.get(), p.get()) >= 0 ||
|
||||
BN_cmp(z.get(), p.get()) >= 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (BN_is_zero(z.get())) {
|
||||
// The point at infinity is represented as (0, 0).
|
||||
OPENSSL_memset(out, 0, sizeof(P256_POINT_AFFINE));
|
||||
return true;
|
||||
}
|
||||
|
||||
UniquePtr<BN_CTX> ctx(BN_CTX_new());
|
||||
UniquePtr<BN_MONT_CTX> mont(BN_MONT_CTX_new_for_modulus(p.get(), ctx.get()));
|
||||
if (!ctx || !mont ||
|
||||
// Invert Z.
|
||||
!BN_from_montgomery(z.get(), z.get(), mont.get(), ctx.get()) ||
|
||||
!BN_mod_inverse(z.get(), z.get(), p.get(), ctx.get()) ||
|
||||
!BN_to_montgomery(z.get(), z.get(), mont.get(), ctx.get()) ||
|
||||
// Convert (X, Y, Z) to (X/Z^2, Y/Z^3).
|
||||
!BN_mod_mul_montgomery(x.get(), x.get(), z.get(), mont.get(),
|
||||
ctx.get()) ||
|
||||
!BN_mod_mul_montgomery(x.get(), x.get(), z.get(), mont.get(),
|
||||
ctx.get()) ||
|
||||
!BN_mod_mul_montgomery(y.get(), y.get(), z.get(), mont.get(),
|
||||
ctx.get()) ||
|
||||
!BN_mod_mul_montgomery(y.get(), y.get(), z.get(), mont.get(),
|
||||
ctx.get()) ||
|
||||
!BN_mod_mul_montgomery(y.get(), y.get(), z.get(), mont.get(),
|
||||
ctx.get()) ||
|
||||
!bn_copy_words(out[0], P256_LIMBS, x.get()) ||
|
||||
!bn_copy_words(out[1], P256_LIMBS, y.get())) {
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
static testing::AssertionResult ExpectPointsEqual(
|
||||
const char *expected_expr, const char *actual_expr,
|
||||
const P256_POINT_AFFINE expected, const P256_POINT actual) {
|
||||
// There are multiple representations of the same `P256_POINT`, so convert to
|
||||
// `P256_POINT_AFFINE` and compare.
|
||||
P256_POINT_AFFINE affine;
|
||||
if (!PointToAffine(affine, actual)) {
|
||||
return testing::AssertionFailure()
|
||||
<< "Could not convert " << actual_expr << " to affine: ("
|
||||
<< FieldElementToString(actual[0]) << ", "
|
||||
<< FieldElementToString(actual[1]) << ", "
|
||||
<< FieldElementToString(actual[2]) << ")";
|
||||
}
|
||||
|
||||
if (OPENSSL_memcmp(expected, affine, sizeof(P256_POINT_AFFINE)) != 0) {
|
||||
return testing::AssertionFailure()
|
||||
<< "Expected: (" << FieldElementToString(expected[0]) << ", "
|
||||
<< FieldElementToString(expected[1]) << ") (" << expected_expr
|
||||
<< "; affine)\n"
|
||||
<< "Actual: (" << FieldElementToString(affine[0]) << ", "
|
||||
<< FieldElementToString(affine[1]) << ") (affine(" << actual_expr
|
||||
<< "))\n"
|
||||
<< "ActualXYZ:(" << FieldElementToString(actual[0]) << ", "
|
||||
<< FieldElementToString(actual[1]) << ", "
|
||||
<< FieldElementToString(actual[2]) << ") (" << actual_expr << ")";
|
||||
}
|
||||
|
||||
return testing::AssertionSuccess();
|
||||
}
|
||||
|
||||
#define EXPECT_POINTS_EQUAL(a, b) EXPECT_PRED_FORMAT2(ExpectPointsEqual, a, b)
|
||||
|
||||
static void TestPointAdd(FileTest *t) {
|
||||
P256_POINT a, b;
|
||||
P256_POINT_AFFINE result;
|
||||
ASSERT_TRUE(GetFieldElement(t, a[0], "A.X"));
|
||||
ASSERT_TRUE(GetFieldElement(t, a[1], "A.Y"));
|
||||
ASSERT_TRUE(GetFieldElement(t, a[2], "A.Z"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b[0], "B.X"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b[1], "B.Y"));
|
||||
ASSERT_TRUE(GetFieldElement(t, b[2], "B.Z"));
|
||||
ASSERT_TRUE(GetFieldElement(t, result[0], "Result.X"));
|
||||
ASSERT_TRUE(GetFieldElement(t, result[1], "Result.Y"));
|
||||
|
||||
P256_POINT ret;
|
||||
point_add(ret, a, b);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
|
||||
point_add(ret, b, a);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
point_add(ret, ret /* a */, b);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
point_add(ret, b, ret /* a */);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
point_add(ret, a, ret /* b */);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
point_add(ret, ret /* b */, a);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
|
||||
P256_POINT a_affine, b_affine;
|
||||
ASSERT_TRUE(PointToAffine(a_affine, a));
|
||||
ASSERT_TRUE(PointToAffine(b_affine, b));
|
||||
static const uint64_t p256_fe_one[4] = {0x1, 0xffffffff00000000,
|
||||
0xffffffffffffffff, 0xfffffffe};
|
||||
OPENSSL_memcpy(a_affine[2], p256_fe_one, sizeof(a_affine[2]));
|
||||
OPENSSL_memcpy(b_affine[2], p256_fe_one, sizeof(b_affine[2]));
|
||||
|
||||
point_add_affine(ret, a, b_affine);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
point_add_affine(ret, ret /* a */, b_affine);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
|
||||
point_add_affine(ret, b, a_affine);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, b, sizeof(ret));
|
||||
point_add_affine(ret, ret /* b */, a_affine);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
|
||||
if (OPENSSL_memcmp(a, b, sizeof(a)) == 0) {
|
||||
point_double(ret, a);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
|
||||
OPENSSL_memcpy(ret, a, sizeof(ret));
|
||||
point_double(ret, ret /* a */);
|
||||
EXPECT_POINTS_EQUAL(result, ret);
|
||||
}
|
||||
}
|
||||
|
||||
TEST(P256Test, TestVectors) {
|
||||
return FileTestGTest("crypto/fipsmodule/ec/p256-tests.txt", [](FileTest *t) {
|
||||
if (t->GetParameter() == "Negate") {
|
||||
TestNegate(t);
|
||||
} else if (t->GetParameter() == "MulMont") {
|
||||
TestMulMont(t);
|
||||
} else if (t->GetParameter() == "FromMont") {
|
||||
TestFromMont(t);
|
||||
} else if (t->GetParameter() == "PointAdd") {
|
||||
TestPointAdd(t);
|
||||
} else if (t->GetParameter() == "OrdMulMont") {
|
||||
TestOrdMulMont(t);
|
||||
} else {
|
||||
FAIL() << "Unknown test type:" << t->GetParameter();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
} // namespace
|
||||
BSSL_NAMESPACE_END
|
||||
|
||||
#endif // !defined(BORINGSSL_SHARED_LIBRARY)
|
||||
|
||||
Generated
+1265
-224
File diff suppressed because it is too large
Load Diff
Generated
+1250
-226
File diff suppressed because it is too large
Load Diff
Generated
+1280
-224
File diff suppressed because it is too large
Load Diff
Generated
+3457
File diff suppressed because it is too large
Load Diff
Generated
+3493
File diff suppressed because it is too large
Load Diff
Generated
+3768
File diff suppressed because it is too large
Load Diff
@@ -227,14 +227,38 @@
|
||||
%define chacha20_poly1305_seal BORINGSSL_PREFIX %+ _chacha20_poly1305_seal
|
||||
%define chacha20_poly1305_seal_avx2 BORINGSSL_PREFIX %+ _chacha20_poly1305_seal_avx2
|
||||
%define chacha20_poly1305_seal_sse41 BORINGSSL_PREFIX %+ _chacha20_poly1305_seal_sse41
|
||||
%define ecp_nistz256_div_by_2 BORINGSSL_PREFIX %+ _ecp_nistz256_div_by_2
|
||||
%define ecp_nistz256_mul_by_2 BORINGSSL_PREFIX %+ _ecp_nistz256_mul_by_2
|
||||
%define ecp_nistz256_mul_by_3 BORINGSSL_PREFIX %+ _ecp_nistz256_mul_by_3
|
||||
%define ecp_nistz256_mul_mont BORINGSSL_PREFIX %+ _ecp_nistz256_mul_mont
|
||||
%define ecp_nistz256_mul_mont_adx BORINGSSL_PREFIX %+ _ecp_nistz256_mul_mont_adx
|
||||
%define ecp_nistz256_mul_mont_nohw BORINGSSL_PREFIX %+ _ecp_nistz256_mul_mont_nohw
|
||||
%define ecp_nistz256_neg BORINGSSL_PREFIX %+ _ecp_nistz256_neg
|
||||
%define ecp_nistz256_ord_mul_mont BORINGSSL_PREFIX %+ _ecp_nistz256_ord_mul_mont
|
||||
%define ecp_nistz256_ord_mul_mont_adx BORINGSSL_PREFIX %+ _ecp_nistz256_ord_mul_mont_adx
|
||||
%define ecp_nistz256_ord_mul_mont_nohw BORINGSSL_PREFIX %+ _ecp_nistz256_ord_mul_mont_nohw
|
||||
%define ecp_nistz256_ord_sqr_mont BORINGSSL_PREFIX %+ _ecp_nistz256_ord_sqr_mont
|
||||
%define ecp_nistz256_ord_sqr_mont_adx BORINGSSL_PREFIX %+ _ecp_nistz256_ord_sqr_mont_adx
|
||||
%define ecp_nistz256_ord_sqr_mont_nohw BORINGSSL_PREFIX %+ _ecp_nistz256_ord_sqr_mont_nohw
|
||||
%define ecp_nistz256_point_add BORINGSSL_PREFIX %+ _ecp_nistz256_point_add
|
||||
%define ecp_nistz256_point_add_adx BORINGSSL_PREFIX %+ _ecp_nistz256_point_add_adx
|
||||
%define ecp_nistz256_point_add_affine BORINGSSL_PREFIX %+ _ecp_nistz256_point_add_affine
|
||||
%define ecp_nistz256_point_add_affine_adx BORINGSSL_PREFIX %+ _ecp_nistz256_point_add_affine_adx
|
||||
%define ecp_nistz256_point_add_affine_nohw BORINGSSL_PREFIX %+ _ecp_nistz256_point_add_affine_nohw
|
||||
%define ecp_nistz256_point_add_nohw BORINGSSL_PREFIX %+ _ecp_nistz256_point_add_nohw
|
||||
%define ecp_nistz256_point_double BORINGSSL_PREFIX %+ _ecp_nistz256_point_double
|
||||
%define ecp_nistz256_point_double_adx BORINGSSL_PREFIX %+ _ecp_nistz256_point_double_adx
|
||||
%define ecp_nistz256_point_double_nohw BORINGSSL_PREFIX %+ _ecp_nistz256_point_double_nohw
|
||||
%define ecp_nistz256_select_w5 BORINGSSL_PREFIX %+ _ecp_nistz256_select_w5
|
||||
%define ecp_nistz256_select_w5_avx2 BORINGSSL_PREFIX %+ _ecp_nistz256_select_w5_avx2
|
||||
%define ecp_nistz256_select_w5_nohw BORINGSSL_PREFIX %+ _ecp_nistz256_select_w5_nohw
|
||||
%define ecp_nistz256_select_w7 BORINGSSL_PREFIX %+ _ecp_nistz256_select_w7
|
||||
%define ecp_nistz256_select_w7_avx2 BORINGSSL_PREFIX %+ _ecp_nistz256_select_w7_avx2
|
||||
%define ecp_nistz256_select_w7_nohw BORINGSSL_PREFIX %+ _ecp_nistz256_select_w7_nohw
|
||||
%define ecp_nistz256_sqr_mont BORINGSSL_PREFIX %+ _ecp_nistz256_sqr_mont
|
||||
%define ecp_nistz256_sqr_mont_adx BORINGSSL_PREFIX %+ _ecp_nistz256_sqr_mont_adx
|
||||
%define ecp_nistz256_sqr_mont_nohw BORINGSSL_PREFIX %+ _ecp_nistz256_sqr_mont_nohw
|
||||
%define ecp_nistz256_sub BORINGSSL_PREFIX %+ _ecp_nistz256_sub
|
||||
%define fiat_curve25519_adx_mul BORINGSSL_PREFIX %+ _fiat_curve25519_adx_mul
|
||||
%define fiat_curve25519_adx_square BORINGSSL_PREFIX %+ _fiat_curve25519_adx_square
|
||||
%define fiat_p256_adx_mul BORINGSSL_PREFIX %+ _fiat_p256_adx_mul
|
||||
|
||||
@@ -227,14 +227,38 @@
|
||||
%define _chacha20_poly1305_seal _ %+ BORINGSSL_PREFIX %+ _chacha20_poly1305_seal
|
||||
%define _chacha20_poly1305_seal_avx2 _ %+ BORINGSSL_PREFIX %+ _chacha20_poly1305_seal_avx2
|
||||
%define _chacha20_poly1305_seal_sse41 _ %+ BORINGSSL_PREFIX %+ _chacha20_poly1305_seal_sse41
|
||||
%define _ecp_nistz256_div_by_2 _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_div_by_2
|
||||
%define _ecp_nistz256_mul_by_2 _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_mul_by_2
|
||||
%define _ecp_nistz256_mul_by_3 _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_mul_by_3
|
||||
%define _ecp_nistz256_mul_mont _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_mul_mont
|
||||
%define _ecp_nistz256_mul_mont_adx _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_mul_mont_adx
|
||||
%define _ecp_nistz256_mul_mont_nohw _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_mul_mont_nohw
|
||||
%define _ecp_nistz256_neg _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_neg
|
||||
%define _ecp_nistz256_ord_mul_mont _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_ord_mul_mont
|
||||
%define _ecp_nistz256_ord_mul_mont_adx _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_ord_mul_mont_adx
|
||||
%define _ecp_nistz256_ord_mul_mont_nohw _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_ord_mul_mont_nohw
|
||||
%define _ecp_nistz256_ord_sqr_mont _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_ord_sqr_mont
|
||||
%define _ecp_nistz256_ord_sqr_mont_adx _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_ord_sqr_mont_adx
|
||||
%define _ecp_nistz256_ord_sqr_mont_nohw _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_ord_sqr_mont_nohw
|
||||
%define _ecp_nistz256_point_add _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_point_add
|
||||
%define _ecp_nistz256_point_add_adx _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_point_add_adx
|
||||
%define _ecp_nistz256_point_add_affine _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_point_add_affine
|
||||
%define _ecp_nistz256_point_add_affine_adx _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_point_add_affine_adx
|
||||
%define _ecp_nistz256_point_add_affine_nohw _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_point_add_affine_nohw
|
||||
%define _ecp_nistz256_point_add_nohw _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_point_add_nohw
|
||||
%define _ecp_nistz256_point_double _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_point_double
|
||||
%define _ecp_nistz256_point_double_adx _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_point_double_adx
|
||||
%define _ecp_nistz256_point_double_nohw _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_point_double_nohw
|
||||
%define _ecp_nistz256_select_w5 _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_select_w5
|
||||
%define _ecp_nistz256_select_w5_avx2 _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_select_w5_avx2
|
||||
%define _ecp_nistz256_select_w5_nohw _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_select_w5_nohw
|
||||
%define _ecp_nistz256_select_w7 _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_select_w7
|
||||
%define _ecp_nistz256_select_w7_avx2 _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_select_w7_avx2
|
||||
%define _ecp_nistz256_select_w7_nohw _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_select_w7_nohw
|
||||
%define _ecp_nistz256_sqr_mont _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_sqr_mont
|
||||
%define _ecp_nistz256_sqr_mont_adx _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_sqr_mont_adx
|
||||
%define _ecp_nistz256_sqr_mont_nohw _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_sqr_mont_nohw
|
||||
%define _ecp_nistz256_sub _ %+ BORINGSSL_PREFIX %+ _ecp_nistz256_sub
|
||||
%define _fiat_curve25519_adx_mul _ %+ BORINGSSL_PREFIX %+ _fiat_curve25519_adx_mul
|
||||
%define _fiat_curve25519_adx_square _ %+ BORINGSSL_PREFIX %+ _fiat_curve25519_adx_square
|
||||
%define _fiat_p256_adx_mul _ %+ BORINGSSL_PREFIX %+ _fiat_p256_adx_mul
|
||||
|
||||
Generated
+5
-2
@@ -65,6 +65,7 @@ bcm_internal_headers = [
|
||||
"crypto/fipsmodule/ec/ec_montgomery.cc.inc",
|
||||
"crypto/fipsmodule/ec/felem.cc.inc",
|
||||
"crypto/fipsmodule/ec/oct.cc.inc",
|
||||
"crypto/fipsmodule/ec/p256-nistz.cc.inc",
|
||||
"crypto/fipsmodule/ec/p256.cc.inc",
|
||||
"crypto/fipsmodule/ec/scalar.cc.inc",
|
||||
"crypto/fipsmodule/ec/simple.cc.inc",
|
||||
@@ -656,7 +657,7 @@ crypto_internal_headers = [
|
||||
"crypto/fipsmodule/ec/builtin_curves.h",
|
||||
"crypto/fipsmodule/ec/internal.h",
|
||||
"crypto/fipsmodule/ec/p256-nistz-table.h",
|
||||
"crypto/fipsmodule/ec/p256_internal.h",
|
||||
"crypto/fipsmodule/ec/p256-nistz.h",
|
||||
"crypto/fipsmodule/ec/p256_table.h",
|
||||
"crypto/fipsmodule/ecdsa/internal.h",
|
||||
"crypto/fipsmodule/entropy/internal.h",
|
||||
@@ -703,6 +704,7 @@ crypto_internal_headers = [
|
||||
"third_party/fiat/p256_32.h",
|
||||
"third_party/fiat/p256_64.h",
|
||||
"third_party/fiat/p256_64_msvc.h",
|
||||
"third_party/fiat/p256_field.c.inc",
|
||||
"third_party/fiat/p256_field_32.br.c.inc",
|
||||
"third_party/fiat/p256_field_64.br.c.inc",
|
||||
"third_party/fiat/p256_point.br.c.inc",
|
||||
@@ -779,6 +781,7 @@ crypto_test_sources = [
|
||||
"crypto/fipsmodule/bn/bn_test.cc",
|
||||
"crypto/fipsmodule/cmac/cmac_test.cc",
|
||||
"crypto/fipsmodule/ec/ec_test.cc",
|
||||
"crypto/fipsmodule/ec/p256-nistz_test.cc",
|
||||
"crypto/fipsmodule/ec/p256_test.cc",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_test.cc",
|
||||
"crypto/fipsmodule/entropy/jitter_test.cc",
|
||||
@@ -893,7 +896,7 @@ crypto_test_data = [
|
||||
"crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt",
|
||||
"crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt",
|
||||
"crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt",
|
||||
"crypto/fipsmodule/ec/p256-tests.txt",
|
||||
"crypto/fipsmodule/ec/p256-nistz_tests.txt",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt",
|
||||
"crypto/fipsmodule/keccak/keccak_tests.txt",
|
||||
|
||||
Generated
+5
-2
@@ -69,6 +69,7 @@ set(
|
||||
crypto/fipsmodule/ec/ec_montgomery.cc.inc
|
||||
crypto/fipsmodule/ec/felem.cc.inc
|
||||
crypto/fipsmodule/ec/oct.cc.inc
|
||||
crypto/fipsmodule/ec/p256-nistz.cc.inc
|
||||
crypto/fipsmodule/ec/p256.cc.inc
|
||||
crypto/fipsmodule/ec/scalar.cc.inc
|
||||
crypto/fipsmodule/ec/simple.cc.inc
|
||||
@@ -678,7 +679,7 @@ set(
|
||||
crypto/fipsmodule/ec/builtin_curves.h
|
||||
crypto/fipsmodule/ec/internal.h
|
||||
crypto/fipsmodule/ec/p256-nistz-table.h
|
||||
crypto/fipsmodule/ec/p256_internal.h
|
||||
crypto/fipsmodule/ec/p256-nistz.h
|
||||
crypto/fipsmodule/ec/p256_table.h
|
||||
crypto/fipsmodule/ecdsa/internal.h
|
||||
crypto/fipsmodule/entropy/internal.h
|
||||
@@ -725,6 +726,7 @@ set(
|
||||
third_party/fiat/p256_32.h
|
||||
third_party/fiat/p256_64.h
|
||||
third_party/fiat/p256_64_msvc.h
|
||||
third_party/fiat/p256_field.c.inc
|
||||
third_party/fiat/p256_field_32.br.c.inc
|
||||
third_party/fiat/p256_field_64.br.c.inc
|
||||
third_party/fiat/p256_point.br.c.inc
|
||||
@@ -807,6 +809,7 @@ set(
|
||||
crypto/fipsmodule/bn/bn_test.cc
|
||||
crypto/fipsmodule/cmac/cmac_test.cc
|
||||
crypto/fipsmodule/ec/ec_test.cc
|
||||
crypto/fipsmodule/ec/p256-nistz_test.cc
|
||||
crypto/fipsmodule/ec/p256_test.cc
|
||||
crypto/fipsmodule/ecdsa/ecdsa_test.cc
|
||||
crypto/fipsmodule/entropy/jitter_test.cc
|
||||
@@ -925,7 +928,7 @@ set(
|
||||
crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt
|
||||
crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt
|
||||
crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt
|
||||
crypto/fipsmodule/ec/p256-tests.txt
|
||||
crypto/fipsmodule/ec/p256-nistz_tests.txt
|
||||
crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt
|
||||
crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt
|
||||
crypto/fipsmodule/keccak/keccak_tests.txt
|
||||
|
||||
Generated
+5
-2
@@ -65,6 +65,7 @@ bcm_internal_headers = [
|
||||
"crypto/fipsmodule/ec/ec_montgomery.cc.inc",
|
||||
"crypto/fipsmodule/ec/felem.cc.inc",
|
||||
"crypto/fipsmodule/ec/oct.cc.inc",
|
||||
"crypto/fipsmodule/ec/p256-nistz.cc.inc",
|
||||
"crypto/fipsmodule/ec/p256.cc.inc",
|
||||
"crypto/fipsmodule/ec/scalar.cc.inc",
|
||||
"crypto/fipsmodule/ec/simple.cc.inc",
|
||||
@@ -656,7 +657,7 @@ crypto_internal_headers = [
|
||||
"crypto/fipsmodule/ec/builtin_curves.h",
|
||||
"crypto/fipsmodule/ec/internal.h",
|
||||
"crypto/fipsmodule/ec/p256-nistz-table.h",
|
||||
"crypto/fipsmodule/ec/p256_internal.h",
|
||||
"crypto/fipsmodule/ec/p256-nistz.h",
|
||||
"crypto/fipsmodule/ec/p256_table.h",
|
||||
"crypto/fipsmodule/ecdsa/internal.h",
|
||||
"crypto/fipsmodule/entropy/internal.h",
|
||||
@@ -703,6 +704,7 @@ crypto_internal_headers = [
|
||||
"third_party/fiat/p256_32.h",
|
||||
"third_party/fiat/p256_64.h",
|
||||
"third_party/fiat/p256_64_msvc.h",
|
||||
"third_party/fiat/p256_field.c.inc",
|
||||
"third_party/fiat/p256_field_32.br.c.inc",
|
||||
"third_party/fiat/p256_field_64.br.c.inc",
|
||||
"third_party/fiat/p256_point.br.c.inc",
|
||||
@@ -779,6 +781,7 @@ crypto_test_sources = [
|
||||
"crypto/fipsmodule/bn/bn_test.cc",
|
||||
"crypto/fipsmodule/cmac/cmac_test.cc",
|
||||
"crypto/fipsmodule/ec/ec_test.cc",
|
||||
"crypto/fipsmodule/ec/p256-nistz_test.cc",
|
||||
"crypto/fipsmodule/ec/p256_test.cc",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_test.cc",
|
||||
"crypto/fipsmodule/entropy/jitter_test.cc",
|
||||
@@ -893,7 +896,7 @@ crypto_test_data = [
|
||||
"crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt",
|
||||
"crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt",
|
||||
"crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt",
|
||||
"crypto/fipsmodule/ec/p256-tests.txt",
|
||||
"crypto/fipsmodule/ec/p256-nistz_tests.txt",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt",
|
||||
"crypto/fipsmodule/keccak/keccak_tests.txt",
|
||||
|
||||
Generated
+5
-2
@@ -50,6 +50,7 @@
|
||||
"crypto/fipsmodule/ec/ec_montgomery.cc.inc",
|
||||
"crypto/fipsmodule/ec/felem.cc.inc",
|
||||
"crypto/fipsmodule/ec/oct.cc.inc",
|
||||
"crypto/fipsmodule/ec/p256-nistz.cc.inc",
|
||||
"crypto/fipsmodule/ec/p256.cc.inc",
|
||||
"crypto/fipsmodule/ec/scalar.cc.inc",
|
||||
"crypto/fipsmodule/ec/simple.cc.inc",
|
||||
@@ -638,7 +639,7 @@
|
||||
"crypto/fipsmodule/ec/builtin_curves.h",
|
||||
"crypto/fipsmodule/ec/internal.h",
|
||||
"crypto/fipsmodule/ec/p256-nistz-table.h",
|
||||
"crypto/fipsmodule/ec/p256_internal.h",
|
||||
"crypto/fipsmodule/ec/p256-nistz.h",
|
||||
"crypto/fipsmodule/ec/p256_table.h",
|
||||
"crypto/fipsmodule/ecdsa/internal.h",
|
||||
"crypto/fipsmodule/entropy/internal.h",
|
||||
@@ -685,6 +686,7 @@
|
||||
"third_party/fiat/p256_32.h",
|
||||
"third_party/fiat/p256_64.h",
|
||||
"third_party/fiat/p256_64_msvc.h",
|
||||
"third_party/fiat/p256_field.c.inc",
|
||||
"third_party/fiat/p256_field_32.br.c.inc",
|
||||
"third_party/fiat/p256_field_64.br.c.inc",
|
||||
"third_party/fiat/p256_point.br.c.inc"
|
||||
@@ -760,6 +762,7 @@
|
||||
"crypto/fipsmodule/bn/bn_test.cc",
|
||||
"crypto/fipsmodule/cmac/cmac_test.cc",
|
||||
"crypto/fipsmodule/ec/ec_test.cc",
|
||||
"crypto/fipsmodule/ec/p256-nistz_test.cc",
|
||||
"crypto/fipsmodule/ec/p256_test.cc",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_test.cc",
|
||||
"crypto/fipsmodule/entropy/jitter_test.cc",
|
||||
@@ -872,7 +875,7 @@
|
||||
"crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt",
|
||||
"crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt",
|
||||
"crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt",
|
||||
"crypto/fipsmodule/ec/p256-tests.txt",
|
||||
"crypto/fipsmodule/ec/p256-nistz_tests.txt",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt",
|
||||
"crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt",
|
||||
"crypto/fipsmodule/keccak/keccak_tests.txt",
|
||||
|
||||
Generated
+5
-2
@@ -64,6 +64,7 @@ boringssl_bcm_internal_headers := \
|
||||
crypto/fipsmodule/ec/ec_montgomery.cc.inc \
|
||||
crypto/fipsmodule/ec/felem.cc.inc \
|
||||
crypto/fipsmodule/ec/oct.cc.inc \
|
||||
crypto/fipsmodule/ec/p256-nistz.cc.inc \
|
||||
crypto/fipsmodule/ec/p256.cc.inc \
|
||||
crypto/fipsmodule/ec/scalar.cc.inc \
|
||||
crypto/fipsmodule/ec/simple.cc.inc \
|
||||
@@ -646,7 +647,7 @@ boringssl_crypto_internal_headers := \
|
||||
crypto/fipsmodule/ec/builtin_curves.h \
|
||||
crypto/fipsmodule/ec/internal.h \
|
||||
crypto/fipsmodule/ec/p256-nistz-table.h \
|
||||
crypto/fipsmodule/ec/p256_internal.h \
|
||||
crypto/fipsmodule/ec/p256-nistz.h \
|
||||
crypto/fipsmodule/ec/p256_table.h \
|
||||
crypto/fipsmodule/ecdsa/internal.h \
|
||||
crypto/fipsmodule/entropy/internal.h \
|
||||
@@ -693,6 +694,7 @@ boringssl_crypto_internal_headers := \
|
||||
third_party/fiat/p256_32.h \
|
||||
third_party/fiat/p256_64.h \
|
||||
third_party/fiat/p256_64_msvc.h \
|
||||
third_party/fiat/p256_field.c.inc \
|
||||
third_party/fiat/p256_field_32.br.c.inc \
|
||||
third_party/fiat/p256_field_64.br.c.inc \
|
||||
third_party/fiat/p256_point.br.c.inc
|
||||
@@ -766,6 +768,7 @@ boringssl_crypto_test_sources := \
|
||||
crypto/fipsmodule/bn/bn_test.cc \
|
||||
crypto/fipsmodule/cmac/cmac_test.cc \
|
||||
crypto/fipsmodule/ec/ec_test.cc \
|
||||
crypto/fipsmodule/ec/p256-nistz_test.cc \
|
||||
crypto/fipsmodule/ec/p256_test.cc \
|
||||
crypto/fipsmodule/ecdsa/ecdsa_test.cc \
|
||||
crypto/fipsmodule/entropy/jitter_test.cc \
|
||||
@@ -878,7 +881,7 @@ boringssl_crypto_test_data := \
|
||||
crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt \
|
||||
crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt \
|
||||
crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt \
|
||||
crypto/fipsmodule/ec/p256-tests.txt \
|
||||
crypto/fipsmodule/ec/p256-nistz_tests.txt \
|
||||
crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt \
|
||||
crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt \
|
||||
crypto/fipsmodule/keccak/keccak_tests.txt \
|
||||
|
||||
+48
@@ -231,14 +231,38 @@
|
||||
#define _chacha20_poly1305_seal BORINGSSL_ADD_USER_LABEL_AND_PREFIX(chacha20_poly1305_seal)
|
||||
#define _chacha20_poly1305_seal_avx2 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(chacha20_poly1305_seal_avx2)
|
||||
#define _chacha20_poly1305_seal_sse41 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(chacha20_poly1305_seal_sse41)
|
||||
#define _ecp_nistz256_div_by_2 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_div_by_2)
|
||||
#define _ecp_nistz256_mul_by_2 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_mul_by_2)
|
||||
#define _ecp_nistz256_mul_by_3 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_mul_by_3)
|
||||
#define _ecp_nistz256_mul_mont BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_mul_mont)
|
||||
#define _ecp_nistz256_mul_mont_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_mul_mont_adx)
|
||||
#define _ecp_nistz256_mul_mont_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_mul_mont_nohw)
|
||||
#define _ecp_nistz256_neg BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_neg)
|
||||
#define _ecp_nistz256_ord_mul_mont BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_mul_mont)
|
||||
#define _ecp_nistz256_ord_mul_mont_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_mul_mont_adx)
|
||||
#define _ecp_nistz256_ord_mul_mont_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_mul_mont_nohw)
|
||||
#define _ecp_nistz256_ord_sqr_mont BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_sqr_mont)
|
||||
#define _ecp_nistz256_ord_sqr_mont_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_sqr_mont_adx)
|
||||
#define _ecp_nistz256_ord_sqr_mont_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_sqr_mont_nohw)
|
||||
#define _ecp_nistz256_point_add BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add)
|
||||
#define _ecp_nistz256_point_add_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add_adx)
|
||||
#define _ecp_nistz256_point_add_affine BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add_affine)
|
||||
#define _ecp_nistz256_point_add_affine_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add_affine_adx)
|
||||
#define _ecp_nistz256_point_add_affine_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add_affine_nohw)
|
||||
#define _ecp_nistz256_point_add_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add_nohw)
|
||||
#define _ecp_nistz256_point_double BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_double)
|
||||
#define _ecp_nistz256_point_double_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_double_adx)
|
||||
#define _ecp_nistz256_point_double_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_double_nohw)
|
||||
#define _ecp_nistz256_select_w5 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w5)
|
||||
#define _ecp_nistz256_select_w5_avx2 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w5_avx2)
|
||||
#define _ecp_nistz256_select_w5_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w5_nohw)
|
||||
#define _ecp_nistz256_select_w7 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w7)
|
||||
#define _ecp_nistz256_select_w7_avx2 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w7_avx2)
|
||||
#define _ecp_nistz256_select_w7_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w7_nohw)
|
||||
#define _ecp_nistz256_sqr_mont BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_sqr_mont)
|
||||
#define _ecp_nistz256_sqr_mont_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_sqr_mont_adx)
|
||||
#define _ecp_nistz256_sqr_mont_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_sqr_mont_nohw)
|
||||
#define _ecp_nistz256_sub BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_sub)
|
||||
#define _fiat_curve25519_adx_mul BORINGSSL_ADD_USER_LABEL_AND_PREFIX(fiat_curve25519_adx_mul)
|
||||
#define _fiat_curve25519_adx_square BORINGSSL_ADD_USER_LABEL_AND_PREFIX(fiat_curve25519_adx_square)
|
||||
#define _fiat_p256_adx_mul BORINGSSL_ADD_USER_LABEL_AND_PREFIX(fiat_p256_adx_mul)
|
||||
@@ -509,14 +533,38 @@
|
||||
#define chacha20_poly1305_seal BORINGSSL_ADD_USER_LABEL_AND_PREFIX(chacha20_poly1305_seal)
|
||||
#define chacha20_poly1305_seal_avx2 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(chacha20_poly1305_seal_avx2)
|
||||
#define chacha20_poly1305_seal_sse41 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(chacha20_poly1305_seal_sse41)
|
||||
#define ecp_nistz256_div_by_2 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_div_by_2)
|
||||
#define ecp_nistz256_mul_by_2 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_mul_by_2)
|
||||
#define ecp_nistz256_mul_by_3 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_mul_by_3)
|
||||
#define ecp_nistz256_mul_mont BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_mul_mont)
|
||||
#define ecp_nistz256_mul_mont_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_mul_mont_adx)
|
||||
#define ecp_nistz256_mul_mont_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_mul_mont_nohw)
|
||||
#define ecp_nistz256_neg BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_neg)
|
||||
#define ecp_nistz256_ord_mul_mont BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_mul_mont)
|
||||
#define ecp_nistz256_ord_mul_mont_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_mul_mont_adx)
|
||||
#define ecp_nistz256_ord_mul_mont_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_mul_mont_nohw)
|
||||
#define ecp_nistz256_ord_sqr_mont BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_sqr_mont)
|
||||
#define ecp_nistz256_ord_sqr_mont_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_sqr_mont_adx)
|
||||
#define ecp_nistz256_ord_sqr_mont_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_ord_sqr_mont_nohw)
|
||||
#define ecp_nistz256_point_add BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add)
|
||||
#define ecp_nistz256_point_add_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add_adx)
|
||||
#define ecp_nistz256_point_add_affine BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add_affine)
|
||||
#define ecp_nistz256_point_add_affine_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add_affine_adx)
|
||||
#define ecp_nistz256_point_add_affine_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add_affine_nohw)
|
||||
#define ecp_nistz256_point_add_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_add_nohw)
|
||||
#define ecp_nistz256_point_double BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_double)
|
||||
#define ecp_nistz256_point_double_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_double_adx)
|
||||
#define ecp_nistz256_point_double_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_point_double_nohw)
|
||||
#define ecp_nistz256_select_w5 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w5)
|
||||
#define ecp_nistz256_select_w5_avx2 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w5_avx2)
|
||||
#define ecp_nistz256_select_w5_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w5_nohw)
|
||||
#define ecp_nistz256_select_w7 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w7)
|
||||
#define ecp_nistz256_select_w7_avx2 BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w7_avx2)
|
||||
#define ecp_nistz256_select_w7_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_select_w7_nohw)
|
||||
#define ecp_nistz256_sqr_mont BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_sqr_mont)
|
||||
#define ecp_nistz256_sqr_mont_adx BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_sqr_mont_adx)
|
||||
#define ecp_nistz256_sqr_mont_nohw BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_sqr_mont_nohw)
|
||||
#define ecp_nistz256_sub BORINGSSL_ADD_USER_LABEL_AND_PREFIX(ecp_nistz256_sub)
|
||||
#define fiat_curve25519_adx_mul BORINGSSL_ADD_USER_LABEL_AND_PREFIX(fiat_curve25519_adx_mul)
|
||||
#define fiat_curve25519_adx_square BORINGSSL_ADD_USER_LABEL_AND_PREFIX(fiat_curve25519_adx_square)
|
||||
#define fiat_p256_adx_mul BORINGSSL_ADD_USER_LABEL_AND_PREFIX(fiat_p256_adx_mul)
|
||||
|
||||
+24
@@ -231,14 +231,38 @@
|
||||
#define chacha20_poly1305_seal BORINGSSL_ADD_PREFIX(chacha20_poly1305_seal)
|
||||
#define chacha20_poly1305_seal_avx2 BORINGSSL_ADD_PREFIX(chacha20_poly1305_seal_avx2)
|
||||
#define chacha20_poly1305_seal_sse41 BORINGSSL_ADD_PREFIX(chacha20_poly1305_seal_sse41)
|
||||
#define ecp_nistz256_div_by_2 BORINGSSL_ADD_PREFIX(ecp_nistz256_div_by_2)
|
||||
#define ecp_nistz256_mul_by_2 BORINGSSL_ADD_PREFIX(ecp_nistz256_mul_by_2)
|
||||
#define ecp_nistz256_mul_by_3 BORINGSSL_ADD_PREFIX(ecp_nistz256_mul_by_3)
|
||||
#define ecp_nistz256_mul_mont BORINGSSL_ADD_PREFIX(ecp_nistz256_mul_mont)
|
||||
#define ecp_nistz256_mul_mont_adx BORINGSSL_ADD_PREFIX(ecp_nistz256_mul_mont_adx)
|
||||
#define ecp_nistz256_mul_mont_nohw BORINGSSL_ADD_PREFIX(ecp_nistz256_mul_mont_nohw)
|
||||
#define ecp_nistz256_neg BORINGSSL_ADD_PREFIX(ecp_nistz256_neg)
|
||||
#define ecp_nistz256_ord_mul_mont BORINGSSL_ADD_PREFIX(ecp_nistz256_ord_mul_mont)
|
||||
#define ecp_nistz256_ord_mul_mont_adx BORINGSSL_ADD_PREFIX(ecp_nistz256_ord_mul_mont_adx)
|
||||
#define ecp_nistz256_ord_mul_mont_nohw BORINGSSL_ADD_PREFIX(ecp_nistz256_ord_mul_mont_nohw)
|
||||
#define ecp_nistz256_ord_sqr_mont BORINGSSL_ADD_PREFIX(ecp_nistz256_ord_sqr_mont)
|
||||
#define ecp_nistz256_ord_sqr_mont_adx BORINGSSL_ADD_PREFIX(ecp_nistz256_ord_sqr_mont_adx)
|
||||
#define ecp_nistz256_ord_sqr_mont_nohw BORINGSSL_ADD_PREFIX(ecp_nistz256_ord_sqr_mont_nohw)
|
||||
#define ecp_nistz256_point_add BORINGSSL_ADD_PREFIX(ecp_nistz256_point_add)
|
||||
#define ecp_nistz256_point_add_adx BORINGSSL_ADD_PREFIX(ecp_nistz256_point_add_adx)
|
||||
#define ecp_nistz256_point_add_affine BORINGSSL_ADD_PREFIX(ecp_nistz256_point_add_affine)
|
||||
#define ecp_nistz256_point_add_affine_adx BORINGSSL_ADD_PREFIX(ecp_nistz256_point_add_affine_adx)
|
||||
#define ecp_nistz256_point_add_affine_nohw BORINGSSL_ADD_PREFIX(ecp_nistz256_point_add_affine_nohw)
|
||||
#define ecp_nistz256_point_add_nohw BORINGSSL_ADD_PREFIX(ecp_nistz256_point_add_nohw)
|
||||
#define ecp_nistz256_point_double BORINGSSL_ADD_PREFIX(ecp_nistz256_point_double)
|
||||
#define ecp_nistz256_point_double_adx BORINGSSL_ADD_PREFIX(ecp_nistz256_point_double_adx)
|
||||
#define ecp_nistz256_point_double_nohw BORINGSSL_ADD_PREFIX(ecp_nistz256_point_double_nohw)
|
||||
#define ecp_nistz256_select_w5 BORINGSSL_ADD_PREFIX(ecp_nistz256_select_w5)
|
||||
#define ecp_nistz256_select_w5_avx2 BORINGSSL_ADD_PREFIX(ecp_nistz256_select_w5_avx2)
|
||||
#define ecp_nistz256_select_w5_nohw BORINGSSL_ADD_PREFIX(ecp_nistz256_select_w5_nohw)
|
||||
#define ecp_nistz256_select_w7 BORINGSSL_ADD_PREFIX(ecp_nistz256_select_w7)
|
||||
#define ecp_nistz256_select_w7_avx2 BORINGSSL_ADD_PREFIX(ecp_nistz256_select_w7_avx2)
|
||||
#define ecp_nistz256_select_w7_nohw BORINGSSL_ADD_PREFIX(ecp_nistz256_select_w7_nohw)
|
||||
#define ecp_nistz256_sqr_mont BORINGSSL_ADD_PREFIX(ecp_nistz256_sqr_mont)
|
||||
#define ecp_nistz256_sqr_mont_adx BORINGSSL_ADD_PREFIX(ecp_nistz256_sqr_mont_adx)
|
||||
#define ecp_nistz256_sqr_mont_nohw BORINGSSL_ADD_PREFIX(ecp_nistz256_sqr_mont_nohw)
|
||||
#define ecp_nistz256_sub BORINGSSL_ADD_PREFIX(ecp_nistz256_sub)
|
||||
#define fiat_curve25519_adx_mul BORINGSSL_ADD_PREFIX(fiat_curve25519_adx_mul)
|
||||
#define fiat_curve25519_adx_square BORINGSSL_ADD_PREFIX(fiat_curve25519_adx_square)
|
||||
#define fiat_p256_adx_mul BORINGSSL_ADD_PREFIX(fiat_p256_adx_mul)
|
||||
|
||||
Vendored
+36
@@ -1,3 +1,23 @@
|
||||
#include <openssl/base.h>
|
||||
#include "bedrock_unverified_platform.c.inc"
|
||||
#include "p256_field_64.br.c.inc"
|
||||
#include "../../crypto/internal.h"
|
||||
|
||||
#if !defined(OPENSSL_NO_ASM) && (defined(__ELF__) || defined(__APPLE__)) && \
|
||||
defined(OPENSSL_X86_64) && !defined(OPENSSL_NANOLIBC)
|
||||
// These functions are only available with gas and SysV ABI, used by Apple and
|
||||
// ELF-based platforms. Unlike most of our SysV assembly, they currently rely on
|
||||
// the SysV redzone. This trips one target which looks like it targets SysV but
|
||||
// has no redzone. This happens to define `OPENSSL_NANOLIBC`, so gate on that.
|
||||
//
|
||||
// TODO(crbug.com/522255483): Come up with a clearer story for the redzone
|
||||
// situation.
|
||||
extern "C" {
|
||||
void fiat_p256_adx_mul(uint64_t*, const uint64_t*, const uint64_t*);
|
||||
void fiat_p256_adx_sqr(uint64_t*, const uint64_t*);
|
||||
}
|
||||
#endif
|
||||
|
||||
/* Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --inline --static --use-value-barrier p256 64 '2^256 - 2^224 + 2^192 + 2^96 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp */
|
||||
/* curve description: p256 */
|
||||
/* machine_wordsize = 64 (from "64") */
|
||||
@@ -165,6 +185,14 @@ static FIAT_P256_FIAT_INLINE void fiat_p256_cmovznz_u64(uint64_t* out1, fiat_p25
|
||||
*
|
||||
*/
|
||||
static FIAT_P256_FIAT_INLINE void fiat_p256_mul(fiat_p256_montgomery_domain_field_element out1, const fiat_p256_montgomery_domain_field_element arg1, const fiat_p256_montgomery_domain_field_element arg2) {
|
||||
// NOTE: edited by hand, see third_party/fiat/README.md
|
||||
#if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) && defined(__x86_64__)
|
||||
if (bssl::CRYPTO_is_BMI1_capable() && bssl::CRYPTO_is_BMI2_capable() &&
|
||||
bssl::CRYPTO_is_ADX_capable()) {
|
||||
fiat_p256_adx_mul(out1, arg1, arg2);
|
||||
return;
|
||||
}
|
||||
#endif
|
||||
uint64_t x1;
|
||||
uint64_t x2;
|
||||
uint64_t x3;
|
||||
@@ -472,6 +500,14 @@ static FIAT_P256_FIAT_INLINE void fiat_p256_mul(fiat_p256_montgomery_domain_fiel
|
||||
*
|
||||
*/
|
||||
static FIAT_P256_FIAT_INLINE void fiat_p256_square(fiat_p256_montgomery_domain_field_element out1, const fiat_p256_montgomery_domain_field_element arg1) {
|
||||
// NOTE: edited by hand, see third_party/fiat/README.md
|
||||
#if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) && defined(__x86_64__)
|
||||
if (bssl::CRYPTO_is_BMI1_capable() && bssl::CRYPTO_is_BMI2_capable() &&
|
||||
bssl::CRYPTO_is_ADX_capable()) {
|
||||
fiat_p256_adx_sqr(out1, arg1);
|
||||
return;
|
||||
}
|
||||
#endif
|
||||
uint64_t x1;
|
||||
uint64_t x2;
|
||||
uint64_t x3;
|
||||
|
||||
Vendored
+2
@@ -17,6 +17,8 @@
|
||||
/* twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in */
|
||||
/* if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256 */
|
||||
|
||||
#include "bedrock_unverified_platform.c.inc"
|
||||
#include "p256_field_64.br.c.inc"
|
||||
#include <stdint.h>
|
||||
#include <intrin.h>
|
||||
#if defined(_M_X64)
|
||||
|
||||
Vendored
+26
@@ -0,0 +1,26 @@
|
||||
#include <openssl/base.h>
|
||||
#include "bedrock_unverified_platform.c.inc"
|
||||
|
||||
#if defined(BORINGSSL_HAS_UINT128)
|
||||
#include "p256_64.h"
|
||||
#elif defined(OPENSSL_64_BIT)
|
||||
#include "p256_64_msvc.h"
|
||||
#else
|
||||
#include "p256_field_32.br.c.inc"
|
||||
#include "p256_32.h"
|
||||
// the 32-bit Bedrock-generated field halving calls Fiat-C code for add, sub
|
||||
static inline void p256_coord_add(br_word_t out, br_word_t x, br_word_t y) {
|
||||
fiat_p256_add((uint32_t*)out, (const uint32_t*)x, (const uint32_t*)y);
|
||||
}
|
||||
static inline void p256_coord_sub(br_word_t out, br_word_t x, br_word_t y) {
|
||||
fiat_p256_sub((uint32_t*)out, (const uint32_t*)x, (const uint32_t*)y);
|
||||
}
|
||||
#endif
|
||||
|
||||
// the Bedrock-generated point operations call Fiat-C or Fiat-x86 mul, sqr
|
||||
static inline void p256_coord_mul(br_word_t out, br_word_t x, br_word_t y) {
|
||||
fiat_p256_mul((br_word_t*)out, (const br_word_t*)x, (const br_word_t*)y);
|
||||
}
|
||||
static inline void p256_coord_sqr(br_word_t out, br_word_t x) {
|
||||
fiat_p256_square((br_word_t*)out, (const br_word_t*)x);
|
||||
}
|
||||
|
||||
Vendored
-54
@@ -110,57 +110,3 @@ static inline void p256_point_add_vartime_if_doubling(br_word_t p_out, br_word_t
|
||||
}
|
||||
br_memcpy(p_out, p_sel, (br_word_t)96);
|
||||
}
|
||||
|
||||
static inline br_word_t p256_point_add_affine_nz_nz_neq(br_word_t p_out, br_word_t p_P, br_word_t p_Q) {
|
||||
br_word_t z1z1, Hsqr, ok, different_x, different_y, u2, Hcub, r, h, s2;
|
||||
uint8_t _br_stackalloc_z1z1[32] = {0}; z1z1 = (br_word_t)&_br_stackalloc_z1z1;
|
||||
uint8_t _br_stackalloc_u2[32] = {0}; u2 = (br_word_t)&_br_stackalloc_u2;
|
||||
uint8_t _br_stackalloc_h[32] = {0}; h = (br_word_t)&_br_stackalloc_h;
|
||||
uint8_t _br_stackalloc_s2[32] = {0}; s2 = (br_word_t)&_br_stackalloc_s2;
|
||||
uint8_t _br_stackalloc_r[32] = {0}; r = (br_word_t)&_br_stackalloc_r;
|
||||
uint8_t _br_stackalloc_Hsqr[32] = {0}; Hsqr = (br_word_t)&_br_stackalloc_Hsqr;
|
||||
uint8_t _br_stackalloc_Hcub[32] = {0}; Hcub = (br_word_t)&_br_stackalloc_Hcub;
|
||||
p256_coord_sqr(z1z1, (p_P+32)+32);
|
||||
p256_coord_mul(u2, p_Q, z1z1);
|
||||
p256_coord_sub(h, u2, p_P);
|
||||
p256_coord_mul(s2, (p_P+32)+32, z1z1);
|
||||
p256_coord_mul((p_out+32)+32, h, (p_P+32)+32);
|
||||
p256_coord_mul(s2, s2, p_Q+32);
|
||||
p256_coord_sub(r, s2, p_P+32);
|
||||
p256_coord_sqr(Hsqr, h);
|
||||
p256_coord_sqr(p_out, r);
|
||||
p256_coord_mul(Hcub, Hsqr, h);
|
||||
p256_coord_mul(u2, p_P, Hsqr);
|
||||
different_x = p256_coord_nonzero(Hcub);
|
||||
different_y = p256_coord_nonzero(p_out);
|
||||
ok = br_value_barrier(different_x|different_y);
|
||||
p256_coord_sub(p_out, p_out, Hcub);
|
||||
p256_coord_sub(p_out, p_out, u2);
|
||||
p256_coord_sub(p_out, p_out, u2);
|
||||
p256_coord_sub(h, u2, p_out);
|
||||
p256_coord_mul(s2, Hcub, p_P+32);
|
||||
p256_coord_mul(h, h, r);
|
||||
p256_coord_sub(p_out+32, h, s2);
|
||||
return ok;
|
||||
}
|
||||
|
||||
static inline void p256_point_add_affinenz_conditional_vartime_if_doubling(br_word_t p_out, br_word_t p_P, br_word_t p_Q, br_word_t c) {
|
||||
br_word_t nzQ, p_tmp, zeroP, zeroQ, ok, p_buf;
|
||||
zeroP = p256_point_iszero(p_P);
|
||||
nzQ = br_broadcast_nonzero(c);
|
||||
zeroQ = ~nzQ;
|
||||
uint8_t _br_stackalloc_p_tmp[96] = {0}; p_tmp = (br_word_t)&_br_stackalloc_p_tmp;
|
||||
ok = p256_point_add_affine_nz_nz_neq(p_tmp, p_P, p_Q);
|
||||
ok = br_declassify((zeroP|zeroQ)|ok);
|
||||
uint8_t _br_stackalloc_p_buf[96] = {0}; p_buf = (br_word_t)&_br_stackalloc_p_buf;
|
||||
br_memset(p_buf, (br_word_t)0, (br_word_t)3*32);
|
||||
br_memcxor(p_buf, p_tmp, (br_word_t)3*32, (~zeroP)&(~zeroQ));
|
||||
br_memcxor(p_buf, p_P, (br_word_t)3*32, (~zeroP)&zeroQ);
|
||||
br_memcxor(p_buf, p_Q, (br_word_t)3*32, zeroP&(~zeroQ));
|
||||
if (ok) {
|
||||
/*skip*/
|
||||
} else {
|
||||
p256_point_double(p_buf, p_P);
|
||||
}
|
||||
br_memcpy(p_out, p_buf, (br_word_t)96);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user