lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-08-01 10:06:53 +03:00
Code Activity

Merge pull request #6777 from tom-cosgrove-arm/issue-6292-mod_inv

Browse Source 
Bignum: Implement high level fixed width modular inversion
This commit is contained in:
Gilles Peskine
2022-12-17 13:26:02 +01:00
committed by GitHub
parent cf86d70162 f723754f6d
commit e162b4725c
15 changed files with 593 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
library/bignum_core.c
View File

@ -824,6 +824,40 @@ mbedtls_mpi_uint mbedtls_mpi_core_sub_int( mbedtls_mpi_uint *X,
return( c );
}
mbedtls_mpi_uint mbedtls_mpi_core_check_zero_ct( const mbedtls_mpi_uint *A,
size_t limbs )
{
mbedtls_mpi_uint bits = 0;
for( size_t i = 0; i < limbs; i++ )
bits |= A[i];
return( bits );
}
void mbedtls_mpi_core_to_mont_rep( mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
const mbedtls_mpi_uint *N,
size_t AN_limbs,
mbedtls_mpi_uint mm,
const mbedtls_mpi_uint *rr,
mbedtls_mpi_uint *T )
{
mbedtls_mpi_core_montmul( X, A, rr, AN_limbs, N, AN_limbs, mm, T );
}
void mbedtls_mpi_core_from_mont_rep( mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
const mbedtls_mpi_uint *N,
size_t AN_limbs,
mbedtls_mpi_uint mm,
mbedtls_mpi_uint *T )
{
const mbedtls_mpi_uint Rinv = 1; /* 1/R in Mont. rep => 1 */
mbedtls_mpi_core_montmul( X, A, &Rinv, 1, N, AN_limbs, mm, T );
}
/* END MERGE SLOT 3 */
/* BEGIN MERGE SLOT 4 */

109
library/bignum_core.h
View File

@ -555,6 +555,10 @@ int mbedtls_mpi_core_random( mbedtls_mpi_uint *X,
* \brief Returns the number of limbs of working memory required for
* a call to `mbedtls_mpi_core_exp_mod()`.
*
* \note This will always be at least
* `mbedtls_mpi_core_montmul_working_limbs(AN_limbs)`,
* i.e. sufficient for a call to `mbedtls_mpi_core_montmul()`.
*
* \param AN_limbs The number of limbs in the input `A` and the modulus `N`
* (they must be the same size) that will be given to
* `mbedtls_mpi_core_exp_mod()`.
@ -625,6 +629,111 @@ mbedtls_mpi_uint mbedtls_mpi_core_sub_int( mbedtls_mpi_uint *X,
mbedtls_mpi_uint b,
size_t limbs );
/**
* \brief Determine if a given MPI has the value \c 0 in constant time with
* respect to the value (but not with respect to the number of limbs).
*
* \param[in] A The MPI to test.
* \param limbs Number of limbs in \p A.
*
* \return 0 if `A == 0`
* non-0 (may be any value) if `A != 0`.
*/
mbedtls_mpi_uint mbedtls_mpi_core_check_zero_ct( const mbedtls_mpi_uint *A,
size_t limbs );
/**
* \brief Returns the number of limbs of working memory required for
* a call to `mbedtls_mpi_core_montmul()`.
*
* \param AN_limbs The number of limbs in the input `A` and the modulus `N`
* (they must be the same size) that will be given to
* `mbedtls_mpi_core_montmul()` or one of the other functions
* that specifies this as the amount of working memory needed.
*
* \return The number of limbs of working memory required by
* `mbedtls_mpi_core_montmul()` (or other similar function).
*/
static inline size_t mbedtls_mpi_core_montmul_working_limbs( size_t AN_limbs )
{
return( 2 * AN_limbs + 1 );
}
/** Convert an MPI into Montgomery form.
*
* \p X may be aliased to \p A, but may not otherwise overlap it.
*
* \p X may not alias \p N (it is in canonical form, so must be stricly less
* than \p N). Nor may it alias or overlap \p rr (this is unlikely to be
* required in practice.)
*
* This function is a thin wrapper around `mbedtls_mpi_core_montmul()` that is
* an alternative to calling `mbedtls_mpi_mod_raw_to_mont_rep()` when we
* don't want to allocate memory.
*
* \param[out] X The result of the conversion.
* Must have the same number of limbs as \p A.
* \param[in] A The MPI to convert into Montgomery form.
* Must have the same number of limbs as the modulus.
* \param[in] N The address of the modulus, which gives the size of
* the base `R` = 2^(biL*N->limbs).
* \param[in] AN_limbs The number of limbs in \p X, \p A, \p N and \p rr.
* \param mm The Montgomery constant for \p N: -N^-1 mod 2^biL.
* This can be determined by calling
* `mbedtls_mpi_core_montmul_init()`.
* \param[in] rr The residue for `2^{2*n*biL} mod N`.
* \param[in,out] T Temporary storage of size at least
* `mbedtls_mpi_core_montmul_working_limbs(AN_limbs)`
* limbs.
* Its initial content is unused and
* its final content is indeterminate.
* It must not alias or otherwise overlap any of the
* other parameters.
*/
void mbedtls_mpi_core_to_mont_rep( mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
const mbedtls_mpi_uint *N,
size_t AN_limbs,
mbedtls_mpi_uint mm,
const mbedtls_mpi_uint *rr,
mbedtls_mpi_uint *T );
/** Convert an MPI from Montgomery form.
*
* \p X may be aliased to \p A, but may not otherwise overlap it.
*
* \p X may not alias \p N (it is in canonical form, so must be stricly less
* than \p N).
*
* This function is a thin wrapper around `mbedtls_mpi_core_montmul()` that is
* an alternative to calling `mbedtls_mpi_mod_raw_from_mont_rep()` when we
* don't want to allocate memory.
*
* \param[out] X The result of the conversion.
* Must have the same number of limbs as \p A.
* \param[in] A The MPI to convert from Montgomery form.
* Must have the same number of limbs as the modulus.
* \param[in] N The address of the modulus, which gives the size of
* the base `R` = 2^(biL*N->limbs).
* \param[in] AN_limbs The number of limbs in \p X, \p A and \p N.
* \param mm The Montgomery constant for \p N: -N^-1 mod 2^biL.
* This can be determined by calling
* `mbedtls_mpi_core_montmul_init()`.
* \param[in,out] T Temporary storage of size at least
* `mbedtls_mpi_core_montmul_working_limbs(AN_limbs)`
* limbs.
* Its initial content is unused and
* its final content is indeterminate.
* It must not alias or otherwise overlap any of the
* other parameters.
*/
void mbedtls_mpi_core_from_mont_rep( mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
const mbedtls_mpi_uint *N,
size_t AN_limbs,
mbedtls_mpi_uint mm,
mbedtls_mpi_uint *T );
/* END MERGE SLOT 3 */
/* BEGIN MERGE SLOT 4 */

91
library/bignum_mod.c
View File

@ -79,7 +79,7 @@ void mbedtls_mpi_mod_modulus_free( mbedtls_mpi_mod_modulus *m )
if (m->rep.mont.rr != NULL)
{
mbedtls_platform_zeroize( (mbedtls_mpi_uint *) m->rep.mont.rr,
m->limbs );
m->limbs * sizeof(mbedtls_mpi_uint) );
mbedtls_free( (mbedtls_mpi_uint *)m->rep.mont.rr );
m->rep.mont.rr = NULL;
}
@ -191,6 +191,95 @@ int mbedtls_mpi_mod_sub( mbedtls_mpi_mod_residue *X,
return( 0 );
}
static int mbedtls_mpi_mod_inv_mont( mbedtls_mpi_mod_residue *X,
const mbedtls_mpi_mod_residue *A,
const mbedtls_mpi_mod_modulus *N,
mbedtls_mpi_uint *working_memory )
{
/* Input already in Montgomery form, so there's little to do */
mbedtls_mpi_mod_raw_inv_prime( X->p, A->p,
N->p, N->limbs,
N->rep.mont.rr,
working_memory );
return( 0 );
}
static int mbedtls_mpi_mod_inv_non_mont( mbedtls_mpi_mod_residue *X,
const mbedtls_mpi_mod_residue *A,
const mbedtls_mpi_mod_modulus *N,
mbedtls_mpi_uint *working_memory )
{
/* Need to convert input into Montgomery form */
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
mbedtls_mpi_mod_modulus Nmont;
mbedtls_mpi_mod_modulus_init( &Nmont );
MBEDTLS_MPI_CHK( mbedtls_mpi_mod_modulus_setup( &Nmont, N->p, N->limbs,
MBEDTLS_MPI_MOD_REP_MONTGOMERY ) );
/* We'll use X->p to hold the Montgomery form of the input A->p */
mbedtls_mpi_core_to_mont_rep( X->p, A->p, Nmont.p, Nmont.limbs,
Nmont.rep.mont.mm, Nmont.rep.mont.rr,
working_memory );
mbedtls_mpi_mod_raw_inv_prime( X->p, X->p,
Nmont.p, Nmont.limbs,
Nmont.rep.mont.rr,
working_memory );
/* And convert back from Montgomery form */
mbedtls_mpi_core_from_mont_rep( X->p, X->p, Nmont.p, Nmont.limbs,
Nmont.rep.mont.mm, working_memory );
cleanup:
mbedtls_mpi_mod_modulus_free( &Nmont );
return( ret );
}
int mbedtls_mpi_mod_inv( mbedtls_mpi_mod_residue *X,
const mbedtls_mpi_mod_residue *A,
const mbedtls_mpi_mod_modulus *N )
{
if( X->limbs != N->limbs || A->limbs != N->limbs )
return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
/* Zero has the same value regardless of Montgomery form or not */
if( mbedtls_mpi_core_check_zero_ct( A->p, A->limbs ) == 0 )
return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
size_t working_limbs =
mbedtls_mpi_mod_raw_inv_prime_working_limbs( N->limbs );
mbedtls_mpi_uint *working_memory = mbedtls_calloc( working_limbs,
sizeof(mbedtls_mpi_uint) );
if( working_memory == NULL )
return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
switch( N->int_rep )
{
case MBEDTLS_MPI_MOD_REP_MONTGOMERY:
ret = mbedtls_mpi_mod_inv_mont( X, A, N, working_memory );
break;
case MBEDTLS_MPI_MOD_REP_OPT_RED:
ret = mbedtls_mpi_mod_inv_non_mont( X, A, N, working_memory );
break;
default:
ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
break;
}
mbedtls_platform_zeroize( working_memory,
working_limbs * sizeof(mbedtls_mpi_uint) );
mbedtls_free( working_memory );
return ret;
}
/* END MERGE SLOT 3 */
/* BEGIN MERGE SLOT 4 */

29
library/bignum_mod.h
View File

@ -249,6 +249,35 @@ int mbedtls_mpi_mod_sub( mbedtls_mpi_mod_residue *X,
const mbedtls_mpi_mod_residue *A,
const mbedtls_mpi_mod_residue *B,
const mbedtls_mpi_mod_modulus *N );
/**
* \brief Perform modular inversion of an MPI with respect to a modulus \p N.
*
* \p A and \p X must be associated with the modulus \p N and will therefore
* have the same number of limbs as \p N.
*
* \p X may be aliased to \p A.
*
* \warning Currently only supports prime moduli, but does not check for them.
*
* \param[out] X The modular inverse of \p A with respect to \p N.
* \param[in] A The number to calculate the modular inverse of.
* Must not be 0.
* \param[in] N The modulus to use.
*
* \return \c 0 if successful.
* \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p A and \p N do not
* have the same number of limbs.
* \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p A is zero.
* \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if couldn't allocate enough
* memory (needed for conversion to and from Mongtomery form
* when not in Montgomery form already, and for temporary use
* by the inversion calculation itself).
*/
int mbedtls_mpi_mod_inv( mbedtls_mpi_mod_residue *X,
const mbedtls_mpi_mod_residue *A,
const mbedtls_mpi_mod_modulus *N );
/* END MERGE SLOT 3 */
/* BEGIN MERGE SLOT 4 */

12
library/bignum_mod_raw.c
View File

@ -193,13 +193,13 @@ int mbedtls_mpi_mod_raw_to_mont_rep( mbedtls_mpi_uint *X,
const mbedtls_mpi_mod_modulus *m )
{
mbedtls_mpi_uint *T;
const size_t t_limbs = m->limbs * 2 + 1;
const size_t t_limbs = mbedtls_mpi_core_montmul_working_limbs( m->limbs );
if( ( T = (mbedtls_mpi_uint *) mbedtls_calloc( t_limbs, ciL ) ) == NULL )
return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
mbedtls_mpi_core_montmul( X, X, m->rep.mont.rr, m->limbs, m->p, m->limbs,
m->rep.mont.mm, T );
mbedtls_mpi_core_to_mont_rep( X, X, m->p, m->limbs,
m->rep.mont.mm, m->rep.mont.rr, T );
mbedtls_platform_zeroize( T, t_limbs * ciL );
mbedtls_free( T );
@ -209,15 +209,13 @@ int mbedtls_mpi_mod_raw_to_mont_rep( mbedtls_mpi_uint *X,
int mbedtls_mpi_mod_raw_from_mont_rep( mbedtls_mpi_uint *X,
const mbedtls_mpi_mod_modulus *m )
{
const mbedtls_mpi_uint one = 1;
const size_t t_limbs = m->limbs * 2 + 1;
const size_t t_limbs = mbedtls_mpi_core_montmul_working_limbs( m->limbs );
mbedtls_mpi_uint *T;
if( ( T = (mbedtls_mpi_uint *) mbedtls_calloc( t_limbs, ciL ) ) == NULL )
return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
mbedtls_mpi_core_montmul( X, X, &one, 1, m->p, m->limbs,
m->rep.mont.mm, T );
mbedtls_mpi_core_from_mont_rep( X, X, m->p, m->limbs, m->rep.mont.mm, T );
mbedtls_platform_zeroize( T, t_limbs * ciL );
mbedtls_free( T );

4
library/bignum_mod_raw.h
View File

@ -258,6 +258,10 @@ void mbedtls_mpi_mod_raw_mul( mbedtls_mpi_uint *X,
* \brief Returns the number of limbs of working memory required for
* a call to `mbedtls_mpi_mod_raw_inv_prime()`.
*
* \note This will always be at least
* `mbedtls_mpi_core_montmul_working_limbs(AN_limbs)`,
* i.e. sufficient for a call to `mbedtls_mpi_core_montmul()`.
*
* \param AN_limbs The number of limbs in the input `A` and the modulus `N`
* (they must be the same size) that will be given to
* `mbedtls_mpi_mod_raw_inv_prime()`.