lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-29 11:41:15 +03:00
Code Activity

Merge pull request #7184 from gabor-mezei-arm/6349_Secp224r1_fast_reduction

Browse Source 
Extract Secp224r1 fast reduction from the prototype
This commit is contained in:
Janos Follath
2023-03-07 10:57:58 +00:00
committed by GitHub
parent a5ffa93e43 a2ef6a8e38
commit fe780a3c4b
5 changed files with 311 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

193
library/ecp_curves.c
View File

@ -4575,6 +4575,8 @@ int mbedtls_ecp_mod_p192_raw(mbedtls_mpi_uint *Np, size_t Nn);
#endif
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
static int ecp_mod_p224(mbedtls_mpi *);
MBEDTLS_STATIC_TESTABLE
int mbedtls_ecp_mod_p224_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#endif
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
static int ecp_mod_p256(mbedtls_mpi *);
@ -4951,6 +4953,173 @@ int mbedtls_ecp_mod_p192_raw(mbedtls_mpi_uint *Np, size_t Nn)
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
/*
* The reader is advised to first understand ecp_mod_p192() since the same
* general structure is used here, but with additional complications:
* (1) chunks of 32 bits, and (2) subtractions.
*/
/*
* For these primes, we need to handle data in chunks of 32 bits.
* This makes it more complicated if we use 64 bits limbs in MPI,
* which prevents us from using a uniform access method as for p192.
*
* So, we define a mini abstraction layer to access 32 bit chunks,
* load them in 'cur' for work, and store them back from 'cur' when done.
*
* While at it, also define the size of N in terms of 32-bit chunks.
*/
#define LOAD32 cur = A(i);
#if defined(MBEDTLS_HAVE_INT32) /* 32 bit */
#define MAX32 X_limbs
#define A(j) X[j]
#define STORE32 X[i] = (mbedtls_mpi_uint) cur;
#define STORE0 X[i] = 0;
#else /* 64 bit */
#define MAX32 X_limbs * 2
#define A(j) \
(j) % 2 ? \
(uint32_t) (X[(j) / 2] >> 32) : \
(uint32_t) (X[(j) / 2])
#define STORE32 \
if (i % 2) { \
X[i/2] &= 0x00000000FFFFFFFF; \
X[i/2] |= (uint64_t) (cur) << 32; \
} else { \
X[i/2] &= 0xFFFFFFFF00000000; \
X[i/2] |= (uint32_t) cur; \
}
#define STORE0 \
if (i % 2) { \
X[i/2] &= 0x00000000FFFFFFFF; \
} else { \
X[i/2] &= 0xFFFFFFFF00000000; \
}
#endif
static inline int8_t extract_carry(int64_t cur)
{
return (int8_t) (cur >> 32);
}
#define ADD(j) cur += A(j)
#define SUB(j) cur -= A(j)
#define ADD_CARRY(cc) cur += (cc)
#define SUB_CARRY(cc) cur -= (cc)
#define ADD_LAST ADD_CARRY(last_c)
#define SUB_LAST SUB_CARRY(last_c)
/*
* Helpers for the main 'loop'
*/
#define INIT(b) \
int8_t c = 0, last_c; \
int64_t cur; \
size_t i = 0; \
LOAD32;
#define NEXT \
c = extract_carry(cur); \
STORE32; i++; LOAD32; \
ADD_CARRY(c);
#define RESET \
c = extract_carry(cur); \
last_c = c; \
STORE32; i = 0; LOAD32; \
c = 0; \
#define LAST \
c = extract_carry(cur); \
STORE32; i++; \
if (c != 0) \
return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; \
while (i < MAX32) { STORE0; i++; }
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
/*
* Fast quasi-reduction modulo p224 (FIPS 186-3 D.2.2)
*/
static int ecp_mod_p224(mbedtls_mpi *N)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
size_t expected_width = 2 * 224 / biL;
MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
ret = mbedtls_ecp_mod_p224_raw(N->p, expected_width);
cleanup:
return ret;
}
MBEDTLS_STATIC_TESTABLE
int mbedtls_ecp_mod_p224_raw(mbedtls_mpi_uint *X, size_t X_limbs)
{
if (X_limbs != 2 * 224 / biL) {
return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
}
INIT(224);
SUB(7); SUB(11); NEXT; // A0 += -A7 - A11
SUB(8); SUB(12); NEXT; // A1 += -A8 - A12
SUB(9); SUB(13); NEXT; // A2 += -A9 - A13
SUB(10); ADD(7); ADD(11); NEXT; // A3 += -A10 + A7 + A11
SUB(11); ADD(8); ADD(12); NEXT; // A4 += -A11 + A8 + A12
SUB(12); ADD(9); ADD(13); NEXT; // A5 += -A12 + A9 + A13
SUB(13); ADD(10); // A6 += -A13 + A10
RESET;
/* Use 2^224 = P + 2^96 - 1 to modulo reduce the final carry */
SUB_LAST; NEXT; // A0 -= last_c
; NEXT; // A1
; NEXT; // A2
ADD_LAST; NEXT; // A3 += last_c
; NEXT; // A4
; NEXT; // A5
// A6
/* The carry reduction cannot generate a carry
* (see commit 73e8553 for details)*/
LAST;
return 0;
}
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
#undef LOAD32
#undef MAX32
#undef A
#undef STORE32
#undef STORE0
#undef ADD
#undef SUB
#undef ADD_CARRY
#undef SUB_CARRY
#undef ADD_LAST
#undef SUB_LAST
#undef INIT
#undef NEXT
#undef RESET
#undef LAST
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED ||
MBEDTLS_ECP_DP_SECP256R1_ENABLED ||
MBEDTLS_ECP_DP_SECP384R1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
/*
* The reader is advised to first understand ecp_mod_p192() since the same
* general structure is used here, but with additional complications:
@ -5071,27 +5240,6 @@ void mbedtls_ecp_fix_negative(mbedtls_mpi *N, signed char c, size_t bits)
N->p[bits / 8 / sizeof(mbedtls_mpi_uint)] += msw;
}
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
/*
* Fast quasi-reduction modulo p224 (FIPS 186-3 D.2.2)
*/
static int ecp_mod_p224(mbedtls_mpi *N)
{
INIT(224);
SUB(7); SUB(11); NEXT; // A0 += -A7 - A11
SUB(8); SUB(12); NEXT; // A1 += -A8 - A12
SUB(9); SUB(13); NEXT; // A2 += -A9 - A13
SUB(10); ADD(7); ADD(11); NEXT; // A3 += -A10 + A7 + A11
SUB(11); ADD(8); ADD(12); NEXT; // A4 += -A11 + A8 + A12
SUB(12); ADD(9); ADD(13); NEXT; // A5 += -A12 + A9 + A13
SUB(13); ADD(10); LAST; // A6 += -A13 + A10
cleanup:
return ret;
}
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
/*
* Fast quasi-reduction modulo p256 (FIPS 186-3 D.2.3)
@ -5186,8 +5334,7 @@ cleanup:
#undef NEXT
#undef LAST
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED ||
MBEDTLS_ECP_DP_SECP256R1_ENABLED ||
#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED ||
MBEDTLS_ECP_DP_SECP384R1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)

25
library/ecp_invasive.h
View File

@ -33,8 +33,7 @@
#if defined(MBEDTLS_TEST_HOOKS) && defined(MBEDTLS_ECP_C)
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) || \
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
/* Preconditions:
* - bits is a multiple of 64 or is 224
@ -96,6 +95,28 @@ int mbedtls_ecp_mod_p192_raw(mbedtls_mpi_uint *Np, size_t Nn);
#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
/** Fast quasi-reduction modulo p224 (FIPS 186-3 D.2.2)
*
* \param[in,out] X The address of the MPI to be converted.
* Must have exact limb size that stores a 448-bit MPI
* (double the bitlength of the modulus).
* Upon return holds the reduced value which is
* in range `0 <= X < 2 * N` (where N is the modulus).
* The bitlength of the reduced value is the same as
* that of the modulus (224 bits).
* \param[in] X_limbs The length of \p X in limbs.
*
* \return \c 0 on success.
* \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p X_limbs is not the
* limb size that sores a 448-bit MPI.
*/
MBEDTLS_STATIC_TESTABLE
int mbedtls_ecp_mod_p224_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
/** Fast quasi-reduction modulo p521 = 2^521 - 1 (FIPS 186-3 D.2.5)