1 /* Copyright 2016 Brian Smith.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include "ecp_nistz256.h"
16 #include "../../limbs/limbs.h"
17
18 #include "../../internal.h"
19 #include "../bn/internal.h"
20 #include "../../limbs/limbs.inl"
21
22 typedef Limb Elem[P256_LIMBS];
23 typedef Limb ScalarMont[P256_LIMBS];
24 typedef Limb Scalar[P256_LIMBS];
25
26 void GFp_p256_scalar_sqr_rep_mont(ScalarMont r, const ScalarMont a, Limb rep);
27
28 #if defined(OPENSSL_ARM) || defined(OPENSSL_X86)
GFp_nistz256_sqr_mont(Elem r,const Elem a)29 void GFp_nistz256_sqr_mont(Elem r, const Elem a) {
30 /* XXX: Inefficient. TODO: optimize with dedicated squaring routine. */
31 GFp_nistz256_mul_mont(r, a, a);
32 }
33 #endif
34
35 #if !defined(OPENSSL_X86_64)
GFp_p256_scalar_mul_mont(ScalarMont r,const ScalarMont a,const ScalarMont b)36 void GFp_p256_scalar_mul_mont(ScalarMont r, const ScalarMont a,
37 const ScalarMont b) {
38 static const BN_ULONG N[] = {
39 TOBN(0xf3b9cac2, 0xfc632551),
40 TOBN(0xbce6faad, 0xa7179e84),
41 TOBN(0xffffffff, 0xffffffff),
42 TOBN(0xffffffff, 0x00000000),
43 };
44 static const BN_ULONG N_N0[] = {
45 BN_MONT_CTX_N0(0xccd1c8aa, 0xee00bc4f)
46 };
47 /* XXX: Inefficient. TODO: optimize with dedicated multiplication routine. */
48 GFp_bn_mul_mont(r, a, b, N, N_N0, P256_LIMBS);
49 }
50 #endif
51
52 #if defined(OPENSSL_X86_64)
GFp_p256_scalar_sqr_mont(ScalarMont r,const ScalarMont a)53 void GFp_p256_scalar_sqr_mont(ScalarMont r, const ScalarMont a) {
54 GFp_p256_scalar_sqr_rep_mont(r, a, 1);
55 }
56 #else
GFp_p256_scalar_sqr_mont(ScalarMont r,const ScalarMont a)57 void GFp_p256_scalar_sqr_mont(ScalarMont r, const ScalarMont a) {
58 GFp_p256_scalar_mul_mont(r, a, a);
59 }
60
GFp_p256_scalar_sqr_rep_mont(ScalarMont r,const ScalarMont a,Limb rep)61 void GFp_p256_scalar_sqr_rep_mont(ScalarMont r, const ScalarMont a, Limb rep) {
62 dev_assert_secret(rep >= 1);
63 GFp_p256_scalar_sqr_mont(r, a);
64 for (Limb i = 1; i < rep; ++i) {
65 GFp_p256_scalar_sqr_mont(r, r);
66 }
67 }
68 #endif
69
70
71 #if !defined(OPENSSL_X86_64)
72
73 /* TODO(perf): Optimize these. */
74
GFp_nistz256_select_w5(P256_POINT * out,const P256_POINT table[16],crypto_word index)75 void GFp_nistz256_select_w5(P256_POINT *out, const P256_POINT table[16],
76 crypto_word index) {
77 dev_assert_secret(index >= 0);
78
79 alignas(32) Elem x; limbs_zero(x, P256_LIMBS);
80 alignas(32) Elem y; limbs_zero(y, P256_LIMBS);
81 alignas(32) Elem z; limbs_zero(z, P256_LIMBS);
82
83 // TODO: Rewrite in terms of |limbs_select|.
84 for (size_t i = 0; i < 16; ++i) {
85 crypto_word equal = constant_time_eq_w(index, (crypto_word)i + 1);
86 for (size_t j = 0; j < P256_LIMBS; ++j) {
87 x[j] = constant_time_select_w(equal, table[i].X[j], x[j]);
88 y[j] = constant_time_select_w(equal, table[i].Y[j], y[j]);
89 z[j] = constant_time_select_w(equal, table[i].Z[j], z[j]);
90 }
91 }
92
93 limbs_copy(out->X, x, P256_LIMBS);
94 limbs_copy(out->Y, y, P256_LIMBS);
95 limbs_copy(out->Z, z, P256_LIMBS);
96 }
97
98 #if defined GFp_USE_LARGE_TABLE
GFp_nistz256_select_w7(P256_POINT_AFFINE * out,const PRECOMP256_ROW table,crypto_word index)99 void GFp_nistz256_select_w7(P256_POINT_AFFINE *out,
100 const PRECOMP256_ROW table, crypto_word index) {
101 alignas(32) Limb xy[P256_LIMBS * 2];
102 limbs_select(xy, table, P256_LIMBS * 2, 64, index - 1);
103 limbs_copy(out->X, &xy[0], P256_LIMBS);
104 limbs_copy(out->Y, &xy[P256_LIMBS], P256_LIMBS);
105 }
106 #endif
107
108 #endif
109