Home | History | Annotate | Line # | Download | only in curve448 
      1 /*
      2  * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
      3  * Copyright 2014 Cryptography Research, Inc.
      4  *
      5  * Licensed under the Apache License 2.0 (the "License").  You may not use
      6  * this file except in compliance with the License.  You can obtain a copy
      7  * in the file LICENSE in the source distribution or at
      8  * https://www.openssl.org/source/license.html
      9  *
     10  * Originally written by Mike Hamburg
     11  */
     12 
     13 #ifndef OSSL_CRYPTO_EC_CURVE448_FIELD_H
     14 # define OSSL_CRYPTO_EC_CURVE448_FIELD_H
     15 
     16 # include "internal/constant_time.h"
     17 # include <string.h>
     18 # include <assert.h>
     19 # include "word.h"
     20 
     21 # define NLIMBS (64/sizeof(word_t))
     22 # define X_SER_BYTES 56
     23 # define SER_BYTES 56
     24 
     25 # if defined(__GNUC__) || defined(__clang__)
     26 #  define INLINE_UNUSED __inline__ __attribute__((__unused__,__always_inline__))
     27 #  define RESTRICT __restrict__
     28 #  define ALIGNED __attribute__((__aligned__(16)))
     29 # else
     30 #  define INLINE_UNUSED ossl_inline
     31 #  define RESTRICT
     32 #  define ALIGNED
     33 # endif
     34 
     35 typedef struct gf_s {
     36     word_t limb[NLIMBS];
     37 } ALIGNED gf_s, gf[1];
     38 
     39 /* RFC 7748 support */
     40 # define X_PUBLIC_BYTES  X_SER_BYTES
     41 # define X_PRIVATE_BYTES X_PUBLIC_BYTES
     42 # define X_PRIVATE_BITS  448
     43 
     44 static INLINE_UNUSED void gf_copy(gf out, const gf a)
     45 {
     46     *out = *a;
     47 }
     48 
     49 static INLINE_UNUSED void gf_add_RAW(gf out, const gf a, const gf b);
     50 static INLINE_UNUSED void gf_sub_RAW(gf out, const gf a, const gf b);
     51 static INLINE_UNUSED void gf_bias(gf inout, int amount);
     52 static INLINE_UNUSED void gf_weak_reduce(gf inout);
     53 
     54 void gf_strong_reduce(gf inout);
     55 void gf_add(gf out, const gf a, const gf b);
     56 void gf_sub(gf out, const gf a, const gf b);
     57 void gf_mul(gf_s * RESTRICT out, const gf a, const gf b);
     58 void gf_mulw_unsigned(gf_s * RESTRICT out, const gf a, uint32_t b);
     59 void gf_sqr(gf_s * RESTRICT out, const gf a);
     60 mask_t gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0.  Return true if successful */
     61 mask_t gf_eq(const gf x, const gf y);
     62 mask_t gf_lobit(const gf x);
     63 mask_t gf_hibit(const gf x);
     64 
     65 void gf_serialize(uint8_t *serial, const gf x, int with_highbit);
     66 mask_t gf_deserialize(gf x, const uint8_t serial[SER_BYTES], int with_hibit,
     67                       uint8_t hi_nmask);
     68 
     69 
     70 # define LIMBPERM(i) (i)
     71 # if (ARCH_WORD_BITS == 32)
     72 #  include "arch_32/f_impl.h"    /* Bring in the inline implementations */
     73 #  define LIMB_MASK(i) (((1)<<LIMB_PLACE_VALUE(i))-1)
     74 # elif (ARCH_WORD_BITS == 64)
     75 #  include "arch_64/f_impl.h"    /* Bring in the inline implementations */
     76 #  define LIMB_MASK(i) (((1ULL)<<LIMB_PLACE_VALUE(i))-1)
     77 # endif
     78 
     79 static const gf ZERO = {{{0}}}, ONE = {{{1}}};
     80 
     81 /* Square x, n times. */
     82 static ossl_inline void gf_sqrn(gf_s * RESTRICT y, const gf x, int n)
     83 {
     84     gf tmp;
     85 
     86     assert(n > 0);
     87     if (n & 1) {
     88         gf_sqr(y, x);
     89         n--;
     90     } else {
     91         gf_sqr(tmp, x);
     92         gf_sqr(y, tmp);
     93         n -= 2;
     94     }
     95     for (; n; n -= 2) {
     96         gf_sqr(tmp, y);
     97         gf_sqr(y, tmp);
     98     }
     99 }
    100 
    101 # define gf_add_nr gf_add_RAW
    102 
    103 /* Subtract mod p.  Bias by 2 and don't reduce  */
    104 static ossl_inline void gf_sub_nr(gf c, const gf a, const gf b)
    105 {
    106     gf_sub_RAW(c, a, b);
    107     gf_bias(c, 2);
    108     if (GF_HEADROOM < 3)
    109         gf_weak_reduce(c);
    110 }
    111 
    112 /* Subtract mod p. Bias by amt but don't reduce.  */
    113 static ossl_inline void gf_subx_nr(gf c, const gf a, const gf b, int amt)
    114 {
    115     gf_sub_RAW(c, a, b);
    116     gf_bias(c, amt);
    117     if (GF_HEADROOM < amt + 1)
    118         gf_weak_reduce(c);
    119 }
    120 
    121 /* Mul by signed int.  Not constant-time WRT the sign of that int. */
    122 static ossl_inline void gf_mulw(gf c, const gf a, int32_t w)
    123 {
    124     if (w > 0) {
    125         gf_mulw_unsigned(c, a, w);
    126     } else {
    127         gf_mulw_unsigned(c, a, -w);
    128         gf_sub(c, ZERO, c);
    129     }
    130 }
    131 
    132 /* Constant time, x = is_z ? z : y */
    133 static ossl_inline void gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z)
    134 {
    135     size_t i;
    136 
    137     for (i = 0; i < NLIMBS; i++) {
    138 #if ARCH_WORD_BITS == 32
    139         x[0].limb[i] = constant_time_select_32(is_z, z[0].limb[i],
    140                                                y[0].limb[i]);
    141 #else
    142         /* Must be 64 bit */
    143         x[0].limb[i] = constant_time_select_64(is_z, z[0].limb[i],
    144                                                y[0].limb[i]);
    145 #endif
    146     }
    147 }
    148 
    149 /* Constant time, if (neg) x=-x; */
    150 static ossl_inline void gf_cond_neg(gf x, mask_t neg)
    151 {
    152     gf y;
    153 
    154     gf_sub(y, ZERO, x);
    155     gf_cond_sel(x, x, y, neg);
    156 }
    157 
    158 /* Constant time, if (swap) (x,y) = (y,x); */
    159 static ossl_inline void gf_cond_swap(gf x, gf_s * RESTRICT y, mask_t swap)
    160 {
    161     size_t i;
    162 
    163     for (i = 0; i < NLIMBS; i++) {
    164 #if ARCH_WORD_BITS == 32
    165         constant_time_cond_swap_32(swap, &(x[0].limb[i]), &(y->limb[i]));
    166 #else
    167         /* Must be 64 bit */
    168         constant_time_cond_swap_64(swap, &(x[0].limb[i]), &(y->limb[i]));
    169 #endif
    170     }
    171 }
    172 
    173 #endif                          /* OSSL_CRYPTO_EC_CURVE448_FIELD_H */
    174