field.h 4.8 KB
Newer Older
1
/*
2
 * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
3 4 5 6 7 8 9 10
 * Copyright 2014 Cryptography Research, Inc.
 *
 * Licensed under the OpenSSL license (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 *
 * Originally written by Mike Hamburg
M
Matt Caswell 已提交
11 12
 */

13 14
#ifndef HEADER_FIELD_H
# define HEADER_FIELD_H
15

16
# include "internal/constant_time_locl.h"
17
# include <string.h>
M
Matt Caswell 已提交
18 19 20 21 22 23
# include <assert.h>
# include "word.h"

# define NLIMBS (64/sizeof(word_t))
# define X_SER_BYTES 56
# define SER_BYTES 56
24 25

# if defined(__GNUC__) || defined(__clang__)
26
#  define INLINE_UNUSED __inline__ __attribute__((__unused__,__always_inline__))
27 28 29 30 31 32 33 34
#  define RESTRICT __restrict__
#  define ALIGNED __attribute__((aligned(32)))
# else
#  define INLINE_UNUSED ossl_inline
#  define RESTRICT
#  define ALIGNED
# endif

M
Matt Caswell 已提交
35 36
typedef struct gf_s {
    word_t limb[NLIMBS];
37
} ALIGNED gf_s, gf[1];
M
Matt Caswell 已提交
38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56

/* RFC 7748 support */
# define X_PUBLIC_BYTES  X_SER_BYTES
# define X_PRIVATE_BYTES X_PUBLIC_BYTES
# define X_PRIVATE_BITS  448

static INLINE_UNUSED void gf_copy(gf out, const gf a)
{
    *out = *a;
}

static INLINE_UNUSED void gf_add_RAW(gf out, const gf a, const gf b);
static INLINE_UNUSED void gf_sub_RAW(gf out, const gf a, const gf b);
static INLINE_UNUSED void gf_bias(gf inout, int amount);
static INLINE_UNUSED void gf_weak_reduce(gf inout);

void gf_strong_reduce(gf inout);
void gf_add(gf out, const gf a, const gf b);
void gf_sub(gf out, const gf a, const gf b);
57 58 59
void gf_mul(gf_s * RESTRICT out, const gf a, const gf b);
void gf_mulw_unsigned(gf_s * RESTRICT out, const gf a, uint32_t b);
void gf_sqr(gf_s * RESTRICT out, const gf a);
M
Matt Caswell 已提交
60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76
mask_t gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0.  Return true if successful */
mask_t gf_eq(const gf x, const gf y);
mask_t gf_lobit(const gf x);
mask_t gf_hibit(const gf x);

void gf_serialize(uint8_t *serial, const gf x, int with_highbit);
mask_t gf_deserialize(gf x, const uint8_t serial[SER_BYTES], int with_hibit,
                      uint8_t hi_nmask);

# include "f_impl.h"            /* Bring in the inline implementations */

# ifndef LIMBPERM
#  define LIMBPERM(i) (i)
# endif
# define LIMB_MASK(i) (((1)<<LIMB_PLACE_VALUE(i))-1)

static const gf ZERO = {{{0}}}, ONE = {{{1}}};
M
Matt Caswell 已提交
77

78
/* Square x, n times. */
79
static ossl_inline void gf_sqrn(gf_s * RESTRICT y, const gf x, int n)
80
{
M
Matt Caswell 已提交
81
    gf tmp;
82 83 84
    assert(n > 0);
    if (n & 1) {
        gf_sqr(y, x);
M
Matt Caswell 已提交
85 86
        n--;
    } else {
87 88 89
        gf_sqr(tmp, x);
        gf_sqr(y, tmp);
        n -= 2;
M
Matt Caswell 已提交
90
    }
91 92 93
    for (; n; n -= 2) {
        gf_sqr(tmp, y);
        gf_sqr(y, tmp);
M
Matt Caswell 已提交
94 95 96
    }
}

97
# define gf_add_nr gf_add_RAW
M
Matt Caswell 已提交
98

99
/* Subtract mod p.  Bias by 2 and don't reduce  */
100 101 102
static ossl_inline void gf_sub_nr(gf c, const gf a, const gf b)
{
    gf_sub_RAW(c, a, b);
M
Matt Caswell 已提交
103
    gf_bias(c, 2);
104 105
    if (GF_HEADROOM < 3)
        gf_weak_reduce(c);
M
Matt Caswell 已提交
106 107
}

108
/* Subtract mod p. Bias by amt but don't reduce.  */
109 110 111
static ossl_inline void gf_subx_nr(gf c, const gf a, const gf b, int amt)
{
    gf_sub_RAW(c, a, b);
M
Matt Caswell 已提交
112
    gf_bias(c, amt);
113 114
    if (GF_HEADROOM < amt + 1)
        gf_weak_reduce(c);
M
Matt Caswell 已提交
115 116
}

117
/* Mul by signed int.  Not constant-time WRT the sign of that int. */
118 119 120
static ossl_inline void gf_mulw(gf c, const gf a, int32_t w)
{
    if (w > 0) {
M
Matt Caswell 已提交
121 122 123
        gf_mulw_unsigned(c, a, w);
    } else {
        gf_mulw_unsigned(c, a, -w);
124
        gf_sub(c, ZERO, c);
M
Matt Caswell 已提交
125 126 127
    }
}

128
/* Constant time, x = is_z ? z : y */
129 130
static ossl_inline void gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z)
{
131 132 133 134 135 136 137 138 139 140 141 142 143 144
    size_t i;

    for (i = 0; i < NLIMBS; i++) {
#if ARCH_WORD_BITS == 32
        x[0].limb[i] = constant_time_select_32((uint32_t)is_z,
                                               (uint32_t)(z[0].limb[i]),
                                               (uint32_t)(y[0].limb[i]));
#else
        /* Must be 64 bit */
        x[0].limb[i] = constant_time_select_64((uint64_t)is_z,
                                               (uint64_t)(z[0].limb[i]),
                                               (uint64_t)(y[0].limb[i]));
#endif
    }
M
Matt Caswell 已提交
145 146
}

147
/* Constant time, if (neg) x=-x; */
148 149
static ossl_inline void gf_cond_neg(gf x, mask_t neg)
{
M
Matt Caswell 已提交
150
    gf y;
151 152
    gf_sub(y, ZERO, x);
    gf_cond_sel(x, x, y, neg);
M
Matt Caswell 已提交
153 154
}

155
/* Constant time, if (swap) (x,y) = (y,x); */
156
static ossl_inline void gf_cond_swap(gf x, gf_s * RESTRICT y, mask_t swap)
157
{
158 159 160 161 162 163 164 165 166 167 168 169
    size_t i;

    for (i = 0; i < NLIMBS; i++) {
#if ARCH_WORD_BITS == 32
        constant_time_cond_swap_32((uint32_t)swap, (uint32_t *)&(x[0].limb[i]),
                                   (uint32_t *)&(y->limb[i]));
#else
        /* Must be 64 bit */
        constant_time_cond_swap_64((uint64_t)swap, (uint64_t *)&(x[0].limb[i]),
                                   (uint64_t *)&(y->limb[i]));
#endif
    }
M
Matt Caswell 已提交
170 171
}

172
#endif                          /* HEADER_FIELD_H */