]>
Commit | Line | Data |
---|---|---|
1308e022 MC |
1 | /* |
2 | * Copyright 2017 The OpenSSL Project Authors. All Rights Reserved. | |
3 | * Copyright 2014 Cryptography Research, Inc. | |
4 | * | |
5 | * Licensed under the OpenSSL license (the "License"). You may not use | |
6 | * this file except in compliance with the License. You can obtain a copy | |
7 | * in the file LICENSE in the source distribution or at | |
8 | * https://www.openssl.org/source/license.html | |
9 | * | |
10 | * Originally written by Mike Hamburg | |
7324473f MC |
11 | */ |
12 | ||
13 | #ifndef __GF_H__ | |
205fd638 MC |
14 | # define __GF_H__ |
15 | ||
16 | # include "constant_time.h" | |
205fd638 | 17 | # include <string.h> |
001a0934 MC |
18 | # include <assert.h> |
19 | # include "word.h" | |
20 | ||
21 | # define NLIMBS (64/sizeof(word_t)) | |
22 | # define X_SER_BYTES 56 | |
23 | # define SER_BYTES 56 | |
24 | typedef struct gf_s { | |
25 | word_t limb[NLIMBS]; | |
26 | } __attribute__ ((aligned(32))) gf_s, gf[1]; | |
27 | ||
28 | /* RFC 7748 support */ | |
29 | # define X_PUBLIC_BYTES X_SER_BYTES | |
30 | # define X_PRIVATE_BYTES X_PUBLIC_BYTES | |
31 | # define X_PRIVATE_BITS 448 | |
32 | ||
33 | # define INLINE_UNUSED __inline__ __attribute__((unused,always_inline)) | |
34 | ||
35 | static INLINE_UNUSED void gf_copy(gf out, const gf a) | |
36 | { | |
37 | *out = *a; | |
38 | } | |
39 | ||
40 | static INLINE_UNUSED void gf_add_RAW(gf out, const gf a, const gf b); | |
41 | static INLINE_UNUSED void gf_sub_RAW(gf out, const gf a, const gf b); | |
42 | static INLINE_UNUSED void gf_bias(gf inout, int amount); | |
43 | static INLINE_UNUSED void gf_weak_reduce(gf inout); | |
44 | ||
45 | void gf_strong_reduce(gf inout); | |
46 | void gf_add(gf out, const gf a, const gf b); | |
47 | void gf_sub(gf out, const gf a, const gf b); | |
48 | void gf_mul(gf_s * __restrict__ out, const gf a, const gf b); | |
49 | void gf_mulw_unsigned(gf_s * __restrict__ out, const gf a, uint32_t b); | |
50 | void gf_sqr(gf_s * __restrict__ out, const gf a); | |
51 | mask_t gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0. Return true if successful */ | |
52 | mask_t gf_eq(const gf x, const gf y); | |
53 | mask_t gf_lobit(const gf x); | |
54 | mask_t gf_hibit(const gf x); | |
55 | ||
56 | void gf_serialize(uint8_t *serial, const gf x, int with_highbit); | |
57 | mask_t gf_deserialize(gf x, const uint8_t serial[SER_BYTES], int with_hibit, | |
58 | uint8_t hi_nmask); | |
59 | ||
60 | # include "f_impl.h" /* Bring in the inline implementations */ | |
61 | ||
62 | # ifndef LIMBPERM | |
63 | # define LIMBPERM(i) (i) | |
64 | # endif | |
65 | # define LIMB_MASK(i) (((1)<<LIMB_PLACE_VALUE(i))-1) | |
66 | ||
67 | static const gf ZERO = {{{0}}}, ONE = {{{1}}}; | |
7324473f | 68 | |
8d55f844 | 69 | /* Square x, n times. */ |
205fd638 MC |
70 | static ossl_inline void gf_sqrn(gf_s * __restrict__ y, const gf x, int n) |
71 | { | |
7324473f | 72 | gf tmp; |
205fd638 MC |
73 | assert(n > 0); |
74 | if (n & 1) { | |
75 | gf_sqr(y, x); | |
7324473f MC |
76 | n--; |
77 | } else { | |
205fd638 MC |
78 | gf_sqr(tmp, x); |
79 | gf_sqr(y, tmp); | |
80 | n -= 2; | |
7324473f | 81 | } |
205fd638 MC |
82 | for (; n; n -= 2) { |
83 | gf_sqr(tmp, y); | |
84 | gf_sqr(y, tmp); | |
7324473f MC |
85 | } |
86 | } | |
87 | ||
205fd638 | 88 | # define gf_add_nr gf_add_RAW |
7324473f | 89 | |
8d55f844 | 90 | /* Subtract mod p. Bias by 2 and don't reduce */ |
205fd638 MC |
91 | static ossl_inline void gf_sub_nr(gf c, const gf a, const gf b) |
92 | { | |
93 | gf_sub_RAW(c, a, b); | |
7324473f | 94 | gf_bias(c, 2); |
205fd638 MC |
95 | if (GF_HEADROOM < 3) |
96 | gf_weak_reduce(c); | |
7324473f MC |
97 | } |
98 | ||
8d55f844 | 99 | /* Subtract mod p. Bias by amt but don't reduce. */ |
205fd638 MC |
100 | static ossl_inline void gf_subx_nr(gf c, const gf a, const gf b, int amt) |
101 | { | |
102 | gf_sub_RAW(c, a, b); | |
7324473f | 103 | gf_bias(c, amt); |
205fd638 MC |
104 | if (GF_HEADROOM < amt + 1) |
105 | gf_weak_reduce(c); | |
7324473f MC |
106 | } |
107 | ||
8d55f844 | 108 | /* Mul by signed int. Not constant-time WRT the sign of that int. */ |
205fd638 MC |
109 | static ossl_inline void gf_mulw(gf c, const gf a, int32_t w) |
110 | { | |
111 | if (w > 0) { | |
7324473f MC |
112 | gf_mulw_unsigned(c, a, w); |
113 | } else { | |
114 | gf_mulw_unsigned(c, a, -w); | |
205fd638 | 115 | gf_sub(c, ZERO, c); |
7324473f MC |
116 | } |
117 | } | |
118 | ||
8d55f844 | 119 | /* Constant time, x = is_z ? z : y */ |
205fd638 MC |
120 | static ossl_inline void gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z) |
121 | { | |
122 | constant_time_select(x, y, z, sizeof(gf), is_z, 0); | |
7324473f MC |
123 | } |
124 | ||
8d55f844 | 125 | /* Constant time, if (neg) x=-x; */ |
205fd638 MC |
126 | static ossl_inline void gf_cond_neg(gf x, mask_t neg) |
127 | { | |
7324473f | 128 | gf y; |
205fd638 MC |
129 | gf_sub(y, ZERO, x); |
130 | gf_cond_sel(x, x, y, neg); | |
7324473f MC |
131 | } |
132 | ||
8d55f844 | 133 | /* Constant time, if (swap) (x,y) = (y,x); */ |
205fd638 MC |
134 | static ossl_inline void gf_cond_swap(gf x, gf_s * __restrict__ y, mask_t swap) |
135 | { | |
136 | constant_time_cond_swap(x, y, sizeof(gf_s), swap); | |
7324473f MC |
137 | } |
138 | ||
205fd638 | 139 | #endif /* __GF_H__ */ |