]>
Commit | Line | Data |
---|---|---|
21dcbebc | 1 | /* |
0d664759 | 2 | * Copyright 2014-2018 The OpenSSL Project Authors. All Rights Reserved. |
5a3d21c0 | 3 | * |
48f4ad77 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
21dcbebc RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
5a3d21c0 EK |
8 | */ |
9 | ||
10 | #ifndef HEADER_CONSTANT_TIME_LOCL_H | |
0f113f3e | 11 | # define HEADER_CONSTANT_TIME_LOCL_H |
5a3d21c0 | 12 | |
2688e7a0 | 13 | # include <stdlib.h> |
e0fa6324 | 14 | # include <string.h> |
80e0ecbf | 15 | # include <openssl/e_os2.h> /* For 'ossl_inline' */ |
5a3d21c0 | 16 | |
1d97c843 | 17 | /*- |
294d1e36 | 18 | * The boolean methods return a bitmask of all ones (0xff...f) for true |
5a3d21c0 EK |
19 | * and 0 for false. This is useful for choosing a value based on the result |
20 | * of a conditional in constant time. For example, | |
9018f3ce RS |
21 | * if (a < b) { |
22 | * c = a; | |
23 | * } else { | |
24 | * c = b; | |
25 | * } | |
5a3d21c0 | 26 | * can be written as |
9018f3ce RS |
27 | * unsigned int lt = constant_time_lt(a, b); |
28 | * c = constant_time_select(lt, a, b); | |
5a3d21c0 EK |
29 | */ |
30 | ||
b12169ee | 31 | /* Returns the given value with the MSB copied to all the other bits. */ |
80e0ecbf | 32 | static ossl_inline unsigned int constant_time_msb(unsigned int a); |
e0fa6324 MC |
33 | /* Convenience method for uint32_t. */ |
34 | static ossl_inline uint32_t constant_time_msb_32(uint32_t a); | |
9018f3ce RS |
35 | /* Convenience method for uint64_t. */ |
36 | static ossl_inline uint64_t constant_time_msb_64(uint64_t a); | |
5a3d21c0 | 37 | |
9018f3ce | 38 | /* Returns 0xff..f if a < b and 0 otherwise. */ |
80e0ecbf DSH |
39 | static ossl_inline unsigned int constant_time_lt(unsigned int a, |
40 | unsigned int b); | |
5a3d21c0 | 41 | /* Convenience method for getting an 8-bit mask. */ |
80e0ecbf DSH |
42 | static ossl_inline unsigned char constant_time_lt_8(unsigned int a, |
43 | unsigned int b); | |
9018f3ce RS |
44 | /* Convenience method for uint64_t. */ |
45 | static ossl_inline uint64_t constant_time_lt_64(uint64_t a, uint64_t b); | |
5a3d21c0 | 46 | |
9018f3ce | 47 | /* Returns 0xff..f if a >= b and 0 otherwise. */ |
80e0ecbf DSH |
48 | static ossl_inline unsigned int constant_time_ge(unsigned int a, |
49 | unsigned int b); | |
5a3d21c0 | 50 | /* Convenience method for getting an 8-bit mask. */ |
80e0ecbf DSH |
51 | static ossl_inline unsigned char constant_time_ge_8(unsigned int a, |
52 | unsigned int b); | |
5a3d21c0 | 53 | |
9018f3ce | 54 | /* Returns 0xff..f if a == 0 and 0 otherwise. */ |
80e0ecbf | 55 | static ossl_inline unsigned int constant_time_is_zero(unsigned int a); |
5a3d21c0 | 56 | /* Convenience method for getting an 8-bit mask. */ |
80e0ecbf | 57 | static ossl_inline unsigned char constant_time_is_zero_8(unsigned int a); |
e0fa6324 MC |
58 | /* Convenience method for getting a 32-bit mask. */ |
59 | static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a); | |
5a3d21c0 | 60 | |
9018f3ce | 61 | /* Returns 0xff..f if a == b and 0 otherwise. */ |
80e0ecbf DSH |
62 | static ossl_inline unsigned int constant_time_eq(unsigned int a, |
63 | unsigned int b); | |
5a3d21c0 | 64 | /* Convenience method for getting an 8-bit mask. */ |
80e0ecbf DSH |
65 | static ossl_inline unsigned char constant_time_eq_8(unsigned int a, |
66 | unsigned int b); | |
455b65df | 67 | /* Signed integers. */ |
80e0ecbf | 68 | static ossl_inline unsigned int constant_time_eq_int(int a, int b); |
455b65df | 69 | /* Convenience method for getting an 8-bit mask. */ |
80e0ecbf | 70 | static ossl_inline unsigned char constant_time_eq_int_8(int a, int b); |
455b65df | 71 | |
1d97c843 | 72 | /*- |
294d1e36 EK |
73 | * Returns (mask & a) | (~mask & b). |
74 | * | |
75 | * When |mask| is all 1s or all 0s (as returned by the methods above), | |
76 | * the select methods return either |a| (if |mask| is nonzero) or |b| | |
77 | * (if |mask| is zero). | |
78 | */ | |
80e0ecbf DSH |
79 | static ossl_inline unsigned int constant_time_select(unsigned int mask, |
80 | unsigned int a, | |
81 | unsigned int b); | |
294d1e36 | 82 | /* Convenience method for unsigned chars. */ |
80e0ecbf DSH |
83 | static ossl_inline unsigned char constant_time_select_8(unsigned char mask, |
84 | unsigned char a, | |
85 | unsigned char b); | |
e0fa6324 MC |
86 | |
87 | /* Convenience method for uint32_t. */ | |
88 | static ossl_inline uint32_t constant_time_select_32(uint32_t mask, uint32_t a, | |
89 | uint32_t b); | |
90 | ||
9018f3ce RS |
91 | /* Convenience method for uint64_t. */ |
92 | static ossl_inline uint64_t constant_time_select_64(uint64_t mask, uint64_t a, | |
93 | uint64_t b); | |
294d1e36 | 94 | /* Convenience method for signed integers. */ |
80e0ecbf DSH |
95 | static ossl_inline int constant_time_select_int(unsigned int mask, int a, |
96 | int b); | |
294d1e36 | 97 | |
9018f3ce | 98 | |
80e0ecbf | 99 | static ossl_inline unsigned int constant_time_msb(unsigned int a) |
0f113f3e MC |
100 | { |
101 | return 0 - (a >> (sizeof(a) * 8 - 1)); | |
102 | } | |
5a3d21c0 | 103 | |
e0fa6324 MC |
104 | |
105 | static ossl_inline uint32_t constant_time_msb_32(uint32_t a) | |
106 | { | |
107 | return 0 - (a >> 31); | |
108 | } | |
109 | ||
9018f3ce RS |
110 | static ossl_inline uint64_t constant_time_msb_64(uint64_t a) |
111 | { | |
112 | return 0 - (a >> 63); | |
113 | } | |
114 | ||
2688e7a0 MC |
115 | static ossl_inline size_t constant_time_msb_s(size_t a) |
116 | { | |
117 | return 0 - (a >> (sizeof(a) * 8 - 1)); | |
118 | } | |
119 | ||
80e0ecbf DSH |
120 | static ossl_inline unsigned int constant_time_lt(unsigned int a, |
121 | unsigned int b) | |
0f113f3e MC |
122 | { |
123 | return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b))); | |
124 | } | |
5a3d21c0 | 125 | |
2688e7a0 MC |
126 | static ossl_inline size_t constant_time_lt_s(size_t a, size_t b) |
127 | { | |
128 | return constant_time_msb_s(a ^ ((a ^ b) | ((a - b) ^ b))); | |
129 | } | |
130 | ||
80e0ecbf DSH |
131 | static ossl_inline unsigned char constant_time_lt_8(unsigned int a, |
132 | unsigned int b) | |
0f113f3e | 133 | { |
26a7d938 | 134 | return (unsigned char)constant_time_lt(a, b); |
0f113f3e | 135 | } |
5a3d21c0 | 136 | |
9018f3ce RS |
137 | static ossl_inline uint64_t constant_time_lt_64(uint64_t a, uint64_t b) |
138 | { | |
139 | return constant_time_msb_64(a ^ ((a ^ b) | ((a - b) ^ b))); | |
140 | } | |
141 | ||
80e0ecbf DSH |
142 | static ossl_inline unsigned int constant_time_ge(unsigned int a, |
143 | unsigned int b) | |
0f113f3e MC |
144 | { |
145 | return ~constant_time_lt(a, b); | |
146 | } | |
5a3d21c0 | 147 | |
2688e7a0 MC |
148 | static ossl_inline size_t constant_time_ge_s(size_t a, size_t b) |
149 | { | |
150 | return ~constant_time_lt_s(a, b); | |
151 | } | |
152 | ||
80e0ecbf DSH |
153 | static ossl_inline unsigned char constant_time_ge_8(unsigned int a, |
154 | unsigned int b) | |
0f113f3e | 155 | { |
26a7d938 | 156 | return (unsigned char)constant_time_ge(a, b); |
0f113f3e | 157 | } |
5a3d21c0 | 158 | |
2688e7a0 MC |
159 | static ossl_inline unsigned char constant_time_ge_8_s(size_t a, size_t b) |
160 | { | |
26a7d938 | 161 | return (unsigned char)constant_time_ge_s(a, b); |
2688e7a0 MC |
162 | } |
163 | ||
80e0ecbf | 164 | static ossl_inline unsigned int constant_time_is_zero(unsigned int a) |
0f113f3e MC |
165 | { |
166 | return constant_time_msb(~a & (a - 1)); | |
167 | } | |
5a3d21c0 | 168 | |
2688e7a0 MC |
169 | static ossl_inline size_t constant_time_is_zero_s(size_t a) |
170 | { | |
171 | return constant_time_msb_s(~a & (a - 1)); | |
172 | } | |
173 | ||
80e0ecbf | 174 | static ossl_inline unsigned char constant_time_is_zero_8(unsigned int a) |
0f113f3e | 175 | { |
26a7d938 | 176 | return (unsigned char)constant_time_is_zero(a); |
0f113f3e | 177 | } |
5a3d21c0 | 178 | |
e0fa6324 MC |
179 | static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a) |
180 | { | |
181 | return constant_time_msb_32(~a & (a - 1)); | |
182 | } | |
183 | ||
80e0ecbf DSH |
184 | static ossl_inline unsigned int constant_time_eq(unsigned int a, |
185 | unsigned int b) | |
0f113f3e MC |
186 | { |
187 | return constant_time_is_zero(a ^ b); | |
188 | } | |
5a3d21c0 | 189 | |
2688e7a0 MC |
190 | static ossl_inline size_t constant_time_eq_s(size_t a, size_t b) |
191 | { | |
192 | return constant_time_is_zero_s(a ^ b); | |
193 | } | |
194 | ||
80e0ecbf DSH |
195 | static ossl_inline unsigned char constant_time_eq_8(unsigned int a, |
196 | unsigned int b) | |
0f113f3e | 197 | { |
26a7d938 | 198 | return (unsigned char)constant_time_eq(a, b); |
0f113f3e | 199 | } |
5a3d21c0 | 200 | |
2688e7a0 MC |
201 | static ossl_inline unsigned char constant_time_eq_8_s(size_t a, size_t b) |
202 | { | |
26a7d938 | 203 | return (unsigned char)constant_time_eq_s(a, b); |
2688e7a0 MC |
204 | } |
205 | ||
80e0ecbf | 206 | static ossl_inline unsigned int constant_time_eq_int(int a, int b) |
0f113f3e MC |
207 | { |
208 | return constant_time_eq((unsigned)(a), (unsigned)(b)); | |
209 | } | |
455b65df | 210 | |
80e0ecbf | 211 | static ossl_inline unsigned char constant_time_eq_int_8(int a, int b) |
0f113f3e MC |
212 | { |
213 | return constant_time_eq_8((unsigned)(a), (unsigned)(b)); | |
214 | } | |
455b65df | 215 | |
04edd688 BE |
216 | /* |
217 | * Returns the value unmodified, but avoids optimizations. | |
218 | * The barriers prevent the compiler from narrowing down the | |
219 | * possible value range of the mask and ~mask in the select | |
220 | * statements, which avoids the recognition of the select | |
221 | * and turning it into a conditional load or branch. | |
222 | */ | |
223 | static ossl_inline unsigned int value_barrier(unsigned int a) | |
224 | { | |
225 | #if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) | |
226 | unsigned int r; | |
227 | __asm__("" : "=r"(r) : "0"(a)); | |
228 | #else | |
229 | volatile unsigned int r = a; | |
230 | #endif | |
231 | return r; | |
232 | } | |
233 | ||
234 | /* Convenience method for uint32_t. */ | |
235 | static ossl_inline uint32_t value_barrier_32(uint32_t a) | |
236 | { | |
237 | #if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) | |
238 | uint32_t r; | |
239 | __asm__("" : "=r"(r) : "0"(a)); | |
240 | #else | |
241 | volatile uint32_t r = a; | |
242 | #endif | |
243 | return r; | |
244 | } | |
245 | ||
246 | /* Convenience method for uint64_t. */ | |
247 | static ossl_inline uint64_t value_barrier_64(uint64_t a) | |
248 | { | |
249 | #if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) | |
250 | uint64_t r; | |
251 | __asm__("" : "=r"(r) : "0"(a)); | |
252 | #else | |
253 | volatile uint64_t r = a; | |
254 | #endif | |
255 | return r; | |
256 | } | |
257 | ||
258 | /* Convenience method for size_t. */ | |
259 | static ossl_inline size_t value_barrier_s(size_t a) | |
260 | { | |
261 | #if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) | |
262 | size_t r; | |
263 | __asm__("" : "=r"(r) : "0"(a)); | |
264 | #else | |
265 | volatile size_t r = a; | |
266 | #endif | |
267 | return r; | |
268 | } | |
269 | ||
80e0ecbf DSH |
270 | static ossl_inline unsigned int constant_time_select(unsigned int mask, |
271 | unsigned int a, | |
272 | unsigned int b) | |
0f113f3e | 273 | { |
04edd688 | 274 | return (value_barrier(mask) & a) | (value_barrier(~mask) & b); |
0f113f3e | 275 | } |
294d1e36 | 276 | |
2688e7a0 MC |
277 | static ossl_inline size_t constant_time_select_s(size_t mask, |
278 | size_t a, | |
279 | size_t b) | |
280 | { | |
04edd688 | 281 | return (value_barrier_s(mask) & a) | (value_barrier_s(~mask) & b); |
2688e7a0 MC |
282 | } |
283 | ||
80e0ecbf DSH |
284 | static ossl_inline unsigned char constant_time_select_8(unsigned char mask, |
285 | unsigned char a, | |
286 | unsigned char b) | |
0f113f3e | 287 | { |
26a7d938 | 288 | return (unsigned char)constant_time_select(mask, a, b); |
0f113f3e | 289 | } |
294d1e36 | 290 | |
80e0ecbf DSH |
291 | static ossl_inline int constant_time_select_int(unsigned int mask, int a, |
292 | int b) | |
0f113f3e | 293 | { |
26a7d938 | 294 | return (int)constant_time_select(mask, (unsigned)(a), (unsigned)(b)); |
0f113f3e | 295 | } |
294d1e36 | 296 | |
2688e7a0 MC |
297 | static ossl_inline int constant_time_select_int_s(size_t mask, int a, int b) |
298 | { | |
26a7d938 K |
299 | return (int)constant_time_select((unsigned)mask, (unsigned)(a), |
300 | (unsigned)(b)); | |
2688e7a0 MC |
301 | } |
302 | ||
e0fa6324 MC |
303 | static ossl_inline uint32_t constant_time_select_32(uint32_t mask, uint32_t a, |
304 | uint32_t b) | |
305 | { | |
04edd688 | 306 | return (value_barrier_32(mask) & a) | (value_barrier_32(~mask) & b); |
e0fa6324 MC |
307 | } |
308 | ||
9018f3ce RS |
309 | static ossl_inline uint64_t constant_time_select_64(uint64_t mask, uint64_t a, |
310 | uint64_t b) | |
311 | { | |
04edd688 | 312 | return (value_barrier_64(mask) & a) | (value_barrier_64(~mask) & b); |
9018f3ce RS |
313 | } |
314 | ||
e0fa6324 MC |
315 | /* |
316 | * mask must be 0xFFFFFFFF or 0x00000000. | |
317 | * | |
318 | * if (mask) { | |
319 | * uint32_t tmp = *a; | |
320 | * | |
321 | * *a = *b; | |
322 | * *b = tmp; | |
323 | * } | |
324 | */ | |
325 | static ossl_inline void constant_time_cond_swap_32(uint32_t mask, uint32_t *a, | |
326 | uint32_t *b) | |
327 | { | |
328 | uint32_t xor = *a ^ *b; | |
329 | ||
330 | xor &= mask; | |
331 | *a ^= xor; | |
332 | *b ^= xor; | |
333 | } | |
334 | ||
335 | /* | |
336 | * mask must be 0xFFFFFFFF or 0x00000000. | |
337 | * | |
338 | * if (mask) { | |
339 | * uint64_t tmp = *a; | |
340 | * | |
341 | * *a = *b; | |
342 | * *b = tmp; | |
343 | * } | |
344 | */ | |
345 | static ossl_inline void constant_time_cond_swap_64(uint64_t mask, uint64_t *a, | |
346 | uint64_t *b) | |
347 | { | |
348 | uint64_t xor = *a ^ *b; | |
349 | ||
350 | xor &= mask; | |
351 | *a ^= xor; | |
352 | *b ^= xor; | |
353 | } | |
354 | ||
355 | /* | |
356 | * table is a two dimensional array of bytes. Each row has rowsize elements. | |
357 | * Copies row number idx into out. rowsize and numrows are not considered | |
358 | * private. | |
359 | */ | |
360 | static ossl_inline void constant_time_lookup(void *out, | |
361 | const void *table, | |
362 | size_t rowsize, | |
363 | size_t numrows, | |
364 | size_t idx) | |
365 | { | |
366 | size_t i, j; | |
367 | const unsigned char *tablec = (const unsigned char *)table; | |
368 | unsigned char *outc = (unsigned char *)out; | |
369 | unsigned char mask; | |
370 | ||
371 | memset(out, 0, rowsize); | |
372 | ||
373 | /* Note idx may underflow - but that is well defined */ | |
374 | for (i = 0; i < numrows; i++, idx--) { | |
375 | mask = (unsigned char)constant_time_is_zero_s(idx); | |
376 | for (j = 0; j < rowsize; j++) | |
377 | *(outc + j) |= constant_time_select_8(mask, *(tablec++), 0); | |
378 | } | |
379 | } | |
380 | ||
f658a3b6 AP |
381 | /* |
382 | * Expected usage pattern is to unconditionally set error and then | |
383 | * wipe it if there was no actual error. |clear| is 1 or 0. | |
384 | */ | |
385 | void err_clear_last_constant_time(int clear); | |
386 | ||
0f113f3e | 387 | #endif /* HEADER_CONSTANT_TIME_LOCL_H */ |