]>
Commit | Line | Data |
---|---|---|
21dcbebc | 1 | /* |
0d664759 | 2 | * Copyright 2014-2018 The OpenSSL Project Authors. All Rights Reserved. |
5a3d21c0 | 3 | * |
21dcbebc RS |
4 | * Licensed under the OpenSSL license (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
5a3d21c0 EK |
8 | */ |
9 | ||
10 | #ifndef HEADER_CONSTANT_TIME_LOCL_H | |
0f113f3e | 11 | # define HEADER_CONSTANT_TIME_LOCL_H |
5a3d21c0 | 12 | |
2688e7a0 | 13 | # include <stdlib.h> |
e0fa6324 | 14 | # include <string.h> |
80e0ecbf | 15 | # include <openssl/e_os2.h> /* For 'ossl_inline' */ |
5a3d21c0 | 16 | |
1d97c843 | 17 | /*- |
294d1e36 | 18 | * The boolean methods return a bitmask of all ones (0xff...f) for true |
5a3d21c0 EK |
19 | * and 0 for false. This is useful for choosing a value based on the result |
20 | * of a conditional in constant time. For example, | |
9018f3ce RS |
21 | * if (a < b) { |
22 | * c = a; | |
23 | * } else { | |
24 | * c = b; | |
25 | * } | |
5a3d21c0 | 26 | * can be written as |
9018f3ce RS |
27 | * unsigned int lt = constant_time_lt(a, b); |
28 | * c = constant_time_select(lt, a, b); | |
5a3d21c0 EK |
29 | */ |
30 | ||
b12169ee | 31 | /* Returns the given value with the MSB copied to all the other bits. */ |
80e0ecbf | 32 | static ossl_inline unsigned int constant_time_msb(unsigned int a); |
e0fa6324 MC |
33 | /* Convenience method for uint32_t. */ |
34 | static ossl_inline uint32_t constant_time_msb_32(uint32_t a); | |
9018f3ce RS |
35 | /* Convenience method for uint64_t. */ |
36 | static ossl_inline uint64_t constant_time_msb_64(uint64_t a); | |
5a3d21c0 | 37 | |
9018f3ce | 38 | /* Returns 0xff..f if a < b and 0 otherwise. */ |
80e0ecbf DSH |
39 | static ossl_inline unsigned int constant_time_lt(unsigned int a, |
40 | unsigned int b); | |
5a3d21c0 | 41 | /* Convenience method for getting an 8-bit mask. */ |
80e0ecbf DSH |
42 | static ossl_inline unsigned char constant_time_lt_8(unsigned int a, |
43 | unsigned int b); | |
9018f3ce RS |
44 | /* Convenience method for uint64_t. */ |
45 | static ossl_inline uint64_t constant_time_lt_64(uint64_t a, uint64_t b); | |
5a3d21c0 | 46 | |
9018f3ce | 47 | /* Returns 0xff..f if a >= b and 0 otherwise. */ |
80e0ecbf DSH |
48 | static ossl_inline unsigned int constant_time_ge(unsigned int a, |
49 | unsigned int b); | |
5a3d21c0 | 50 | /* Convenience method for getting an 8-bit mask. */ |
80e0ecbf DSH |
51 | static ossl_inline unsigned char constant_time_ge_8(unsigned int a, |
52 | unsigned int b); | |
5a3d21c0 | 53 | |
9018f3ce | 54 | /* Returns 0xff..f if a == 0 and 0 otherwise. */ |
80e0ecbf | 55 | static ossl_inline unsigned int constant_time_is_zero(unsigned int a); |
5a3d21c0 | 56 | /* Convenience method for getting an 8-bit mask. */ |
80e0ecbf | 57 | static ossl_inline unsigned char constant_time_is_zero_8(unsigned int a); |
e0fa6324 MC |
58 | /* Convenience method for getting a 32-bit mask. */ |
59 | static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a); | |
5a3d21c0 | 60 | |
9018f3ce | 61 | /* Returns 0xff..f if a == b and 0 otherwise. */ |
80e0ecbf DSH |
62 | static ossl_inline unsigned int constant_time_eq(unsigned int a, |
63 | unsigned int b); | |
5a3d21c0 | 64 | /* Convenience method for getting an 8-bit mask. */ |
80e0ecbf DSH |
65 | static ossl_inline unsigned char constant_time_eq_8(unsigned int a, |
66 | unsigned int b); | |
455b65df | 67 | /* Signed integers. */ |
80e0ecbf | 68 | static ossl_inline unsigned int constant_time_eq_int(int a, int b); |
455b65df | 69 | /* Convenience method for getting an 8-bit mask. */ |
80e0ecbf | 70 | static ossl_inline unsigned char constant_time_eq_int_8(int a, int b); |
455b65df | 71 | |
1d97c843 | 72 | /*- |
294d1e36 EK |
73 | * Returns (mask & a) | (~mask & b). |
74 | * | |
75 | * When |mask| is all 1s or all 0s (as returned by the methods above), | |
76 | * the select methods return either |a| (if |mask| is nonzero) or |b| | |
77 | * (if |mask| is zero). | |
78 | */ | |
80e0ecbf DSH |
79 | static ossl_inline unsigned int constant_time_select(unsigned int mask, |
80 | unsigned int a, | |
81 | unsigned int b); | |
294d1e36 | 82 | /* Convenience method for unsigned chars. */ |
80e0ecbf DSH |
83 | static ossl_inline unsigned char constant_time_select_8(unsigned char mask, |
84 | unsigned char a, | |
85 | unsigned char b); | |
e0fa6324 MC |
86 | |
87 | /* Convenience method for uint32_t. */ | |
88 | static ossl_inline uint32_t constant_time_select_32(uint32_t mask, uint32_t a, | |
89 | uint32_t b); | |
90 | ||
9018f3ce RS |
91 | /* Convenience method for uint64_t. */ |
92 | static ossl_inline uint64_t constant_time_select_64(uint64_t mask, uint64_t a, | |
93 | uint64_t b); | |
294d1e36 | 94 | /* Convenience method for signed integers. */ |
80e0ecbf DSH |
95 | static ossl_inline int constant_time_select_int(unsigned int mask, int a, |
96 | int b); | |
294d1e36 | 97 | |
9018f3ce | 98 | |
80e0ecbf | 99 | static ossl_inline unsigned int constant_time_msb(unsigned int a) |
0f113f3e MC |
100 | { |
101 | return 0 - (a >> (sizeof(a) * 8 - 1)); | |
102 | } | |
5a3d21c0 | 103 | |
e0fa6324 MC |
104 | |
105 | static ossl_inline uint32_t constant_time_msb_32(uint32_t a) | |
106 | { | |
107 | return 0 - (a >> 31); | |
108 | } | |
109 | ||
9018f3ce RS |
110 | static ossl_inline uint64_t constant_time_msb_64(uint64_t a) |
111 | { | |
112 | return 0 - (a >> 63); | |
113 | } | |
114 | ||
2688e7a0 MC |
115 | static ossl_inline size_t constant_time_msb_s(size_t a) |
116 | { | |
117 | return 0 - (a >> (sizeof(a) * 8 - 1)); | |
118 | } | |
119 | ||
80e0ecbf DSH |
120 | static ossl_inline unsigned int constant_time_lt(unsigned int a, |
121 | unsigned int b) | |
0f113f3e MC |
122 | { |
123 | return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b))); | |
124 | } | |
5a3d21c0 | 125 | |
2688e7a0 MC |
126 | static ossl_inline size_t constant_time_lt_s(size_t a, size_t b) |
127 | { | |
128 | return constant_time_msb_s(a ^ ((a ^ b) | ((a - b) ^ b))); | |
129 | } | |
130 | ||
80e0ecbf DSH |
131 | static ossl_inline unsigned char constant_time_lt_8(unsigned int a, |
132 | unsigned int b) | |
0f113f3e | 133 | { |
26a7d938 | 134 | return (unsigned char)constant_time_lt(a, b); |
0f113f3e | 135 | } |
5a3d21c0 | 136 | |
9018f3ce RS |
137 | static ossl_inline uint64_t constant_time_lt_64(uint64_t a, uint64_t b) |
138 | { | |
139 | return constant_time_msb_64(a ^ ((a ^ b) | ((a - b) ^ b))); | |
140 | } | |
141 | ||
80e0ecbf DSH |
142 | static ossl_inline unsigned int constant_time_ge(unsigned int a, |
143 | unsigned int b) | |
0f113f3e MC |
144 | { |
145 | return ~constant_time_lt(a, b); | |
146 | } | |
5a3d21c0 | 147 | |
2688e7a0 MC |
148 | static ossl_inline size_t constant_time_ge_s(size_t a, size_t b) |
149 | { | |
150 | return ~constant_time_lt_s(a, b); | |
151 | } | |
152 | ||
80e0ecbf DSH |
153 | static ossl_inline unsigned char constant_time_ge_8(unsigned int a, |
154 | unsigned int b) | |
0f113f3e | 155 | { |
26a7d938 | 156 | return (unsigned char)constant_time_ge(a, b); |
0f113f3e | 157 | } |
5a3d21c0 | 158 | |
2688e7a0 MC |
159 | static ossl_inline unsigned char constant_time_ge_8_s(size_t a, size_t b) |
160 | { | |
26a7d938 | 161 | return (unsigned char)constant_time_ge_s(a, b); |
2688e7a0 MC |
162 | } |
163 | ||
80e0ecbf | 164 | static ossl_inline unsigned int constant_time_is_zero(unsigned int a) |
0f113f3e MC |
165 | { |
166 | return constant_time_msb(~a & (a - 1)); | |
167 | } | |
5a3d21c0 | 168 | |
2688e7a0 MC |
169 | static ossl_inline size_t constant_time_is_zero_s(size_t a) |
170 | { | |
171 | return constant_time_msb_s(~a & (a - 1)); | |
172 | } | |
173 | ||
80e0ecbf | 174 | static ossl_inline unsigned char constant_time_is_zero_8(unsigned int a) |
0f113f3e | 175 | { |
26a7d938 | 176 | return (unsigned char)constant_time_is_zero(a); |
0f113f3e | 177 | } |
5a3d21c0 | 178 | |
e0fa6324 MC |
179 | static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a) |
180 | { | |
181 | return constant_time_msb_32(~a & (a - 1)); | |
182 | } | |
183 | ||
80e0ecbf DSH |
184 | static ossl_inline unsigned int constant_time_eq(unsigned int a, |
185 | unsigned int b) | |
0f113f3e MC |
186 | { |
187 | return constant_time_is_zero(a ^ b); | |
188 | } | |
5a3d21c0 | 189 | |
2688e7a0 MC |
190 | static ossl_inline size_t constant_time_eq_s(size_t a, size_t b) |
191 | { | |
192 | return constant_time_is_zero_s(a ^ b); | |
193 | } | |
194 | ||
80e0ecbf DSH |
195 | static ossl_inline unsigned char constant_time_eq_8(unsigned int a, |
196 | unsigned int b) | |
0f113f3e | 197 | { |
26a7d938 | 198 | return (unsigned char)constant_time_eq(a, b); |
0f113f3e | 199 | } |
5a3d21c0 | 200 | |
2688e7a0 MC |
201 | static ossl_inline unsigned char constant_time_eq_8_s(size_t a, size_t b) |
202 | { | |
26a7d938 | 203 | return (unsigned char)constant_time_eq_s(a, b); |
2688e7a0 MC |
204 | } |
205 | ||
80e0ecbf | 206 | static ossl_inline unsigned int constant_time_eq_int(int a, int b) |
0f113f3e MC |
207 | { |
208 | return constant_time_eq((unsigned)(a), (unsigned)(b)); | |
209 | } | |
455b65df | 210 | |
80e0ecbf | 211 | static ossl_inline unsigned char constant_time_eq_int_8(int a, int b) |
0f113f3e MC |
212 | { |
213 | return constant_time_eq_8((unsigned)(a), (unsigned)(b)); | |
214 | } | |
455b65df | 215 | |
80e0ecbf DSH |
216 | static ossl_inline unsigned int constant_time_select(unsigned int mask, |
217 | unsigned int a, | |
218 | unsigned int b) | |
0f113f3e MC |
219 | { |
220 | return (mask & a) | (~mask & b); | |
221 | } | |
294d1e36 | 222 | |
2688e7a0 MC |
223 | static ossl_inline size_t constant_time_select_s(size_t mask, |
224 | size_t a, | |
225 | size_t b) | |
226 | { | |
227 | return (mask & a) | (~mask & b); | |
228 | } | |
229 | ||
80e0ecbf DSH |
230 | static ossl_inline unsigned char constant_time_select_8(unsigned char mask, |
231 | unsigned char a, | |
232 | unsigned char b) | |
0f113f3e | 233 | { |
26a7d938 | 234 | return (unsigned char)constant_time_select(mask, a, b); |
0f113f3e | 235 | } |
294d1e36 | 236 | |
80e0ecbf DSH |
237 | static ossl_inline int constant_time_select_int(unsigned int mask, int a, |
238 | int b) | |
0f113f3e | 239 | { |
26a7d938 | 240 | return (int)constant_time_select(mask, (unsigned)(a), (unsigned)(b)); |
0f113f3e | 241 | } |
294d1e36 | 242 | |
2688e7a0 MC |
243 | static ossl_inline int constant_time_select_int_s(size_t mask, int a, int b) |
244 | { | |
26a7d938 K |
245 | return (int)constant_time_select((unsigned)mask, (unsigned)(a), |
246 | (unsigned)(b)); | |
2688e7a0 MC |
247 | } |
248 | ||
e0fa6324 MC |
249 | static ossl_inline uint32_t constant_time_select_32(uint32_t mask, uint32_t a, |
250 | uint32_t b) | |
251 | { | |
252 | return (mask & a) | (~mask & b); | |
253 | } | |
254 | ||
9018f3ce RS |
255 | static ossl_inline uint64_t constant_time_select_64(uint64_t mask, uint64_t a, |
256 | uint64_t b) | |
257 | { | |
258 | return (mask & a) | (~mask & b); | |
259 | } | |
260 | ||
e0fa6324 MC |
261 | /* |
262 | * mask must be 0xFFFFFFFF or 0x00000000. | |
263 | * | |
264 | * if (mask) { | |
265 | * uint32_t tmp = *a; | |
266 | * | |
267 | * *a = *b; | |
268 | * *b = tmp; | |
269 | * } | |
270 | */ | |
271 | static ossl_inline void constant_time_cond_swap_32(uint32_t mask, uint32_t *a, | |
272 | uint32_t *b) | |
273 | { | |
274 | uint32_t xor = *a ^ *b; | |
275 | ||
276 | xor &= mask; | |
277 | *a ^= xor; | |
278 | *b ^= xor; | |
279 | } | |
280 | ||
281 | /* | |
282 | * mask must be 0xFFFFFFFF or 0x00000000. | |
283 | * | |
284 | * if (mask) { | |
285 | * uint64_t tmp = *a; | |
286 | * | |
287 | * *a = *b; | |
288 | * *b = tmp; | |
289 | * } | |
290 | */ | |
291 | static ossl_inline void constant_time_cond_swap_64(uint64_t mask, uint64_t *a, | |
292 | uint64_t *b) | |
293 | { | |
294 | uint64_t xor = *a ^ *b; | |
295 | ||
296 | xor &= mask; | |
297 | *a ^= xor; | |
298 | *b ^= xor; | |
299 | } | |
300 | ||
301 | /* | |
302 | * table is a two dimensional array of bytes. Each row has rowsize elements. | |
303 | * Copies row number idx into out. rowsize and numrows are not considered | |
304 | * private. | |
305 | */ | |
306 | static ossl_inline void constant_time_lookup(void *out, | |
307 | const void *table, | |
308 | size_t rowsize, | |
309 | size_t numrows, | |
310 | size_t idx) | |
311 | { | |
312 | size_t i, j; | |
313 | const unsigned char *tablec = (const unsigned char *)table; | |
314 | unsigned char *outc = (unsigned char *)out; | |
315 | unsigned char mask; | |
316 | ||
317 | memset(out, 0, rowsize); | |
318 | ||
319 | /* Note idx may underflow - but that is well defined */ | |
320 | for (i = 0; i < numrows; i++, idx--) { | |
321 | mask = (unsigned char)constant_time_is_zero_s(idx); | |
322 | for (j = 0; j < rowsize; j++) | |
323 | *(outc + j) |= constant_time_select_8(mask, *(tablec++), 0); | |
324 | } | |
325 | } | |
326 | ||
0f113f3e | 327 | #endif /* HEADER_CONSTANT_TIME_LOCL_H */ |