AuroraMiddleware/mbedtls
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Made ecp_mul() faster and truly SPA resistant

Browse Source
This commit is contained in:
Manuel Pégourié-Gonnard 2012-11-21 13:00:58 +01:00 committed by Paul Bakker
parent 7652a593d6
commit b63f9e98f5
3 changed files with 119 additions and 79 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
include/polarssl/ecp.h
View File

@ -97,17 +97,23 @@ ecp_group;
#define POLARSSL_ECP_DP_SECP384R1 3
#define POLARSSL_ECP_DP_SECP521R1 4
/**
* Maximum bit size of the groups (that is, of N)
*/
#define POLARSSL_ECP_MAX_N_BITS 521
/*
* Maximum NAF width used for point multipliation. Default: 7.
* Maximum window size (actually, NAF width) used for point multipliation.
* Default: 7.
* Minimum value: 2. Maximum value: 8.
*
* Result is an array of at most ( 1 << ( POLARSSL_ECP_NAF_WIDTH - 1 ) )
* Result is an array of at most ( 1 << ( POLARSSL_ECP_WINDOW_SIZE - 1 ) )
* points used for point multiplication, so at most 64 by default.
* In practice, most curves will use less precomputed points.
*
* Reduction in size may reduce speed for big curves.
*/
#define POLARSSL_ECP_NAF_WIDTH 7 /**< Maximum NAF width used. */
#define POLARSSL_ECP_WINDOW_SIZE 7 /**< Maximum NAF width used. */
#ifdef __cplusplus
extern "C" {
@ -236,7 +242,11 @@ int ecp_sub( const ecp_group *grp, ecp_point *R,
*
* \return 0 if successful,
* POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
* POLARSSL_ERR_ECP_GENERIC if m < 0
* POLARSSL_ERR_ECP_GENERIC if m < 0 of m has greater bit
* length than N, the number of points in the group.
*
* \note This function executes a constant number of operations
* for random m in the allowed range.
*/
int ecp_mul( const ecp_group *grp, ecp_point *R,
const mpi *m, const ecp_point *P );

171
library/ecp.c
View File

@ -768,8 +768,9 @@ cleanup:
* Precompute odd multiples of P up to (2 * t_len - 1) P.
* The table is filled with T[i] = (2 * i + 1) P.
*/
static int ecp_precompute( ecp_point T[], size_t t_len,
const ecp_group *grp, const ecp_point *P )
static int ecp_precompute( const ecp_group *grp,
ecp_point T[], size_t t_len,
const ecp_point *P )
{
int ret;
size_t i;
@ -795,47 +796,114 @@ cleanup:
}
/*
* Integer multiplication: R = m * P (GECC 5.7, SPA-resistant)
* Maximum length of the precomputed table
*/
#define MAX_PRE_LEN ( 1 << (POLARSSL_ECP_WINDOW_SIZE - 1) )
/*
* Maximum length of the NAF: ceil( grp->nbits + 1 ) / w
* (that is: grp->nbits / w + 1)
* Allow p_bits + 1 bits in case M = grp->N + 1 is one bit longer than N.
*/
#define MAX_NAF_LEN ( POLARSSL_ECP_MAX_N_BITS / 2 + 1 )
/*
* Integer multiplication: R = m * P
*
* Based on fixed-pattern width-w NAF, see comments of ecp_w_naf_fixed()
* and <http://rd.springer.com/chapter/10.1007/3-540-36563-X_23>.
*
* This function executes a fixed number of operations for
* random m in the range 0 .. 2^nbits - 1.
*/
int ecp_mul( const ecp_group *grp, ecp_point *R,
const mpi *m, const ecp_point *P )
{
int ret, cmp;
size_t pos;
ecp_point Q[2];
int ret;
unsigned char w, m_is_odd;
size_t pre_len, naf_len, i, j;
signed char naf[ MAX_NAF_LEN ];
ecp_point Q, T[ MAX_PRE_LEN ];
mpi M;
cmp = mpi_cmp_int( m, 0 );
if( cmp < 0 )
if( mpi_cmp_int( m, 0 ) < 0 || mpi_msb( m ) > grp->nbits )
return( POLARSSL_ERR_ECP_GENERIC );
w = 3; // TODO: find optimal values once precompute() is optimized
if( w < 2 )
w = 2;
if( w > POLARSSL_ECP_WINDOW_SIZE )
w = POLARSSL_ECP_WINDOW_SIZE;
pre_len = 1 << ( w - 1 );
naf_len = grp->nbits / w + 1;
mpi_init( &M );
ecp_point_init( &Q );
for( i = 0; i < pre_len; i++ )
ecp_point_init( &T[i] );
m_is_odd = ( mpi_get_bit( m, 0 ) == 1 );
/*
* The general method works only for m != 0
* Make sure M is odd:
* later we'll get m * P by subtracting * P or 2 * P to M * P.
*/
if( cmp == 0 ) {
return( ecp_set_zero( R ) );
}
MPI_CHK( mpi_copy( &M, m ) );
MPI_CHK( mpi_add_int( &M, &M, 1 + m_is_odd ) );
ecp_point_init( &Q[0] ); ecp_point_init( &Q[1] );
/*
* Compute the fixed-pattern NAF and precompute odd multiples
*/
MPI_CHK( ecp_w_naf_fixed( naf, naf_len, w, &M ) );
MPI_CHK( ecp_precompute( grp, T, pre_len, P ) );
MPI_CHK( ecp_set_zero( &Q[0] ) );
for( pos = mpi_msb( m ) - 1 ; ; pos-- )
/*
* Compute M * P, using a variant of left-to-right 2^w-ary multiplication:
* at each step we add (2 * naf[i] + 1) P, then multiply by 2^w.
*
* If naf[i] >= 0, we have (2 * naf[i] + 1) P == T[ naf[i] ]
* Otherwise, (2 * naf[i] + 1) P == - ( 2 * ( - naf[i] - 1 ) + 1) P
* == T[ - naf[i] - 1 ]
*/
MPI_CHK( ecp_set_zero( &Q ) );
i = naf_len - 1;
while( 1 )
{
MPI_CHK( ecp_double_jac( grp, &Q[0], &Q[0] ) );
MPI_CHK( ecp_add_mixed( grp, &Q[1], &Q[0], P, 1 ) );
MPI_CHK( ecp_copy( &Q[0], &Q[ mpi_get_bit( m, pos ) ] ) );
if( naf[i] < 0 )
{
MPI_CHK( ecp_add_mixed( grp, &Q, &Q, &T[ - naf[i] - 1 ], -1 ) );
}
else
{
MPI_CHK( ecp_add_mixed( grp, &Q, &Q, &T[ naf[i] ], +1 ) );
}
if( pos == 0 )
if( i == 0 )
break;
i--;
for( j = 0; j < w; j++ )
{
MPI_CHK( ecp_double_jac( grp, &Q, &Q ) );
}
}
MPI_CHK( ecp_copy( R, &Q[0] ) );
MPI_CHK( ecp_normalize( grp, R ) );
/*
* Now get m * P from M * P.
* Since we don't need T[] any more, we can recycle it:
* we already have T[0] = P, now set T[1] = 2 * P.
*/
MPI_CHK( ecp_add( grp, &T[1], P, P ) );
MPI_CHK( ecp_sub( grp, R, &Q, &T[m_is_odd] ) );
cleanup:
ecp_point_free( &Q[0] ); ecp_point_free( &Q[1] );
mpi_free( &M );
ecp_point_free( &Q );
for( i = 0; i < pre_len; i++ )
ecp_point_free( &T[i] );
return( ret );
}
@ -850,72 +918,25 @@ int ecp_self_test( int verbose )
{
int ret;
size_t i;
int j, jj;
ecp_group grp;
ecp_point R;
mpi m;
unsigned long add_c_prev, dbl_c_prev;
char *exponents[] =
{
"000000000000000000000000000000000000000000000000", /* zero */
"000000000000000000000000000000000000000000000001", /* one */
"FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831", /* N */
"5EA6F389A38B8BC81E767753B15AA5569E1782E30ABE7D25", /* random */
"400000000000000000000000000000000000000000000000",
"7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
"555555555555555555555555555555555555555555555555",
"5EA6F389A38B8BC81E767753B15AA5569E1782E30ABE7D25",
/* "000000000000000000000000000000000000000000000010", TODO */
};
signed char x[3];
ecp_group_init( &grp );
ecp_point_init( &R );
mpi_init( &m );
if( verbose != 0 )
printf( " ECP test #0 (naf): " );
for( j = 1; j < 32; j += 2 )
{
mpi_lset( &m, j );
x[0] = x[1] = x[2] = 0;
MPI_CHK( ecp_w_naf_fixed( x, 3, 2, &m ) );
jj = ( 2 * x[0] + 1 ) + 4 * ( 2 * x[1] + 1 ) + 16 * ( 2 * x[2] + 1 );
if( j != jj ||
x[0] > 1 || x[0] < -2 ||
x[1] > 1 || x[1] < -2 ||
x[2] > 1 || x[2] < -2 )
{
if( verbose != 0 )
printf( "failed\n" );
printf( "%i != %i (%i, %i, %i)\n", j, jj, x[0], x[1], x[2] );
ret = 1;
goto cleanup;
}
x[0] = x[1] = x[2] = 0;
MPI_CHK( ecp_w_naf_fixed( x, 2, 3, &m ) );
jj = ( 2 * x[0] + 1 ) + 8 * ( 2 * x[1] + 1 );
if( j != jj ||
x[0] > 3 || x[0] < -4 ||
x[1] > 3 || x[1] < -4 ||
x[2] != 0 )
{
if( verbose != 0 )
printf( "failed\n" );
printf( "%i != %i (%i, %i)\n", j, jj, x[0], x[1] );
ret = 1;
goto cleanup;
}
}
if( verbose != 0 )
printf( "passed\n" );
MPI_CHK( ecp_use_known_dp( &grp, POLARSSL_ECP_DP_SECP192R1 ) );
if( verbose != 0 )

9
tests/suites/test_suite_ecp.data
View File

@ -94,6 +94,15 @@ ecp_small_mul:12:0:17:05:0
ECP small multiplication #13
ecp_small_mul:13:1:0:0:0
ECP small multiplication #14
ecp_small_mul:1:0:17:42:0
ECP small multiplication #15
ecp_small_mul:2:0:20:01:0
ECP small multiplication too big
ecp_small_mul:-1:0:0:0:POLARSSL_ERR_ECP_GENERIC
ECP mod p192 readable
ecp_fast_mod:SECP192R1:"000000000000010500000000000001040000000000000103000000000000010200000000000001010000000000000100"