AuroraMiddleware/mbedtls
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update comments at the end of montmul following Gilles' feedback

Browse Source 
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
This commit is contained in:
Tom Cosgrove 2022-08-31 17:57:34 +01:00
parent 5eefc3db3f
commit f0b2231fcd
1 changed files with 17 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
library/bignum_core.c
View File

@ -413,36 +413,37 @@ void mbedtls_mpi_core_montmul( mbedtls_mpi_uint *X,
for( size_t i = 0; i < AN_limbs; i++, T++ )
{
mbedtls_mpi_uint u0, u1;
/* T = (T + u0*B + u1*N) / 2^biL */
u0 = A[i];
u1 = ( T[0] + u0 * B[0] ) * mm;
mbedtls_mpi_uint u0 = A[i];
mbedtls_mpi_uint u1 = ( T[0] + u0 * B[0] ) * mm;
(void) mbedtls_mpi_core_mla( T, AN_limbs + 2, B, B_limbs, u0 );
(void) mbedtls_mpi_core_mla( T, AN_limbs + 2, N, AN_limbs, u1 );
}
/* It's possible that the result in T is > N, and so we might need to subtract N */
/*
* The result we want is (T >= N) ? T - N : T.
*
* For better constant-time properties in this function, we always do the
* subtraction, with the result in X.
*
* We also look to see if there was any carry in the final additions in the
* loop above.
*/
mbedtls_mpi_uint carry = T[AN_limbs];
mbedtls_mpi_uint borrow = mbedtls_mpi_core_sub( X, T, N, AN_limbs );
/*
* Both carry and borrow can only be 0 or 1.
* Using R as the Montgomery radix (auxiliary modulus) i.e. 2^(biL*AN_limbs):
*
* If carry = 1, the result in T must be > N by definition, and the subtraction
* using only AN_limbs limbs will create borrow, but that will have the correct
* final result.
* T can be in one of 3 ranges:
*
* i.e. (carry, borrow) of (1, 1) => return X
* 1) T < N : (carry, borrow) = (0, 1): we want T
* 2) N <= T < R : (carry, borrow) = (0, 0): we want X
* 3) T >= R : (carry, borrow) = (1, 1): we want X
*
* If carry = 0, then we want to use the result of the subtraction iff
* borrow = 0.
*
* i.e. (carry, borrow) of (0, 0) => return X
* (0, 1) => return T
*
* (carry, borrow) = (1, 0) can't happen.
* and (carry, borrow) = (1, 0) can't happen.
*
* So the correct return value is already in X if (carry ^ borrow) = 0,
* but is in (the lower AN_limbs limbs of) T if (carry ^ borrow) = 1.