From d5ca2c640aed5084dc2dc49c8c281edab7e6c182 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niels=20M=C3=B6ller?= <nisse@lysator.liu.se> Date: Thu, 28 Aug 2014 11:50:37 +0200 Subject: [PATCH] ecc_eh_to_a interface change, optionally reduce x mod q. --- ChangeLog | 3 +++ curve25519-mul-g.c | 2 +- curve25519-mul.c | 2 +- ecc-eh-to-a.c | 26 +++++++++++++++++++++----- ecc.h | 2 +- 5 files changed, 27 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index be68acc1..b8e8a40d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,8 @@ 2014-08-28 Niels Möller <nisse@lysator.liu.se> + * ecc-eh-to-a.c (ecc_eh_to_a): Analogous change as for ecc_j_to_a. + The modulo q case (op == 2) is hardcoded for curve25519. + * ecc-j-to-a.c (ecc_j_to_a): For curves using redc, always convert back from redc form. When producing x coordiante only optionally reduce it modulo q. Completely changes the meaning of the "flags" diff --git a/curve25519-mul-g.c b/curve25519-mul-g.c index f98bee3d..a695dad0 100644 --- a/curve25519-mul-g.c +++ b/curve25519-mul-g.c @@ -64,7 +64,7 @@ curve25519_mul_g (uint8_t *r, const uint8_t *n) mpn_set_base256_le (x, ecc_size, t, CURVE25519_SIZE); ecc_mul_g_eh (&nettle_curve25519, p, x, scratch_out); - ecc_eh_to_a (&nettle_curve25519, 2, x, p, scratch_out); + ecc_eh_to_a (&nettle_curve25519, 1, x, p, scratch_out); mpn_get_base256_le (r, CURVE25519_SIZE, x, ecc_size); gmp_free_limbs (scratch, itch); diff --git a/curve25519-mul.c b/curve25519-mul.c index ddc50eb5..e94e26b4 100644 --- a/curve25519-mul.c +++ b/curve25519-mul.c @@ -82,7 +82,7 @@ curve25519_mul (uint8_t *q, const uint8_t *n, const uint8_t *p) mpn_set_base256_le (s, ecc->size, t, CURVE25519_SIZE); ecc_mul_a_eh (ecc, x, s, x, scratch_out); - ecc_eh_to_a (ecc, 2, s, x, scratch_out); + ecc_eh_to_a (ecc, 1, s, x, scratch_out); mpn_get_base256_le (q, CURVE25519_SIZE, s, ecc->size); gmp_free_limbs (scratch, itch); diff --git a/ecc-eh-to-a.c b/ecc-eh-to-a.c index fd953bf3..80a450d9 100644 --- a/ecc-eh-to-a.c +++ b/ecc-eh-to-a.c @@ -33,6 +33,8 @@ # include "config.h" #endif +#include <assert.h> + #include "ecc.h" #include "ecc-internal.h" @@ -47,7 +49,7 @@ ecc_eh_to_a_itch (const struct ecc_curve *ecc) coordinates on the corresponding Montgomery curve. */ void ecc_eh_to_a (const struct ecc_curve *ecc, - int flags, + int op, mp_limb_t *r, const mp_limb_t *p, mp_limb_t *scratch) { @@ -88,10 +90,24 @@ ecc_eh_to_a (const struct ecc_curve *ecc, cy = mpn_sub_n (xp, tp, ecc->p, ecc->size); cnd_copy (cy, xp, tp, ecc->size); - if (flags & 2) - /* Skip y coordinate */ - return; - + if (op) + { + /* Skip y coordinate */ + if (op > 1) + { + /* Reduce modulo q. FIXME: Hardcoded for curve25519, + duplicates end of ecc_25519_modq. */ + mp_limb_t cy; + unsigned shift; + assert (ecc->bit_size == 255); + shift = 252 - GMP_NUMB_BITS * (ecc->size - 1); + cy = mpn_submul_1 (xp, ecc->q, ecc->size, + xp[ecc->size-1] >> shift); + assert (cy < 2); + cnd_add_n (cy, xp, ecc->q, ecc->size); + } + return; + } ecc_modp_add (ecc, sp, wp, vp); /* FIXME: Redundant. Also the (W + V) Z^-1 multiplication is redundant. */ diff --git a/ecc.h b/ecc.h index 2d8fc49f..0d07ee5d 100644 --- a/ecc.h +++ b/ecc.h @@ -206,7 +206,7 @@ mp_size_t ecc_eh_to_a_itch (const struct ecc_curve *ecc); void ecc_eh_to_a (const struct ecc_curve *ecc, - int flags, + int op, mp_limb_t *r, const mp_limb_t *p, mp_limb_t *scratch); -- GitLab