diff --git a/ChangeLog b/ChangeLog index eb66f3aad2e353a7693948ef3fa6545951b8c5cb..0516a0406fa2d60d2e6d1cbbd2a64e5de2e622bb 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,15 @@ +2019-12-14 Niels Möller + + * ecc-mul-m.c (ecc_mul_m): New file and function. Implements + multipliction for curves in Montgomery representation, as used for + curve25519 and curve448. Extracted from curve25519_mul. + * ecc-internal.h (ecc_mul_m): Declare. + (ECC_MUL_M_ITCH): New macro. + * Makefile.in (hogweed_SOURCES): Add ecc-mul-m.c. + + * curve25519-mul.c (curve25519_mul): Use ecc_mul_m. + * curve448-mul.c (curve448_mul): Likewise. + 2019-12-13 Niels Möller * Merge curve448 implementation. diff --git a/Makefile.in b/Makefile.in index 036a3a1d7f8b9049ed7906db425f151fadac52e7..8d06149ff5fbbbcd2a2e6b579e3bdb2b21557a25 100644 --- a/Makefile.in +++ b/Makefile.in @@ -180,7 +180,7 @@ hogweed_SOURCES = sexp.c sexp-format.c \ ecc-dup-jj.c ecc-add-jja.c ecc-add-jjj.c \ ecc-eh-to-a.c \ ecc-dup-eh.c ecc-add-eh.c ecc-add-ehh.c \ - ecc-mul-g-eh.c ecc-mul-a-eh.c \ + ecc-mul-g-eh.c ecc-mul-a-eh.c ecc-mul-m.c \ ecc-mul-g.c ecc-mul-a.c ecc-hash.c ecc-random.c \ ecc-point.c ecc-scalar.c ecc-point-mul.c ecc-point-mul-g.c \ ecc-ecdsa-sign.c ecdsa-sign.c \ diff --git a/curve25519-mul.c b/curve25519-mul.c index ba76bc0bb1b2b27307ef9990087ef7794ebb71ab..aff2b293a84f24e1ffac70086627be232d0256b4 100644 --- a/curve25519-mul.c +++ b/curve25519-mul.c @@ -44,104 +44,21 @@ void curve25519_mul (uint8_t *q, const uint8_t *n, const uint8_t *p) { - const struct ecc_curve *ecc = &_nettle_curve25519; + const struct ecc_modulo *m = &_nettle_curve25519.p; mp_size_t itch; - mp_limb_t *scratch; - int i; - mp_limb_t cy; - - /* FIXME: Could save some more scratch space, e.g., by letting BB - overlap C, D, and CB overlap A, D. And possibly reusing some of - x2, z2, x3, z3. */ -#define x1 scratch -#define x2 (scratch + ecc->p.size) -#define z2 (scratch + 2*ecc->p.size) -#define x3 (scratch + 3*ecc->p.size) -#define z3 (scratch + 4*ecc->p.size) - -#define A (scratch + 5*ecc->p.size) -#define B (scratch + 6*ecc->p.size) -#define C (scratch + 7*ecc->p.size) -#define D (scratch + 8*ecc->p.size) -#define AA (scratch + 9*ecc->p.size) -#define BB (scratch +10*ecc->p.size) -#define E (scratch + 10*ecc->p.size) /* Overlap BB */ -#define DA (scratch + 9*ecc->p.size) /* Overlap AA */ -#define CB (scratch + 10*ecc->p.size) /* Overlap BB */ - - itch = ecc->p.size * 12; - scratch = gmp_alloc_limbs (itch); - - /* Note that 255 % GMP_NUMB_BITS == 0 isn't supported, so x1 always + mp_limb_t *x; + + itch = m->size + ECC_MUL_M_ITCH(m->size); + x = gmp_alloc_limbs (itch); + + /* Note that 255 % GMP_NUMB_BITS == 0 isn't supported, so x always holds at least 256 bits. */ - mpn_set_base256_le (x1, ecc->p.size, p, CURVE25519_SIZE); + mpn_set_base256_le (x, m->size, p, CURVE25519_SIZE); /* Clear bit 255, as required by RFC 7748. */ - x1[255/GMP_NUMB_BITS] &= ~((mp_limb_t) 1 << (255 % GMP_NUMB_BITS)); - - /* Initialize, x2 = x1, z2 = 1 */ - mpn_copyi (x2, x1, ecc->p.size); - z2[0] = 1; - mpn_zero (z2+1, ecc->p.size - 1); - - /* Get x3, z3 from doubling. Since bit 254 is forced to 1. */ - ecc_modp_add (ecc, A, x2, z2); - ecc_modp_sub (ecc, B, x2, z2); - ecc_modp_sqr (ecc, AA, A); - ecc_modp_sqr (ecc, BB, B); - ecc_modp_mul (ecc, x3, AA, BB); - ecc_modp_sub (ecc, E, AA, BB); - ecc_modp_addmul_1 (ecc, AA, E, 121665); - ecc_modp_mul (ecc, z3, E, AA); - - for (i = 253; i >= 3; i--) - { - int bit = (n[i/8] >> (i & 7)) & 1; - - cnd_swap (bit, x2, x3, 2*ecc->p.size); - - /* Formulas from draft-turner-thecurve25519function-00-Mont. We - compute new coordinates in memory-address order, since mul - and sqr clobbers higher limbs. */ - ecc_modp_add (ecc, A, x2, z2); - ecc_modp_sub (ecc, B, x2, z2); - ecc_modp_sqr (ecc, AA, A); - ecc_modp_sqr (ecc, BB, B); - ecc_modp_mul (ecc, x2, AA, BB); /* Last use of BB */ - ecc_modp_sub (ecc, E, AA, BB); - ecc_modp_addmul_1 (ecc, AA, E, 121665); - ecc_modp_add (ecc, C, x3, z3); - ecc_modp_sub (ecc, D, x3, z3); - ecc_modp_mul (ecc, z2, E, AA); /* Last use of E and AA */ - ecc_modp_mul (ecc, DA, D, A); /* Last use of D, A. FIXME: could - let CB overlap. */ - ecc_modp_mul (ecc, CB, C, B); - - ecc_modp_add (ecc, C, DA, CB); - ecc_modp_sqr (ecc, x3, C); - ecc_modp_sub (ecc, C, DA, CB); - ecc_modp_sqr (ecc, DA, C); - ecc_modp_mul (ecc, z3, DA, x1); - - /* FIXME: Could be combined with the loop's initial cnd_swap. */ - cnd_swap (bit, x2, x3, 2*ecc->p.size); - } - /* Do the 3 low zero bits, just duplicating x2 */ - for ( ; i >= 0; i--) - { - ecc_modp_add (ecc, A, x2, z2); - ecc_modp_sub (ecc, B, x2, z2); - ecc_modp_sqr (ecc, AA, A); - ecc_modp_sqr (ecc, BB, B); - ecc_modp_mul (ecc, x2, AA, BB); - ecc_modp_sub (ecc, E, AA, BB); - ecc_modp_addmul_1 (ecc, AA, E, 121665); - ecc_modp_mul (ecc, z2, E, AA); - } - ecc->p.invert (&ecc->p, x3, z2, z3 + ecc->p.size); - ecc_modp_mul (ecc, z3, x2, x3); - cy = mpn_sub_n (x2, z3, ecc->p.m, ecc->p.size); - cnd_copy (cy, x2, z3, ecc->p.size); - mpn_get_base256_le (q, CURVE25519_SIZE, x2, ecc->p.size); - - gmp_free_limbs (scratch, itch); + x[255/GMP_NUMB_BITS] &= ~((mp_limb_t) 1 << (255 % GMP_NUMB_BITS)); + + ecc_mul_m (m, 121665, 3, 253, x, n, x, x + m->size); + mpn_get_base256_le (q, CURVE25519_SIZE, x, m->size); + + gmp_free_limbs (x, itch); } diff --git a/curve448-mul.c b/curve448-mul.c index 59cf766467369b364fab1f8d3cd4720191b78b67..2090c8a57120d263681414f82fc1a606c2b53799 100644 --- a/curve448-mul.c +++ b/curve448-mul.c @@ -46,105 +46,16 @@ void curve448_mul (uint8_t *q, const uint8_t *n, const uint8_t *p) { - const struct ecc_curve *ecc = &_nettle_curve448; + const struct ecc_modulo *m = &_nettle_curve448.p; mp_size_t itch; - mp_limb_t *scratch; - int i; - mp_limb_t cy; - - /* FIXME: Could save some more scratch space, e.g., by letting BB - overlap C, D, and CB overlap A, D. And possibly reusing some of - x2, z2, x3, z3. */ -#define x1 scratch -#define x2 (scratch + ecc->p.size) -#define z2 (scratch + 2*ecc->p.size) -#define x3 (scratch + 3*ecc->p.size) -#define z3 (scratch + 4*ecc->p.size) - -#define A (scratch + 5*ecc->p.size) -#define B (scratch + 6*ecc->p.size) -#define C (scratch + 7*ecc->p.size) -#define D (scratch + 8*ecc->p.size) -#define AA (scratch + 9*ecc->p.size) -#define BB (scratch + 10*ecc->p.size) -#define E (scratch + 10*ecc->p.size) /* Overlap BB */ -#define DA (scratch + 9*ecc->p.size) /* Overlap AA */ -#define CB (scratch + 10*ecc->p.size) /* Overlap BB */ - -#define a24 39081 - - itch = ecc->p.size * 12; - assert (ecc->p.invert_itch + 5*ecc->p.size <= itch); - scratch = gmp_alloc_limbs (itch); - - /* Note that 255 % GMP_NUMB_BITS == 0 isn't supported, so x1 always - holds at least 256 bits. */ - mpn_set_base256_le (x1, ecc->p.size, p, CURVE448_SIZE); - - /* Initialize, x2 = x1, z2 = 1 */ - mpn_copyi (x2, x1, ecc->p.size); - z2[0] = 1; - mpn_zero (z2+1, ecc->p.size - 1); - - /* Get x3, z3 from doubling. Since bit 447 is forced to 1. */ - ecc_modp_add (ecc, A, x2, z2); - ecc_modp_sub (ecc, B, x2, z2); - ecc_modp_sqr (ecc, AA, A); - ecc_modp_sqr (ecc, BB, B); - ecc_modp_mul (ecc, x3, AA, BB); - ecc_modp_sub (ecc, E, AA, BB); - ecc_modp_addmul_1 (ecc, AA, E, a24); - ecc_modp_mul (ecc, z3, E, AA); - - for (i = 446; i >= 2; i--) - { - int bit = (n[i/8] >> (i & 7)) & 1; - - cnd_swap (bit, x2, x3, 2*ecc->p.size); - - /* Formulas from RFC 7748. We compute new coordinates in - memory-address order, since mul and sqr clobbers higher - limbs. */ - ecc_modp_add (ecc, A, x2, z2); - ecc_modp_sub (ecc, B, x2, z2); - ecc_modp_sqr (ecc, AA, A); - ecc_modp_sqr (ecc, BB, B); - ecc_modp_mul (ecc, x2, AA, BB); - ecc_modp_sub (ecc, E, AA, BB); /* Last use of BB */ - ecc_modp_addmul_1 (ecc, AA, E, a24); - ecc_modp_add (ecc, C, x3, z3); - ecc_modp_sub (ecc, D, x3, z3); - ecc_modp_mul (ecc, z2, E, AA); /* Last use of E and AA */ - ecc_modp_mul (ecc, DA, D, A); /* Last use of D, A. FIXME: could - let CB overlap. */ - ecc_modp_mul (ecc, CB, C, B); - - ecc_modp_add (ecc, C, DA, CB); - ecc_modp_sqr (ecc, x3, C); - ecc_modp_sub (ecc, C, DA, CB); - ecc_modp_sqr (ecc, DA, C); - ecc_modp_mul (ecc, z3, DA, x1); - - /* FIXME: Could be combined with the loop's initial cnd_swap. */ - cnd_swap (bit, x2, x3, 2*ecc->p.size); - } - /* Do the 2 low zero bits, just duplicating x2 */ - for ( ; i >= 0; i--) - { - ecc_modp_add (ecc, A, x2, z2); - ecc_modp_sub (ecc, B, x2, z2); - ecc_modp_sqr (ecc, AA, A); - ecc_modp_sqr (ecc, BB, B); - ecc_modp_mul (ecc, x2, AA, BB); - ecc_modp_sub (ecc, E, AA, BB); - ecc_modp_addmul_1 (ecc, AA, E, a24); - ecc_modp_mul (ecc, z2, E, AA); - } - ecc->p.invert (&ecc->p, x3, z2, z3 + ecc->p.size); - ecc_modp_mul (ecc, z3, x2, x3); - cy = mpn_sub_n (x2, z3, ecc->p.m, ecc->p.size); - cnd_copy (cy, x2, z3, ecc->p.size); - mpn_get_base256_le (q, CURVE448_SIZE, x2, ecc->p.size); - - gmp_free_limbs (scratch, itch); + mp_limb_t *x; + + itch = m->size + ECC_MUL_M_ITCH(m->size); + x = gmp_alloc_limbs (itch); + + mpn_set_base256_le (x, m->size, p, CURVE448_SIZE); + ecc_mul_m (m, 39081, 2, 446, x, n, x, x + m->size); + mpn_get_base256_le (q, CURVE448_SIZE, x, m->size); + + gmp_free_limbs (x, itch); } diff --git a/ecc-internal.h b/ecc-internal.h index a7c7fa15c355b94c452f235e6fa97db338e8c5ec..cd1a1573fc093184d1376d872852f61cedb5a6b3 100644 --- a/ecc-internal.h +++ b/ecc-internal.h @@ -69,6 +69,7 @@ #define ecc_mul_a _nettle_ecc_mul_a #define ecc_mul_g_eh _nettle_ecc_mul_g_eh #define ecc_mul_a_eh _nettle_ecc_mul_a_eh +#define ecc_mul_m _nettle_ecc_mul_m #define cnd_copy _nettle_cnd_copy #define sec_add_1 _nettle_sec_add_1 #define sec_sub_1 _nettle_sec_sub_1 @@ -393,6 +394,13 @@ ecc_mul_a_eh (const struct ecc_curve *ecc, const mp_limb_t *np, const mp_limb_t *p, mp_limb_t *scratch); +void +ecc_mul_m (const struct ecc_modulo *m, + mp_limb_t a24, + unsigned bit_low, unsigned bit_high, + mp_limb_t *qx, const uint8_t *n, const mp_limb_t *px, + mp_limb_t *scratch); + void cnd_copy (int cnd, mp_limb_t *rp, const mp_limb_t *ap, mp_size_t n); @@ -439,6 +447,7 @@ curve448_eh_to_x (mp_limb_t *xp, const mp_limb_t *p, #define ECC_MUL_A_EH_ITCH(size) \ (((3 << ECC_MUL_A_EH_WBITS) + 10) * (size)) #endif +#define ECC_MUL_M_ITCH(size) (11*(size)) #define ECC_ECDSA_SIGN_ITCH(size) (12*(size)) #define ECC_MOD_RANDOM_ITCH(size) (size) #define ECC_HASH_ITCH(size) (1+(size)) diff --git a/ecc-mul-m.c b/ecc-mul-m.c new file mode 100644 index 0000000000000000000000000000000000000000..68bdd16e8e948145cd3ef71cfa4a74bbcc67a769 --- /dev/null +++ b/ecc-mul-m.c @@ -0,0 +1,135 @@ +/* ecc-mul-m.c + + Point multiplication using Montgomery curve representation. + + Copyright (C) 2014 Niels Möller + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include + +#include "ecc.h" +#include "ecc-internal.h" + +void +ecc_mul_m (const struct ecc_modulo *m, + mp_limb_t a24, + unsigned bit_low, unsigned bit_high, + mp_limb_t *qx, const uint8_t *n, const mp_limb_t *px, + mp_limb_t *scratch) +{ + unsigned i; + mp_limb_t cy; + + /* FIXME: Could save some more scratch space, e.g., by letting BB + overlap C, D, and CB overlap A, D. And possibly reusing some of + x2, z2, x3, z3. */ +#define x2 (scratch) +#define z2 (scratch + m->size) +#define x3 (scratch + 2*m->size) +#define z3 (scratch + 3*m->size) + +#define A (scratch + 4*m->size) +#define B (scratch + 5*m->size) +#define C (scratch + 6*m->size) +#define D (scratch + 7*m->size) +#define AA (scratch + 8*m->size) +#define BB (scratch +9*m->size) +#define E (scratch + 9*m->size) /* Overlap BB */ +#define DA (scratch + 8*m->size) /* Overlap AA */ +#define CB (scratch + 9*m->size) /* Overlap BB */ + + /* Initialize, x2 = px, z2 = 1 */ + mpn_copyi (x2, px, m->size); + z2[0] = 1; + mpn_zero (z2+1, m->size - 1); + + /* Get x3, z3 from doubling. Since most significant bit is forced to 1. */ + ecc_mod_add (m, A, x2, z2); + ecc_mod_sub (m, B, x2, z2); + ecc_mod_sqr (m, AA, A); + ecc_mod_sqr (m, BB, B); + ecc_mod_mul (m, x3, AA, BB); + ecc_mod_sub (m, E, AA, BB); + ecc_mod_addmul_1 (m, AA, E, a24); + ecc_mod_mul (m, z3, E, AA); + + for (i = bit_high; i >= bit_low; i--) + { + int bit = (n[i/8] >> (i & 7)) & 1; + + cnd_swap (bit, x2, x3, 2*m->size); + + /* Formulas from RFC 7748. We compute new coordinates in + memory-address order, since mul and sqr clobbers higher + limbs. */ + ecc_mod_add (m, A, x2, z2); + ecc_mod_sub (m, B, x2, z2); + ecc_mod_sqr (m, AA, A); + ecc_mod_sqr (m, BB, B); + ecc_mod_mul (m, x2, AA, BB); /* Last use of BB */ + ecc_mod_sub (m, E, AA, BB); + ecc_mod_addmul_1 (m, AA, E, a24); + ecc_mod_add (m, C, x3, z3); + ecc_mod_sub (m, D, x3, z3); + ecc_mod_mul (m, z2, E, AA); /* Last use of E and AA */ + ecc_mod_mul (m, DA, D, A); /* Last use of D, A. FIXME: could + let CB overlap. */ + ecc_mod_mul (m, CB, C, B); + + ecc_mod_add (m, C, DA, CB); + ecc_mod_sqr (m, x3, C); + ecc_mod_sub (m, C, DA, CB); + ecc_mod_sqr (m, DA, C); + ecc_mod_mul (m, z3, DA, px); + + /* FIXME: Could be combined with the loop's initial cnd_swap. */ + cnd_swap (bit, x2, x3, 2*m->size); + } + /* Do the low zero bits, just duplicating x2 */ + for (i = 0; i < bit_low; i++) + { + ecc_mod_add (m, A, x2, z2); + ecc_mod_sub (m, B, x2, z2); + ecc_mod_sqr (m, AA, A); + ecc_mod_sqr (m, BB, B); + ecc_mod_mul (m, x2, AA, BB); + ecc_mod_sub (m, E, AA, BB); + ecc_mod_addmul_1 (m, AA, E, a24); + ecc_mod_mul (m, z2, E, AA); + } + assert (m->invert_itch <= 7 * m->size); + m->invert (m, x3, z2, z3 + m->size); + ecc_mod_mul (m, z3, x2, x3); + cy = mpn_sub_n (qx, z3, m->m, m->size); + cnd_copy (cy, qx, z3, m->size); +}