2 * Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
3 * Copyright 2014 Cryptography Research, Inc.
5 * Licensed under the OpenSSL license (the "License"). You may not use
6 * this file except in compliance with the License. You can obtain a copy
7 * in the file LICENSE in the source distribution or at
8 * https://www.openssl.org/source/license.html
10 * Originally written by Mike Hamburg
13 #ifndef HEADER_FIELD_H
14 # define HEADER_FIELD_H
16 # include "internal/constant_time_locl.h"
21 # define NLIMBS (64/sizeof(word_t))
22 # define X_SER_BYTES 56
25 # if defined(__GNUC__) || defined(__clang__)
26 # define INLINE_UNUSED __inline__ __attribute__((__unused__,__always_inline__))
27 # define RESTRICT __restrict__
28 # define ALIGNED __attribute__((aligned(32)))
30 # define INLINE_UNUSED ossl_inline
37 } ALIGNED gf_s, gf[1];
39 /* RFC 7748 support */
40 # define X_PUBLIC_BYTES X_SER_BYTES
41 # define X_PRIVATE_BYTES X_PUBLIC_BYTES
42 # define X_PRIVATE_BITS 448
44 static INLINE_UNUSED void gf_copy(gf out, const gf a)
49 static INLINE_UNUSED void gf_add_RAW(gf out, const gf a, const gf b);
50 static INLINE_UNUSED void gf_sub_RAW(gf out, const gf a, const gf b);
51 static INLINE_UNUSED void gf_bias(gf inout, int amount);
52 static INLINE_UNUSED void gf_weak_reduce(gf inout);
54 void gf_strong_reduce(gf inout);
55 void gf_add(gf out, const gf a, const gf b);
56 void gf_sub(gf out, const gf a, const gf b);
57 void gf_mul(gf_s * RESTRICT out, const gf a, const gf b);
58 void gf_mulw_unsigned(gf_s * RESTRICT out, const gf a, uint32_t b);
59 void gf_sqr(gf_s * RESTRICT out, const gf a);
60 mask_t gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0. Return true if successful */
61 mask_t gf_eq(const gf x, const gf y);
62 mask_t gf_lobit(const gf x);
63 mask_t gf_hibit(const gf x);
65 void gf_serialize(uint8_t *serial, const gf x, int with_highbit);
66 mask_t gf_deserialize(gf x, const uint8_t serial[SER_BYTES], int with_hibit,
69 # include "f_impl.h" /* Bring in the inline implementations */
72 # define LIMBPERM(i) (i)
74 # define LIMB_MASK(i) (((1)<<LIMB_PLACE_VALUE(i))-1)
76 static const gf ZERO = {{{0}}}, ONE = {{{1}}};
78 /* Square x, n times. */
79 static ossl_inline void gf_sqrn(gf_s * RESTRICT y, const gf x, int n)
97 # define gf_add_nr gf_add_RAW
99 /* Subtract mod p. Bias by 2 and don't reduce */
100 static ossl_inline void gf_sub_nr(gf c, const gf a, const gf b)
108 /* Subtract mod p. Bias by amt but don't reduce. */
109 static ossl_inline void gf_subx_nr(gf c, const gf a, const gf b, int amt)
113 if (GF_HEADROOM < amt + 1)
117 /* Mul by signed int. Not constant-time WRT the sign of that int. */
118 static ossl_inline void gf_mulw(gf c, const gf a, int32_t w)
121 gf_mulw_unsigned(c, a, w);
123 gf_mulw_unsigned(c, a, -w);
128 /* Constant time, x = is_z ? z : y */
129 static ossl_inline void gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z)
133 for (i = 0; i < NLIMBS; i++) {
134 #if ARCH_WORD_BITS == 32
135 x[0].limb[i] = constant_time_select_32((uint32_t)is_z,
136 (uint32_t)(z[0].limb[i]),
137 (uint32_t)(y[0].limb[i]));
140 x[0].limb[i] = constant_time_select_64((uint64_t)is_z,
141 (uint64_t)(z[0].limb[i]),
142 (uint64_t)(y[0].limb[i]));
147 /* Constant time, if (neg) x=-x; */
148 static ossl_inline void gf_cond_neg(gf x, mask_t neg)
152 gf_cond_sel(x, x, y, neg);
155 /* Constant time, if (swap) (x,y) = (y,x); */
156 static ossl_inline void gf_cond_swap(gf x, gf_s * RESTRICT y, mask_t swap)
160 for (i = 0; i < NLIMBS; i++) {
161 #if ARCH_WORD_BITS == 32
162 constant_time_cond_swap_32((uint32_t)swap, (uint32_t *)&(x[0].limb[i]),
163 (uint32_t *)&(y->limb[i]));
166 constant_time_cond_swap_64((uint64_t)swap, (uint64_t *)&(x[0].limb[i]),
167 (uint64_t *)&(y->limb[i]));
172 #endif /* HEADER_FIELD_H */