*
*/
+
+
#include <openssl/err.h>
+#include "internal/bn_int.h"
#include "ec_lcl.h"
+#ifndef OPENSSL_NO_EC2M
-/* Compute the x-coordinate x/z for the point 2*(x/z) in Montgomery projective
+
+/*-
+ * Compute the x-coordinate x/z for the point 2*(x/z) in Montgomery projective
* coordinates.
* Uses algorithm Mdouble in appendix of
* Lopez, J. and Dahab, R. "Fast multiplication on elliptic curves over
if (!group->meth->field_mul(group, z, x, t1, ctx)) goto err;
if (!group->meth->field_sqr(group, x, x, ctx)) goto err;
if (!group->meth->field_sqr(group, t1, t1, ctx)) goto err;
- if (!group->meth->field_mul(group, t1, &group->b, t1, ctx)) goto err;
+ if (!group->meth->field_mul(group, t1, group->b, t1, ctx)) goto err;
if (!BN_GF2m_add(x, x, t1)) goto err;
ret = 1;
return ret;
}
-/* Compute the x-coordinate x1/z1 for the point (x1/z1)+(x2/x2) in Montgomery
+/*-
+ * Compute the x-coordinate x1/z1 for the point (x1/z1)+(x2/x2) in Montgomery
* projective coordinates.
* Uses algorithm Madd in appendix of
* Lopez, J. and Dahab, R. "Fast multiplication on elliptic curves over
return ret;
}
-/* Compute the x, y affine coordinates from the point (x1, z1) (x2, z2)
+/*-
+ * Compute the x, y affine coordinates from the point (x1, z1) (x2, z2)
* using Montgomery point multiplication algorithm Mxy() in appendix of
* Lopez, J. and Dahab, R. "Fast multiplication on elliptic curves over
* GF(2^m) without precomputation" (CHES '99, LNCS 1717).
return ret;
}
-/* Computes scalar*point and stores the result in r.
+
+/*-
+ * Computes scalar*point and stores the result in r.
* point can not equal r.
- * Uses algorithm 2P of
+ * Uses a modified algorithm 2P of
* Lopez, J. and Dahab, R. "Fast multiplication on elliptic curves over
* GF(2^m) without precomputation" (CHES '99, LNCS 1717).
+ *
+ * To protect against side-channel attack the function uses constant time swap,
+ * avoiding conditional branches.
*/
static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
const EC_POINT *point, BN_CTX *ctx)
z1 = BN_CTX_get(ctx);
if (z1 == NULL) goto err;
- x2 = &r->X;
- z2 = &r->Y;
+ x2 = r->X;
+ z2 = r->Y;
+
+ bn_wexpand(x1, bn_get_top(group->field));
+ bn_wexpand(z1, bn_get_top(group->field));
+ bn_wexpand(x2, bn_get_top(group->field));
+ bn_wexpand(z2, bn_get_top(group->field));
- if (!BN_GF2m_mod_arr(x1, &point->X, group->poly)) goto err; /* x1 = x */
+ if (!BN_GF2m_mod_arr(x1, point->X, group->poly)) goto err; /* x1 = x */
if (!BN_one(z1)) goto err; /* z1 = 1 */
if (!group->meth->field_sqr(group, z2, x1, ctx)) goto err; /* z2 = x1^2 = x^2 */
if (!group->meth->field_sqr(group, x2, z2, ctx)) goto err;
- if (!BN_GF2m_add(x2, x2, &group->b)) goto err; /* x2 = x^4 + b */
+ if (!BN_GF2m_add(x2, x2, group->b)) goto err; /* x2 = x^4 + b */
/* find top most bit and go one past it */
- i = scalar->top - 1;
+ i = bn_get_top(scalar) - 1;
mask = BN_TBIT;
- word = scalar->d[i];
+ word = bn_get_words(scalar)[i];
while (!(word & mask)) mask >>= 1;
mask >>= 1;
/* if top most bit was at word break, go to next word */
for (; i >= 0; i--)
{
- word = scalar->d[i];
+ word = bn_get_words(scalar)[i];
while (mask)
{
- if (word & mask)
- {
- if (!gf2m_Madd(group, &point->X, x1, z1, x2, z2, ctx)) goto err;
- if (!gf2m_Mdouble(group, x2, z2, ctx)) goto err;
- }
- else
- {
- if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err;
- if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
- }
+ BN_consttime_swap(word & mask, x1, x2, bn_get_top(group->field));
+ BN_consttime_swap(word & mask, z1, z2, bn_get_top(group->field));
+ if (!gf2m_Madd(group, point->X, x2, z2, x1, z1, ctx)) goto err;
+ if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
+ BN_consttime_swap(word & mask, x1, x2, bn_get_top(group->field));
+ BN_consttime_swap(word & mask, z1, z2, bn_get_top(group->field));
mask >>= 1;
}
mask = BN_TBIT;
}
/* convert out of "projective" coordinates */
- i = gf2m_Mxy(group, &point->X, &point->Y, x1, z1, x2, z2, ctx);
+ i = gf2m_Mxy(group, point->X, point->Y, x1, z1, x2, z2, ctx);
if (i == 0) goto err;
else if (i == 1)
{
}
else
{
- if (!BN_one(&r->Z)) goto err;
+ if (!BN_one(r->Z)) goto err;
r->Z_is_one = 1;
}
/* GF(2^m) field elements should always have BIGNUM::neg = 0 */
- BN_set_negative(&r->X, 0);
- BN_set_negative(&r->Y, 0);
+ BN_set_negative(r->X, 0);
+ BN_set_negative(r->Y, 0);
ret = 1;
}
-/* Computes the sum
+/*-
+ * Computes the sum
* scalar*group->generator + scalars[0]*points[0] + ... + scalars[num-1]*points[num-1]
* gracefully ignoring NULL scalar values.
*/
{
return ec_wNAF_have_precompute_mult(group);
}
+
+#endif