indent has problems with comments that are on the right hand side of a line.

[oweals/openssl.git] / crypto / ec / ec2_mult.c

diff --git a/crypto/ec/ec2_mult.c b/crypto/ec/ec2_mult.c
index e12b9b284a00298cec51623ec81193c2e86499b9..3f99e177f5e0c4feeb7901b0b7130a6b6046a515 100644 (file)
--- a/crypto/ec/ec2_mult.c
+++ b/crypto/ec/ec2_mult.c
@@ -67,12 +67,18 @@
  *
  */
 
+
+
 #include <openssl/err.h>
 
+#include "internal/bn_int.h"
 #include "ec_lcl.h"
 
+#ifndef OPENSSL_NO_EC2M
 
-/* Compute the x-coordinate x/z for the point 2*(x/z) in Montgomery projective 
+
+/*-
+ * Compute the x-coordinate x/z for the point 2*(x/z) in Montgomery projective 
  * coordinates.
  * Uses algorithm Mdouble in appendix of 
  *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
@@ -94,7 +100,7 @@ static int gf2m_Mdouble(const EC_GROUP *group, BIGNUM *x, BIGNUM *z, BN_CTX *ctx
        if (!group->meth->field_mul(group, z, x, t1, ctx)) goto err;
        if (!group->meth->field_sqr(group, x, x, ctx)) goto err;
        if (!group->meth->field_sqr(group, t1, t1, ctx)) goto err;
-       if (!group->meth->field_mul(group, t1, &group->b, t1, ctx)) goto err;
+       if (!group->meth->field_mul(group, t1, group->b, t1, ctx)) goto err;
        if (!BN_GF2m_add(x, x, t1)) goto err;
 
        ret = 1;
@@ -104,7 +110,8 @@ static int gf2m_Mdouble(const EC_GROUP *group, BIGNUM *x, BIGNUM *z, BN_CTX *ctx
        return ret;
        }
 
-/* Compute the x-coordinate x1/z1 for the point (x1/z1)+(x2/x2) in Montgomery 
+/*-
+ * Compute the x-coordinate x1/z1 for the point (x1/z1)+(x2/x2) in Montgomery 
  * projective coordinates.
  * Uses algorithm Madd in appendix of 
  *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
@@ -138,7 +145,8 @@ static int gf2m_Madd(const EC_GROUP *group, const BIGNUM *x, BIGNUM *x1, BIGNUM
        return ret;
        }
 
-/* Compute the x, y affine coordinates from the point (x1, z1) (x2, z2) 
+/*-
+ * Compute the x, y affine coordinates from the point (x1, z1) (x2, z2) 
  * using Montgomery point multiplication algorithm Mxy() in appendix of 
  *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
  *     GF(2^m) without precomputation" (CHES '99, LNCS 1717).
@@ -206,11 +214,16 @@ static int gf2m_Mxy(const EC_GROUP *group, const BIGNUM *x, const BIGNUM *y, BIG
        return ret;
        }
 
-/* Computes scalar*point and stores the result in r.
+
+/*-
+ * Computes scalar*point and stores the result in r.
  * point can not equal r.
- * Uses algorithm 2P of
+ * Uses a modified algorithm 2P of
  *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
  *     GF(2^m) without precomputation" (CHES '99, LNCS 1717).
+ *
+ * To protect against side-channel attack the function uses constant time swap,
+ * avoiding conditional branches.
  */
 static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
        const EC_POINT *point, BN_CTX *ctx)
@@ -241,19 +254,24 @@ static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r,
        z1 = BN_CTX_get(ctx);
        if (z1 == NULL) goto err;
 
-       x2 = &r->X;
-       z2 = &r->Y;
+       x2 = r->X;
+       z2 = r->Y;
+
+       bn_wexpand(x1, bn_get_top(group->field));
+       bn_wexpand(z1, bn_get_top(group->field));
+       bn_wexpand(x2, bn_get_top(group->field));
+       bn_wexpand(z2, bn_get_top(group->field));
 
-       if (!BN_GF2m_mod_arr(x1, &point->X, group->poly)) goto err; /* x1 = x */
+       if (!BN_GF2m_mod_arr(x1, point->X, group->poly)) goto err; /* x1 = x */
        if (!BN_one(z1)) goto err; /* z1 = 1 */
        if (!group->meth->field_sqr(group, z2, x1, ctx)) goto err; /* z2 = x1^2 = x^2 */
        if (!group->meth->field_sqr(group, x2, z2, ctx)) goto err;
-       if (!BN_GF2m_add(x2, x2, &group->b)) goto err; /* x2 = x^4 + b */
+       if (!BN_GF2m_add(x2, x2, group->b)) goto err; /* x2 = x^4 + b */
 
        /* find top most bit and go one past it */
-       i = scalar->top - 1;
+       i = bn_get_top(scalar) - 1;
        mask = BN_TBIT;
-       word = scalar->d[i];
+       word = bn_get_words(scalar)[i];
        while (!(word & mask)) mask >>= 1;
        mask >>= 1;
        /* if top most bit was at word break, go to next word */
@@ -265,26 +283,22 @@ static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r,
 
        for (; i >= 0; i--)
                {
-               word = scalar->d[i];
+               word = bn_get_words(scalar)[i];
                while (mask)
                        {
-                       if (word & mask)
-                               {
-                               if (!gf2m_Madd(group, &point->X, x1, z1, x2, z2, ctx)) goto err;
-                               if (!gf2m_Mdouble(group, x2, z2, ctx)) goto err;
-                               }
-                       else
-                               {
-                               if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err;
-                               if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
-                               }
+                       BN_consttime_swap(word & mask, x1, x2, bn_get_top(group->field));
+                       BN_consttime_swap(word & mask, z1, z2, bn_get_top(group->field));
+                       if (!gf2m_Madd(group, point->X, x2, z2, x1, z1, ctx)) goto err;
+                       if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
+                       BN_consttime_swap(word & mask, x1, x2, bn_get_top(group->field));
+                       BN_consttime_swap(word & mask, z1, z2, bn_get_top(group->field));
                        mask >>= 1;
                        }
                mask = BN_TBIT;
                }
 
        /* convert out of "projective" coordinates */
-       i = gf2m_Mxy(group, &point->X, &point->Y, x1, z1, x2, z2, ctx);
+       i = gf2m_Mxy(group, point->X, point->Y, x1, z1, x2, z2, ctx);
        if (i == 0) goto err;
        else if (i == 1) 
                {
@@ -292,13 +306,13 @@ static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r,
                }
        else
                {
-               if (!BN_one(&r->Z)) goto err;
+               if (!BN_one(r->Z)) goto err;
                r->Z_is_one = 1;
                }
 
        /* GF(2^m) field elements should always have BIGNUM::neg = 0 */
-       BN_set_negative(&r->X, 0);
-       BN_set_negative(&r->Y, 0);
+       BN_set_negative(r->X, 0);
+       BN_set_negative(r->Y, 0);
 
        ret = 1;
 
@@ -308,7 +322,8 @@ static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r,
        }
 
 
-/* Computes the sum
+/*-
+ * Computes the sum
  *     scalar*group->generator + scalars[0]*points[0] + ... + scalars[num-1]*points[num-1]
  * gracefully ignoring NULL scalar values.
  */
@@ -384,3 +399,5 @@ int ec_GF2m_have_precompute_mult(const EC_GROUP *group)
        {
        return ec_wNAF_have_precompute_mult(group);
        }
+
+#endif