*
*/
/* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project. All rights reserved.
+ * Copyright (c) 1998-2003 The OpenSSL Project. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
*
*/
+#define OPENSSL_FIPSAPI
+
#include <openssl/err.h>
#include "ec_lcl.h"
+#ifndef OPENSSL_NO_EC2M
+
/* Compute the x-coordinate x/z for the point 2*(x/z) in Montgomery projective
* coordinates.
* Uses algorithm Mdouble in appendix of
* Lopez, J. and Dahab, R. "Fast multiplication on elliptic curves over
- * GF(2^m) without precomputation".
+ * GF(2^m) without precomputation" (CHES '99, LNCS 1717).
* modified to not require precomputation of c=b^{2^{m-1}}.
*/
static int gf2m_Mdouble(const EC_GROUP *group, BIGNUM *x, BIGNUM *z, BN_CTX *ctx)
/* Compute the x-coordinate x1/z1 for the point (x1/z1)+(x2/x2) in Montgomery
* projective coordinates.
* Uses algorithm Madd in appendix of
- * Lopex, J. and Dahab, R. "Fast multiplication on elliptic curves over
- * GF(2^m) without precomputation".
+ * Lopez, J. and Dahab, R. "Fast multiplication on elliptic curves over
+ * GF(2^m) without precomputation" (CHES '99, LNCS 1717).
*/
static int gf2m_Madd(const EC_GROUP *group, const BIGNUM *x, BIGNUM *x1, BIGNUM *z1,
const BIGNUM *x2, const BIGNUM *z2, BN_CTX *ctx)
/* Compute the x, y affine coordinates from the point (x1, z1) (x2, z2)
* using Montgomery point multiplication algorithm Mxy() in appendix of
- * Lopex, J. and Dahab, R. "Fast multiplication on elliptic curves over
- * GF(2^m) without precomputation".
+ * Lopez, J. and Dahab, R. "Fast multiplication on elliptic curves over
+ * GF(2^m) without precomputation" (CHES '99, LNCS 1717).
* Returns:
* 0 on error
* 1 if return value should be the point at infinity
if (BN_is_zero(z1))
{
- if (!BN_zero(x2)) return 0;
- if (!BN_zero(z2)) return 0;
+ BN_zero(x2);
+ BN_zero(z2);
return 1;
}
return ret;
}
+
/* Computes scalar*point and stores the result in r.
* point can not equal r.
- * Uses algorithm 2P of
- * Lopex, J. and Dahab, R. "Fast multiplication on elliptic curves over
- * GF(2^m) without precomputation".
+ * Uses a modified algorithm 2P of
+ * Lopez, J. and Dahab, R. "Fast multiplication on elliptic curves over
+ * GF(2^m) without precomputation" (CHES '99, LNCS 1717).
+ *
+ * To protect against side-channel attack the function uses constant time swap,
+ * avoiding conditional branches.
*/
static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
const EC_POINT *point, BN_CTX *ctx)
{
BIGNUM *x1, *x2, *z1, *z2;
- int ret = 0, i, j;
- BN_ULONG mask;
+ int ret = 0, i;
+ BN_ULONG mask,word;
if (r == point)
{
- ECerr(EC_F_EC_POINT_MUL, EC_R_INVALID_ARGUMENT);
+ ECerr(EC_F_EC_GF2M_MONTGOMERY_POINT_MULTIPLY, EC_R_INVALID_ARGUMENT);
return 0;
}
x2 = &r->X;
z2 = &r->Y;
+ bn_wexpand(x1, group->field.top);
+ bn_wexpand(z1, group->field.top);
+ bn_wexpand(x2, group->field.top);
+ bn_wexpand(z2, group->field.top);
+
if (!BN_GF2m_mod_arr(x1, &point->X, group->poly)) goto err; /* x1 = x */
if (!BN_one(z1)) goto err; /* z1 = 1 */
if (!group->meth->field_sqr(group, z2, x1, ctx)) goto err; /* z2 = x1^2 = x^2 */
if (!BN_GF2m_add(x2, x2, &group->b)) goto err; /* x2 = x^4 + b */
/* find top most bit and go one past it */
- i = scalar->top - 1; j = BN_BITS2 - 1;
+ i = scalar->top - 1;
mask = BN_TBIT;
- while (!(scalar->d[i] & mask)) { mask >>= 1; j--; }
- mask >>= 1; j--;
+ word = scalar->d[i];
+ while (!(word & mask)) mask >>= 1;
+ mask >>= 1;
/* if top most bit was at word break, go to next word */
if (!mask)
{
- i--; j = BN_BITS2 - 1;
+ i--;
mask = BN_TBIT;
}
for (; i >= 0; i--)
{
- for (; j >= 0; j--)
+ word = scalar->d[i];
+ while (mask)
{
- if (scalar->d[i] & mask)
- {
- if (!gf2m_Madd(group, &point->X, x1, z1, x2, z2, ctx)) goto err;
- if (!gf2m_Mdouble(group, x2, z2, ctx)) goto err;
- }
- else
- {
- if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err;
- if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
- }
+ BN_consttime_swap(word & mask, x1, x2, group->field.top);
+ BN_consttime_swap(word & mask, z1, z2, group->field.top);
+ if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err;
+ if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
+ BN_consttime_swap(word & mask, x1, x2, group->field.top);
+ BN_consttime_swap(word & mask, z1, z2, group->field.top);
mask >>= 1;
}
- j = BN_BITS2 - 1;
mask = BN_TBIT;
}
}
/* GF(2^m) field elements should always have BIGNUM::neg = 0 */
- BN_set_sign(&r->X, 0);
- BN_set_sign(&r->Y, 0);
+ BN_set_negative(&r->X, 0);
+ BN_set_negative(&r->Y, 0);
ret = 1;
size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
{
BN_CTX *new_ctx = NULL;
- int ret = 0, i;
+ int ret = 0;
+ size_t i;
EC_POINT *p=NULL;
+ EC_POINT *acc = NULL;
if (ctx == NULL)
{
}
/* This implementation is more efficient than the wNAF implementation for 2
- * or fewer points. Use the ec_wNAF_mul implementation for 3 or more points.
+ * or fewer points. Use the ec_wNAF_mul implementation for 3 or more points,
+ * or if we can perform a fast multiplication based on precomputation.
*/
- if ((scalar && (num > 1)) || (num > 2))
+ if ((scalar && (num > 1)) || (num > 2) || (num == 0 && EC_GROUP_have_precompute_mult(group)))
{
ret = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
goto err;
}
if ((p = EC_POINT_new(group)) == NULL) goto err;
+ if ((acc = EC_POINT_new(group)) == NULL) goto err;
- if (!EC_POINT_set_to_infinity(group, r)) goto err;
+ if (!EC_POINT_set_to_infinity(group, acc)) goto err;
if (scalar)
{
if (!ec_GF2m_montgomery_point_multiply(group, p, scalar, group->generator, ctx)) goto err;
- if (BN_get_sign(scalar))
+ if (BN_is_negative(scalar))
if (!group->meth->invert(group, p, ctx)) goto err;
- if (!group->meth->add(group, r, r, p, ctx)) goto err;
+ if (!group->meth->add(group, acc, acc, p, ctx)) goto err;
}
for (i = 0; i < num; i++)
{
if (!ec_GF2m_montgomery_point_multiply(group, p, scalars[i], points[i], ctx)) goto err;
- if (BN_get_sign(scalars[i]))
+ if (BN_is_negative(scalars[i]))
if (!group->meth->invert(group, p, ctx)) goto err;
- if (!group->meth->add(group, r, r, p, ctx)) goto err;
+ if (!group->meth->add(group, acc, acc, p, ctx)) goto err;
}
+ if (!EC_POINT_copy(r, acc)) goto err;
+
ret = 1;
err:
if (p) EC_POINT_free(p);
+ if (acc) EC_POINT_free(acc);
if (new_ctx != NULL)
BN_CTX_free(new_ctx);
return ret;
}
-/* Precomputation for point multiplication. */
+/* Precomputation for point multiplication: fall back to wNAF methods
+ * because ec_GF2m_simple_mul() uses ec_wNAF_mul() if appropriate */
+
int ec_GF2m_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
{
- /* There is no precomputation to do for Montgomery scalar multiplication but
- * since this implementation falls back to the wNAF multiplication for more than
- * two points, call the wNAF implementation's precompute.
- */
return ec_wNAF_precompute_mult(group, ctx);
- }
+ }
+
+int ec_GF2m_have_precompute_mult(const EC_GROUP *group)
+ {
+ return ec_wNAF_have_precompute_mult(group);
+ }
+
+#endif