From 1c678e0e0603c376ba265d38bc572e1ddc2f182d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 20 Mar 2017 13:39:39 +0100 Subject: [PATCH] Update doc about minimum max_ops value Ok, so the original plan was to make mpi_inv_mod() the smallest block that could not be divided. Updated plan is that the smallest block will be either: - ecp_normalize_jac_many() (one mpi_inv_mod() + a number or mpi_mul_mpi()s) - or the second loop in ecp_precompute_comb() With default settings, the minimum non-restartable sequence is: - for P-256: 222M - for P-384: 341M This is within a 2-3x factor of originally planned value of 120M. However, that value can be approached, at the cost of some performance, by setting ECP_WINDOW_SIZE (w below) lower than the default of 6. For example: - w=4 -> 166M for any curve (perf. impact < 10%) - w=2 -> 130M for any curve (perf. impact ~ 30%) My opinion is that the current state with w=4 is a good compromise, and the code complexity need to attain 120M is not warranted by the 1.4 factor between that and the current minimum with w=4 (which is close to optimal perf). --- include/mbedtls/ecp.h | 10 ++++++++-- library/ecp.c | 6 +++--- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h index d44e65843..810cb9f78 100644 --- a/include/mbedtls/ecp.h +++ b/include/mbedtls/ecp.h @@ -274,8 +274,14 @@ mbedtls_ecp_keypair; * of the order of 3600 "basic operations" with default * settings. * - * \warning Values lower than 120 are currently not well-supported, in - * that sometimes functions will have to block for longer. + * \warning Very low values are not always respected: sometimes + * functions need to block for a minimum number of + * operations, and will do so even if max_ops is set to a + * lower value. That minimum depends on the curve size, and + * can be made lower by decreasing the value of + * \c MBEDTLS_ECP_WINDOW_SIZE. As an indication, the minimum + * is around 160 for P-256 with \c MBEDTLS_ECP_WINDOW_SIZE + * set to 4. */ void mbedtls_ecp_set_max_ops( unsigned max_ops ); #endif /* MBEDTLS_ECP_EARLY_RETURN */ diff --git a/library/ecp.c b/library/ecp.c index a1f019d39..b3bddbfc6 100644 --- a/library/ecp.c +++ b/library/ecp.c @@ -1397,7 +1397,7 @@ norm_dbl: for( i = 1; i < T_len; i <<= 1 ) TT[j++] = T + i; - ECP_BUDGET( ECP_OPS_INV + 6 * j - 2 ); // XXX: split next function? + ECP_BUDGET( ECP_OPS_INV + 6 * j - 2 ); MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, j ) ); @@ -1414,7 +1414,7 @@ norm_dbl: add: #endif - ECP_BUDGET( ( T_len - 1 ) * ECP_OPS_ADD ); // XXX: split loop? + ECP_BUDGET( ( T_len - 1 ) * ECP_OPS_ADD ); for( i = 1; i < T_len; i <<= 1 ) { @@ -1440,7 +1440,7 @@ norm_add: for( j = 0; j + 1 < T_len; j++ ) TT[j] = T + j + 1; - ECP_BUDGET( ECP_OPS_INV + 6 * j - 2 ); // XXX: split next function? + ECP_BUDGET( ECP_OPS_INV + 6 * j - 2 ); MBEDTLS_MPI_CHK( ecp_normalize_jac_many( grp, TT, j ) );