yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-12-23 04:55:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged support for Curve25519

Browse source
This commit is contained in:
Paul Bakker 2013-12-05 16:11:38 +01:00
parent 498fd354c6 93f41dbdfd
commit 48d78a5e60
12 changed files with 795 additions and 99 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ChangeLog
View file

@ -5,6 +5,7 @@ Features
* EC key generation support in gen_key app * EC key generation support in gen_key app
* Support for adhering to client ciphersuite order preference * Support for adhering to client ciphersuite order preference
(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE) (POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
* Support for Curve25519
Changes Changes
* gen_prime() speedup * gen_prime() speedup
@ -15,6 +16,7 @@ Changes
* Split off curves from ecp.c into ecp_curves.c * Split off curves from ecp.c into ecp_curves.c
Bugfix Bugfix
* Fixed bug in mpi_set_bit() on platforms where t_uint is wider than int
* Fixed X.509 hostname comparison (with non-regular characters) * Fixed X.509 hostname comparison (with non-regular characters)
* SSL now gracefully handles missing RNG * SSL now gracefully handles missing RNG
* Missing defines / cases for RSA_PSK key exchange * Missing defines / cases for RSA_PSK key exchange

22
include/polarssl/bignum.h
View file

@ -236,11 +236,10 @@ void mpi_swap( mpi *X, mpi *Y );
* *
* \param X MPI to conditionally assign to * \param X MPI to conditionally assign to
* \param Y Value to be assigned * \param Y Value to be assigned
* \param assign 1: perform the assignment, 0: leave X untouched * \param assign 1: perform the assignment, 0: keep X's original value
* *
* \return 0 if successful, * \return 0 if successful,
* POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed, * POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
* POLARSSL_ERR_MPI_BAD_INPUT_DATA if assing is not 0 or 1
* *
* \note This function is equivalent to * \note This function is equivalent to
* if( assign ) mpi_copy( X, Y ); * if( assign ) mpi_copy( X, Y );
@ -251,6 +250,25 @@ void mpi_swap( mpi *X, mpi *Y );
*/ */
int mpi_safe_cond_assign( mpi *X, const mpi *Y, unsigned char assign ); int mpi_safe_cond_assign( mpi *X, const mpi *Y, unsigned char assign );
/**
* \brief Safe conditional swap X <-> Y if swap is 1
*
* \param X First mpi value
* \param Y Second mpi value
* \param assign 1: perform the swap, 0: keep X and Y's original values
*
* \return 0 if successful,
* POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed,
*
* \note This function is equivalent to
* if( assign ) mpi_swap( X, Y );
* except that it avoids leaking any information about whether
* the assignment was done or not (the above code may leak
* information through branch prediction and/or memory access
* patterns analysis).
*/
int mpi_safe_cond_swap( mpi *X, mpi *Y, unsigned char assign );
/** /**
* \brief Set value from integer * \brief Set value from integer
* *

4
include/polarssl/config.h
View file

@ -248,6 +248,10 @@
#define POLARSSL_ECP_DP_BP256R1_ENABLED #define POLARSSL_ECP_DP_BP256R1_ENABLED
#define POLARSSL_ECP_DP_BP384R1_ENABLED #define POLARSSL_ECP_DP_BP384R1_ENABLED
#define POLARSSL_ECP_DP_BP512R1_ENABLED #define POLARSSL_ECP_DP_BP512R1_ENABLED
//#define POLARSSL_ECP_DP_M221_ENABLED // Not implemented yet!
#define POLARSSL_ECP_DP_M255_ENABLED
//#define POLARSSL_ECP_DP_M383_ENABLED // Not implemented yet!
//#define POLARSSL_ECP_DP_M511_ENABLED // Not implemented yet!
/** /**
* \def POLARSSL_ECP_NIST_OPTIM * \def POLARSSL_ECP_NIST_OPTIM

46
include/polarssl/ecp.h
View file

@ -64,10 +64,16 @@ typedef enum
POLARSSL_ECP_DP_BP256R1, /*!< 256-bits Brainpool curve */ POLARSSL_ECP_DP_BP256R1, /*!< 256-bits Brainpool curve */
POLARSSL_ECP_DP_BP384R1, /*!< 384-bits Brainpool curve */ POLARSSL_ECP_DP_BP384R1, /*!< 384-bits Brainpool curve */
POLARSSL_ECP_DP_BP512R1, /*!< 512-bits Brainpool curve */ POLARSSL_ECP_DP_BP512R1, /*!< 512-bits Brainpool curve */
POLARSSL_ECP_DP_M221, /*!< (not implemented yet) */
POLARSSL_ECP_DP_M255, /*!< Curve25519 */
POLARSSL_ECP_DP_M383, /*!< (not implemented yet) */
POLARSSL_ECP_DP_M511, /*!< (not implemented yet) */
} ecp_group_id; } ecp_group_id;
/** /**
* Number of supported curves (plus one for NONE) * Number of supported curves (plus one for NONE).
*
* (Montgomery curves excluded for now.)
*/ */
#define POLARSSL_ECP_DP_MAX 9 #define POLARSSL_ECP_DP_MAX 9
@ -102,10 +108,16 @@ ecp_point;
/** /**
* \brief ECP group structure * \brief ECP group structure
* *
* The curves we consider are defined by y^2 = x^3 + A x + B mod P, * We consider two types of curves equations:
* and a generator for a large subgroup of order N is fixed. * 1. Short Weierstrass y^2 = x^3 + A x + B mod P (SEC1 + RFC 4492)
* 2. Montgomery, y^2 = x^3 + A x^2 + x mod P (M255 + draft)
* In both cases, a generator G for a prime-order subgroup is fixed. In the
* short weierstrass, this subgroup is actually the whole curve, and its
* cardinal is denoted by N.
* *
* pbits and nbits must be the size of P and N in bits. * In the case of Montgomery curves, we don't store A but (A + 2) / 4 which is
* the quantity actualy used in the formulas. Also, nbits is not the size of N
* but the required size for private keys.
* *
* If modp is NULL, reduction modulo P is done using a generic algorithm. * If modp is NULL, reduction modulo P is done using a generic algorithm.
* Otherwise, it must point to a function that takes an mpi in the range * Otherwise, it must point to a function that takes an mpi in the range
@ -118,18 +130,18 @@ typedef struct
{ {
ecp_group_id id; /*!< internal group identifier */ ecp_group_id id; /*!< internal group identifier */
mpi P; /*!< prime modulus of the base field */ mpi P; /*!< prime modulus of the base field */
mpi A; /*!< linear term in the equation */ mpi A; /*!< 1. A in the equation, or 2. (A + 2) / 4 */
mpi B; /*!< constant term in the equation */ mpi B; /*!< 1. B in the equation, or 2. unused */
ecp_point G; /*!< generator of the subgroup used */ ecp_point G; /*!< generator of the (sub)group used */
mpi N; /*!< the order of G */ mpi N; /*!< 1. the order of G, or 2. unused */
size_t pbits; /*!< number of bits in P */ size_t pbits; /*!< number of bits in P */
size_t nbits; /*!< number of bits in N */ size_t nbits; /*!< number of bits in 1. P, or 2. private keys */
unsigned int h; /*!< cofactor (unused now: assume 1) */ unsigned int h; /*!< unused */
int (*modp)(mpi *); /*!< function for fast reduction mod P */ int (*modp)(mpi *); /*!< function for fast reduction mod P */
int (*t_pre)(ecp_point *, void *); /*!< currently unused */ int (*t_pre)(ecp_point *, void *); /*!< unused */
int (*t_post)(ecp_point *, void *); /*!< currently unused */ int (*t_post)(ecp_point *, void *); /*!< unused */
void *t_data; /*!< currently unused */ void *t_data; /*!< unused */
ecp_point *T; /*!< pre-computed points for ecp_mul() */ ecp_point *T; /*!< pre-computed points for ecp_mul_comb() */
size_t T_size; /*!< number for pre-computed points */ size_t T_size; /*!< number for pre-computed points */
} }
ecp_group; ecp_group;
@ -438,6 +450,9 @@ int ecp_tls_write_group( const ecp_group *grp, size_t *olen,
* *
* \return 0 if successful, * \return 0 if successful,
* POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed * POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
*
* \note This function does not support Montgomery curves, such as
* Curve25519.
*/ */
int ecp_add( const ecp_group *grp, ecp_point *R, int ecp_add( const ecp_group *grp, ecp_point *R,
const ecp_point *P, const ecp_point *Q ); const ecp_point *P, const ecp_point *Q );
@ -452,6 +467,9 @@ int ecp_add( const ecp_group *grp, ecp_point *R,
* *
* \return 0 if successful, * \return 0 if successful,
* POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed * POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
*
* \note This function does not support Montgomery curves, such as
* Curve25519.
*/ */
int ecp_sub( const ecp_group *grp, ecp_point *R, int ecp_sub( const ecp_group *grp, ecp_point *R,
const ecp_point *P, const ecp_point *Q ); const ecp_point *P, const ecp_point *Q );

48
library/bignum.c
View file

@ -214,16 +214,16 @@ int mpi_safe_cond_assign( mpi *X, const mpi *Y, unsigned char assign )
int ret = 0; int ret = 0;
size_t i; size_t i;
if( assign * ( 1 - assign ) != 0 ) /* make sure assign is 0 or 1 */
return( POLARSSL_ERR_MPI_BAD_INPUT_DATA ); assign = ( assign != 0 );
if( Y->n > X->n )
MPI_CHK( mpi_grow( X, Y->n ) ); MPI_CHK( mpi_grow( X, Y->n ) );
/* Do the conditional assign safely */
X->s = X->s * (1 - assign) + Y->s * assign; X->s = X->s * (1 - assign) + Y->s * assign;
for( i = 0; i < Y->n; i++ ) for( i = 0; i < Y->n; i++ )
X->p[i] = X->p[i] * (1 - assign) + Y->p[i] * assign; X->p[i] = X->p[i] * (1 - assign) + Y->p[i] * assign;
for( ; i < X->n; i++ ) for( ; i < X->n; i++ )
X->p[i] *= (1 - assign); X->p[i] *= (1 - assign);
@ -231,6 +231,43 @@ cleanup:
return( ret ); return( ret );
} }
/*
* Conditionally swap X and Y, without leaking information
* about whether the swap was made or not.
* Here it is not ok to simply swap the pointers, which whould lead to
* different memory access patterns when X and Y are used afterwards.
*/
int mpi_safe_cond_swap( mpi *X, mpi *Y, unsigned char swap )
{
int ret, s;
size_t i;
t_uint tmp;
if( X == Y )
return( 0 );
/* make sure swap is 0 or 1 */
swap = ( swap != 0 );
MPI_CHK( mpi_grow( X, Y->n ) );
MPI_CHK( mpi_grow( Y, X->n ) );
s = X->s;
X->s = X->s * (1 - swap) + Y->s * swap;
Y->s = Y->s * (1 - swap) + s * swap;
for( i = 0; i < X->n; i++ )
{
tmp = X->p[i];
X->p[i] = X->p[i] * (1 - swap) + Y->p[i] * swap;
Y->p[i] = Y->p[i] * (1 - swap) + tmp * swap;
}
cleanup:
return( ret );
}
/* /*
* Set value from integer * Set value from integer
*/ */
@ -280,7 +317,8 @@ int mpi_set_bit( mpi *X, size_t pos, unsigned char val )
MPI_CHK( mpi_grow( X, off + 1 ) ); MPI_CHK( mpi_grow( X, off + 1 ) );
} }
X->p[off] = ( X->p[off] & ~( 0x01 << idx ) ) | ( val << idx ); X->p[off] &= ~( (t_uint) 0x01 << idx );
X->p[off] |= (t_uint) val << idx;
cleanup: cleanup:

8
library/ecdsa.c
View file

@ -59,6 +59,10 @@ int ecdsa_sign( ecp_group *grp, mpi *r, mpi *s,
ecp_point R; ecp_point R;
mpi k, e; mpi k, e;
/* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
if( grp->N.p == NULL )
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
ecp_point_init( &R ); ecp_point_init( &R );
mpi_init( &k ); mpi_init( &k );
mpi_init( &e ); mpi_init( &e );
@ -129,6 +133,10 @@ int ecdsa_verify( ecp_group *grp,
ecp_point_init( &R ); ecp_point_init( &P ); ecp_point_init( &R ); ecp_point_init( &P );
mpi_init( &e ); mpi_init( &s_inv ); mpi_init( &u1 ); mpi_init( &u2 ); mpi_init( &e ); mpi_init( &s_inv ); mpi_init( &u1 ); mpi_init( &u2 );
/* Fail cleanly on curves such as Curve25519 that can't be used for ECDSA */
if( grp->N.p == NULL )
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
/* /*
* Step 1: make sure r and s are in range 1..n-1 * Step 1: make sure r and s are in range 1..n-1
*/ */

455
library/ecp.c
View file

@ -31,6 +31,8 @@
* FIPS 186-3 http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf * FIPS 186-3 http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf
* RFC 4492 for the related TLS structures and constants * RFC 4492 for the related TLS structures and constants
* *
* [M255] http://cr.yp.to/ecdh/curve25519-20060209.pdf
*
* [2] CORON, Jean-Sébastien. Resistance against differential power analysis * [2] CORON, Jean-Sébastien. Resistance against differential power analysis
* for elliptic curve cryptosystems. In : Cryptographic Hardware and * for elliptic curve cryptosystems. In : Cryptographic Hardware and
* Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302. * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302.
@ -78,6 +80,34 @@
static unsigned long add_count, dbl_count, mul_count; static unsigned long add_count, dbl_count, mul_count;
#endif #endif
#if defined(POLARSSL_ECP_DP_SECP192R1_ENABLED) || \
defined(POLARSSL_ECP_DP_SECP224R1_ENABLED) || \
defined(POLARSSL_ECP_DP_SECP256R1_ENABLED) || \
defined(POLARSSL_ECP_DP_SECP384R1_ENABLED) || \
defined(POLARSSL_ECP_DP_SECP521R1_ENABLED) || \
defined(POLARSSL_ECP_DP_BP256R1_ENABLED) || \
defined(POLARSSL_ECP_DP_BP384R1_ENABLED) || \
defined(POLARSSL_ECP_DP_BP512R1_ENABLED)
#define POLARSSL_ECP_SHORT_WEIERSTRASS
#endif
#if defined(POLARSSL_ECP_DP_M221_ENABLED) || \
defined(POLARSSL_ECP_DP_M255_ENABLED) || \
defined(POLARSSL_ECP_DP_M383_ENABLED) || \
defined(POLARSSL_ECP_DP_M511_ENABLED)
#define POLARSSL_ECP_MONTGOMERY
#endif
/*
* Curve types: internal for now, might be exposed later
*/
typedef enum
{
POLARSSL_ECP_TYPE_NONE = 0,
POLARSSL_ECP_TYPE_SHORT_WEIERSTRASS, /* y^2 = x^3 + a x + b */
POLARSSL_ECP_TYPE_MONTGOMERY, /* y^2 = x^3 + a x^2 + x */
} ecp_curve_type;
/* /*
* List of supported curves: * List of supported curves:
* - internal ID * - internal ID
@ -176,6 +206,20 @@ const ecp_curve_info *ecp_curve_info_from_name( const char *name )
return( NULL ); return( NULL );
} }
/*
* Get the type of a curve
*/
static inline ecp_curve_type ecp_get_type( const ecp_group *grp )
{
if( grp->G.X.p == NULL )
return( POLARSSL_ECP_TYPE_NONE );
if( grp->G.Y.p == NULL )
return( POLARSSL_ECP_TYPE_MONTGOMERY );
else
return( POLARSSL_ECP_TYPE_SHORT_WEIERSTRASS );
}
/* /*
* Initialize (the components of) a point * Initialize (the components of) a point
*/ */
@ -632,11 +676,20 @@ cleanup:
while( mpi_cmp_mpi( &N, &grp->P ) >= 0 ) \ while( mpi_cmp_mpi( &N, &grp->P ) >= 0 ) \
MPI_CHK( mpi_sub_abs( &N, &N, &grp->P ) ) MPI_CHK( mpi_sub_abs( &N, &N, &grp->P ) )
#if defined(POLARSSL_ECP_SHORT_WEIERSTRASS)
/*
* For curves in short Weierstrass form, we do all the internal operations in
* Jacobian coordinates.
*
* For multiplication, we'll use a comb method with coutermeasueres against
* SPA, hence timing attacks.
*/
/* /*
* Normalize jacobian coordinates so that Z == 0 || Z == 1 (GECC 3.2.1) * Normalize jacobian coordinates so that Z == 0 || Z == 1 (GECC 3.2.1)
* Cost: 1N := 1I + 3M + 1S * Cost: 1N := 1I + 3M + 1S
*/ */
static int ecp_normalize( const ecp_group *grp, ecp_point *pt ) static int ecp_normalize_jac( const ecp_group *grp, ecp_point *pt )
{ {
int ret; int ret;
mpi Zi, ZZi; mpi Zi, ZZi;
@ -678,11 +731,11 @@ cleanup:
* Theory", Algorithm 10.3.4.) * Theory", Algorithm 10.3.4.)
* *
* Warning: fails (returning an error) if one of the points is zero! * Warning: fails (returning an error) if one of the points is zero!
* This should never happen, see choice of w in ecp_mul(). * This should never happen, see choice of w in ecp_mul_comb().
* *
* Cost: 1N(t) := 1I + (6t - 3)M + 1S * Cost: 1N(t) := 1I + (6t - 3)M + 1S
*/ */
static int ecp_normalize_many( const ecp_group *grp, static int ecp_normalize_jac_many( const ecp_group *grp,
ecp_point *T[], size_t t_len ) ecp_point *T[], size_t t_len )
{ {
int ret; int ret;
@ -690,7 +743,7 @@ static int ecp_normalize_many( const ecp_group *grp,
mpi *c, u, Zi, ZZi; mpi *c, u, Zi, ZZi;
if( t_len < 2 ) if( t_len < 2 )
return( ecp_normalize( grp, *T ) ); return( ecp_normalize_jac( grp, *T ) );
if( ( c = (mpi *) polarssl_malloc( t_len * sizeof( mpi ) ) ) == NULL ) if( ( c = (mpi *) polarssl_malloc( t_len * sizeof( mpi ) ) ) == NULL )
return( POLARSSL_ERR_ECP_MALLOC_FAILED ); return( POLARSSL_ERR_ECP_MALLOC_FAILED );
@ -756,7 +809,7 @@ cleanup:
* Conditional point inversion: Q -> -Q = (Q.X, -Q.Y, Q.Z) without leak. * Conditional point inversion: Q -> -Q = (Q.X, -Q.Y, Q.Z) without leak.
* "inv" must be 0 (don't invert) or 1 (invert) or the result will be invalid * "inv" must be 0 (don't invert) or 1 (invert) or the result will be invalid
*/ */
static int ecp_safe_invert( const ecp_group *grp, static int ecp_safe_invert_jac( const ecp_group *grp,
ecp_point *Q, ecp_point *Q,
unsigned char inv ) unsigned char inv )
{ {
@ -843,7 +896,7 @@ cleanup:
* but those of P don't need to. R is not normalized. * but those of P don't need to. R is not normalized.
* *
* Special cases: (1) P or Q is zero, (2) R is zero, (3) P == Q. * Special cases: (1) P or Q is zero, (2) R is zero, (3) P == Q.
* None of these cases can happen as intermediate step in ecp_mul(): * None of these cases can happen as intermediate step in ecp_mul_comb():
* - at each step, P, Q and R are multiples of the base point, the factor * - at each step, P, Q and R are multiples of the base point, the factor
* being less than its order, so none of them is zero; * being less than its order, so none of them is zero;
* - Q is an odd multiple of the base point, P an even multiple, * - Q is an odd multiple of the base point, P an even multiple,
@ -929,15 +982,17 @@ cleanup:
/* /*
* Addition: R = P + Q, result's coordinates normalized * Addition: R = P + Q, result's coordinates normalized
* Cost: 1A + 1N = 1I + 11M + 4S
*/ */
int ecp_add( const ecp_group *grp, ecp_point *R, int ecp_add( const ecp_group *grp, ecp_point *R,
const ecp_point *P, const ecp_point *Q ) const ecp_point *P, const ecp_point *Q )
{ {
int ret; int ret;
if( ecp_get_type( grp ) != POLARSSL_ECP_TYPE_SHORT_WEIERSTRASS )
return( POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE );
MPI_CHK( ecp_add_mixed( grp, R, P, Q ) ); MPI_CHK( ecp_add_mixed( grp, R, P, Q ) );
MPI_CHK( ecp_normalize( grp, R ) ); MPI_CHK( ecp_normalize_jac( grp, R ) );
cleanup: cleanup:
return( ret ); return( ret );
@ -945,7 +1000,6 @@ cleanup:
/* /*
* Subtraction: R = P - Q, result's coordinates normalized * Subtraction: R = P - Q, result's coordinates normalized
* Cost: 1A + 1N = 1I + 11M + 4S
*/ */
int ecp_sub( const ecp_group *grp, ecp_point *R, int ecp_sub( const ecp_group *grp, ecp_point *R,
const ecp_point *P, const ecp_point *Q ) const ecp_point *P, const ecp_point *Q )
@ -955,13 +1009,16 @@ int ecp_sub( const ecp_group *grp, ecp_point *R,
ecp_point_init( &mQ ); ecp_point_init( &mQ );
if( ecp_get_type( grp ) != POLARSSL_ECP_TYPE_SHORT_WEIERSTRASS )
return( POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE );
/* mQ = - Q */ /* mQ = - Q */
ecp_copy( &mQ, Q ); ecp_copy( &mQ, Q );
if( mpi_cmp_int( &mQ.Y, 0 ) != 0 ) if( mpi_cmp_int( &mQ.Y, 0 ) != 0 )
MPI_CHK( mpi_sub_mpi( &mQ.Y, &grp->P, &mQ.Y ) ); MPI_CHK( mpi_sub_mpi( &mQ.Y, &grp->P, &mQ.Y ) );
MPI_CHK( ecp_add_mixed( grp, R, P, &mQ ) ); MPI_CHK( ecp_add_mixed( grp, R, P, &mQ ) );
MPI_CHK( ecp_normalize( grp, R ) ); MPI_CHK( ecp_normalize_jac( grp, R ) );
cleanup: cleanup:
ecp_point_free( &mQ ); ecp_point_free( &mQ );
@ -972,11 +1029,11 @@ cleanup:
/* /*
* Randomize jacobian coordinates: * Randomize jacobian coordinates:
* (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l
* This is sort of the reverse operation of ecp_normalize(). * This is sort of the reverse operation of ecp_normalize_jac().
* *
* This countermeasure was first suggested in [2]. * This countermeasure was first suggested in [2].
*/ */
static int ecp_randomize_coordinates( const ecp_group *grp, ecp_point *pt, static int ecp_randomize_jac( const ecp_group *grp, ecp_point *pt,
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
{ {
int ret; int ret;
@ -1115,7 +1172,7 @@ static int ecp_precompute_comb( const ecp_group *grp,
TT[k++] = cur; TT[k++] = cur;
} }
ecp_normalize_many( grp, TT, k ); ecp_normalize_jac_many( grp, TT, k );
/* /*
* Compute the remaining ones using the minimal number of additions * Compute the remaining ones using the minimal number of additions
@ -1132,7 +1189,7 @@ static int ecp_precompute_comb( const ecp_group *grp,
} }
} }
ecp_normalize_many( grp, TT, k ); ecp_normalize_jac_many( grp, TT, k );
/* /*
* Post-precessing: reclaim some memory by * Post-precessing: reclaim some memory by
@ -1175,7 +1232,7 @@ static int ecp_select_comb( const ecp_group *grp, ecp_point *R,
MPI_CHK( mpi_lset( &R->Z, 1 ) ); MPI_CHK( mpi_lset( &R->Z, 1 ) );
/* Safely invert result if i is "negative" */ /* Safely invert result if i is "negative" */
MPI_CHK( ecp_safe_invert( grp, R, i >> 7 ) ); MPI_CHK( ecp_safe_invert_jac( grp, R, i >> 7 ) );
cleanup: cleanup:
return( ret ); return( ret );
@ -1203,7 +1260,7 @@ static int ecp_mul_comb_core( const ecp_group *grp, ecp_point *R,
i = d; i = d;
MPI_CHK( ecp_select_comb( grp, R, T, t_len, x[i] ) ); MPI_CHK( ecp_select_comb( grp, R, T, t_len, x[i] ) );
if( f_rng != 0 ) if( f_rng != 0 )
MPI_CHK( ecp_randomize_coordinates( grp, R, f_rng, p_rng ) ); MPI_CHK( ecp_randomize_jac( grp, R, f_rng, p_rng ) );
while( i-- != 0 ) while( i-- != 0 )
{ {
@ -1219,11 +1276,13 @@ cleanup:
} }
/* /*
* Multiplication using the comb method * Multiplication using the comb method,
* for curves in short Weierstrass form
*/ */
int ecp_mul( ecp_group *grp, ecp_point *R, static int ecp_mul_comb( ecp_group *grp, ecp_point *R,
const mpi *m, const ecp_point *P, const mpi *m, const ecp_point *P,
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) int (*f_rng)(void *, unsigned char *, size_t),
void *p_rng )
{ {
int ret; int ret;
unsigned char w, m_is_odd, p_eq_g, pre_len, i; unsigned char w, m_is_odd, p_eq_g, pre_len, i;
@ -1232,28 +1291,13 @@ int ecp_mul( ecp_group *grp, ecp_point *R,
ecp_point *T; ecp_point *T;
mpi M, mm; mpi M, mm;
/*
* Sanity checks (before we even initialize anything)
*/
if( mpi_cmp_int( &P->Z, 1 ) != 0 ||
mpi_get_bit( &grp->N, 0 ) != 1 )
{
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
}
if( ( ret = ecp_check_privkey( grp, m ) ) != 0 )
return( ret );
/* We'll need this later, but do it now to possibly avoid checking P */
p_eq_g = ( mpi_cmp_mpi( &P->Y, &grp->G.Y ) == 0 &&
mpi_cmp_mpi( &P->X, &grp->G.X ) == 0 );
if( ! p_eq_g && ( ret = ecp_check_pubkey( grp, P ) ) != 0 )
return( ret );
mpi_init( &M ); mpi_init( &M );
mpi_init( &mm ); mpi_init( &mm );
/* we need N to be odd to trnaform m in an odd number, check now */
if( mpi_get_bit( &grp->N, 0 ) != 1 )
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
/* /*
* Minimize the number of multiplications, that is minimize * Minimize the number of multiplications, that is minimize
* 10 * d * w + 18 * 2^(w-1) + 11 * d + 7 * w, with d = ceil( nbits / w ) * 10 * d * w + 18 * 2^(w-1) + 11 * d + 7 * w, with d = ceil( nbits / w )
@ -1265,6 +1309,8 @@ int ecp_mul( ecp_group *grp, ecp_point *R,
* If P == G, pre-compute a bit more, since this may be re-used later. * If P == G, pre-compute a bit more, since this may be re-used later.
* Just adding one ups the cost of the first mul by at most 3%. * Just adding one ups the cost of the first mul by at most 3%.
*/ */
p_eq_g = ( mpi_cmp_mpi( &P->Y, &grp->G.Y ) == 0 &&
mpi_cmp_mpi( &P->X, &grp->G.X ) == 0 );
if( p_eq_g ) if( p_eq_g )
w++; w++;
@ -1326,8 +1372,8 @@ int ecp_mul( ecp_group *grp, ecp_point *R,
/* /*
* Now get m * P from M * P and normalize it * Now get m * P from M * P and normalize it
*/ */
MPI_CHK( ecp_safe_invert( grp, R, ! m_is_odd ) ); MPI_CHK( ecp_safe_invert_jac( grp, R, ! m_is_odd ) );
MPI_CHK( ecp_normalize( grp, R ) ); MPI_CHK( ecp_normalize_jac( grp, R ) );
cleanup: cleanup:
@ -1347,23 +1393,228 @@ cleanup:
return( ret ); return( ret );
} }
#endif /* POLARSSL_ECP_SHORT_WEIERSTRASS */
#if defined(POLARSSL_ECP_MONTGOMERY)
/* /*
* Check that a point is valid as a public key (SEC1 3.2.3.1) * For Montgomery curves, we do all the internal arithmetic in projective
* coordinates. Import/export of points uses only the x coordinates, which is
* internaly represented as X / Z.
*
* For scalar multiplication, we'll use a Montgomery ladder.
*/ */
int ecp_check_pubkey( const ecp_group *grp, const ecp_point *pt )
/*
* Normalize Montgomery x/z coordinates: X = X/Z, Z = 1
* Cost: 1M + 1I
*/
static int ecp_normalize_mxz( const ecp_group *grp, ecp_point *P )
{
int ret;
MPI_CHK( mpi_inv_mod( &P->Z, &P->Z, &grp->P ) );
MPI_CHK( mpi_mul_mpi( &P->X, &P->X, &P->Z ) ); MOD_MUL( P->X );
MPI_CHK( mpi_lset( &P->Z, 1 ) );
cleanup:
return( ret );
}
/*
* Randomize projective x/z coordinates:
* (X, Z) -> (l X, l Z) for random l
* This is sort of the reverse operation of ecp_normalize_mxz().
*
* This countermeasure was first suggested in [2].
* Cost: 2M
*/
static int ecp_randomize_mxz( const ecp_group *grp, ecp_point *P,
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
{
int ret;
mpi l;
size_t p_size = (grp->pbits + 7) / 8;
int count = 0;
mpi_init( &l );
/* Generate l such that 1 < l < p */
do
{
mpi_fill_random( &l, p_size, f_rng, p_rng );
while( mpi_cmp_mpi( &l, &grp->P ) >= 0 )
mpi_shift_r( &l, 1 );
if( count++ > 10 )
return( POLARSSL_ERR_ECP_RANDOM_FAILED );
}
while( mpi_cmp_int( &l, 1 ) <= 0 );
MPI_CHK( mpi_mul_mpi( &P->X, &P->X, &l ) ); MOD_MUL( P->X );
MPI_CHK( mpi_mul_mpi( &P->Z, &P->Z, &l ) ); MOD_MUL( P->Z );
cleanup:
mpi_free( &l );
return( ret );
}
/*
* Double-and-add: R = 2P, S = P + Q, with d = X(P - Q),
* for Montgomery curves in x/z coordinates.
*
* http://www.hyperelliptic.org/EFD/g1p/auto-code/montgom/xz/ladder/mladd-1987-m.op3
* with
* d = X1
* P = (X2, Z2)
* Q = (X3, Z3)
* R = (X4, Z4)
* S = (X5, Z5)
* and eliminating temporary variables tO, ..., t4.
*
* Cost: 5M + 4S
*/
static int ecp_double_add_mxz( const ecp_group *grp,
ecp_point *R, ecp_point *S,
const ecp_point *P, const ecp_point *Q,
const mpi *d )
{
int ret;
mpi A, AA, B, BB, E, C, D, DA, CB;
mpi_init( &A ); mpi_init( &AA ); mpi_init( &B );
mpi_init( &BB ); mpi_init( &E ); mpi_init( &C );
mpi_init( &D ); mpi_init( &DA ); mpi_init( &CB );
MPI_CHK( mpi_add_mpi( &A, &P->X, &P->Z ) ); MOD_ADD( A );
MPI_CHK( mpi_mul_mpi( &AA, &A, &A ) ); MOD_MUL( AA );
MPI_CHK( mpi_sub_mpi( &B, &P->X, &P->Z ) ); MOD_SUB( B );
MPI_CHK( mpi_mul_mpi( &BB, &B, &B ) ); MOD_MUL( BB );
MPI_CHK( mpi_sub_mpi( &E, &AA, &BB ) ); MOD_SUB( E );
MPI_CHK( mpi_add_mpi( &C, &Q->X, &Q->Z ) ); MOD_ADD( C );
MPI_CHK( mpi_sub_mpi( &D, &Q->X, &Q->Z ) ); MOD_SUB( D );
MPI_CHK( mpi_mul_mpi( &DA, &D, &A ) ); MOD_MUL( DA );
MPI_CHK( mpi_mul_mpi( &CB, &C, &B ) ); MOD_MUL( CB );
MPI_CHK( mpi_add_mpi( &S->X, &DA, &CB ) ); MOD_MUL( S->X );
MPI_CHK( mpi_mul_mpi( &S->X, &S->X, &S->X ) ); MOD_MUL( S->X );
MPI_CHK( mpi_sub_mpi( &S->Z, &DA, &CB ) ); MOD_SUB( S->Z );
MPI_CHK( mpi_mul_mpi( &S->Z, &S->Z, &S->Z ) ); MOD_MUL( S->Z );
MPI_CHK( mpi_mul_mpi( &S->Z, d, &S->Z ) ); MOD_MUL( S->Z );
MPI_CHK( mpi_mul_mpi( &R->X, &AA, &BB ) ); MOD_MUL( R->X );
MPI_CHK( mpi_mul_mpi( &R->Z, &grp->A, &E ) ); MOD_MUL( R->Z );
MPI_CHK( mpi_add_mpi( &R->Z, &BB, &R->Z ) ); MOD_ADD( R->Z );
MPI_CHK( mpi_mul_mpi( &R->Z, &E, &R->Z ) ); MOD_MUL( R->Z );
cleanup:
mpi_free( &A ); mpi_free( &AA ); mpi_free( &B );
mpi_free( &BB ); mpi_free( &E ); mpi_free( &C );
mpi_free( &D ); mpi_free( &DA ); mpi_free( &CB );
return( ret );
}
/*
* Multiplication with Montgomery ladder in x/z coordinates,
* for curves in Montgomery form
*/
static int ecp_mul_mxz( ecp_group *grp, ecp_point *R,
const mpi *m, const ecp_point *P,
int (*f_rng)(void *, unsigned char *, size_t),
void *p_rng )
{
int ret;
size_t i;
unsigned char b;
ecp_point RP;
mpi PX;
ecp_point_init( &RP ); mpi_init( &PX );
/* Save PX and read from P before writing to R, in case P == R */
mpi_copy( &PX, &P->X );
MPI_CHK( ecp_copy( &RP, P ) );
/* Set R to zero in modified x/z coordinates */
MPI_CHK( mpi_lset( &R->X, 1 ) );
MPI_CHK( mpi_lset( &R->Z, 0 ) );
mpi_free( &R->Y );
/* RP.X might be sligtly larger than P, so reduce it */
MOD_ADD( RP.X );
/* Randomize coordinates of the starting point */
if( f_rng != NULL )
MPI_CHK( ecp_randomize_mxz( grp, &RP, f_rng, p_rng ) );
/* Loop invariant: R = result so far, RP = R + P */
i = mpi_msb( m ); /* one past the (zero-based) most significant bit */
while( i-- > 0 )
{
b = mpi_get_bit( m, i );
/*
* if (b) R = 2R + P else R = 2R,
* which is:
* if (b) double_add( RP, R, RP, R )
* else double_add( R, RP, R, RP )
* but using safe conditional swaps to avoid leaks
*/
MPI_CHK( mpi_safe_cond_swap( &R->X, &RP.X, b ) );
MPI_CHK( mpi_safe_cond_swap( &R->Z, &RP.Z, b ) );
MPI_CHK( ecp_double_add_mxz( grp, R, &RP, R, &RP, &PX ) );
MPI_CHK( mpi_safe_cond_swap( &R->X, &RP.X, b ) );
MPI_CHK( mpi_safe_cond_swap( &R->Z, &RP.Z, b ) );
}
MPI_CHK( ecp_normalize_mxz( grp, R ) );
cleanup:
ecp_point_free( &RP ); mpi_free( &PX );
return( ret );
}
#endif /* POLARSSL_ECP_MONTGOMERY */
/*
* Multiplication R = m * P
*/
int ecp_mul( ecp_group *grp, ecp_point *R,
const mpi *m, const ecp_point *P,
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
{
int ret;
/* Common sanity checks */
if( mpi_cmp_int( &P->Z, 1 ) != 0 )
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
if( ( ret = ecp_check_privkey( grp, m ) ) != 0 ||
( ret = ecp_check_pubkey( grp, P ) ) != 0 )
return( ret );
#if defined(POLARSSL_ECP_MONTGOMERY)
if( ecp_get_type( grp ) == POLARSSL_ECP_TYPE_MONTGOMERY )
return( ecp_mul_mxz( grp, R, m, P, f_rng, p_rng ) );
#endif
#if defined(POLARSSL_ECP_SHORT_WEIERSTRASS)
if( ecp_get_type( grp ) == POLARSSL_ECP_TYPE_SHORT_WEIERSTRASS )
return( ecp_mul_comb( grp, R, m, P, f_rng, p_rng ) );
#endif
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
}
#if defined(POLARSSL_ECP_SHORT_WEIERSTRASS)
/*
* Check that an affine point is valid as a public key,
* short weierstrass curves (SEC1 3.2.3.1)
*/
static int ecp_check_pubkey_sw( const ecp_group *grp, const ecp_point *pt )
{ {
int ret; int ret;
mpi YY, RHS; mpi YY, RHS;
if( mpi_cmp_int( &pt->Z, 0 ) == 0 ) /* pt coordinates must be normalized for our checks */
return( POLARSSL_ERR_ECP_INVALID_KEY );
/*
* pt coordinates must be normalized for our checks
*/
if( mpi_cmp_int( &pt->Z, 1 ) != 0 )
return( POLARSSL_ERR_ECP_INVALID_KEY );
if( mpi_cmp_int( &pt->X, 0 ) < 0 || if( mpi_cmp_int( &pt->X, 0 ) < 0 ||
mpi_cmp_int( &pt->Y, 0 ) < 0 || mpi_cmp_int( &pt->Y, 0 ) < 0 ||
mpi_cmp_mpi( &pt->X, &grp->P ) >= 0 || mpi_cmp_mpi( &pt->X, &grp->P ) >= 0 ||
@ -1391,32 +1642,112 @@ cleanup:
return( ret ); return( ret );
} }
#endif /* POLARSSL_ECP_SHORT_WEIERSTRASS */
#if defined(POLARSSL_ECP_MONTGOMERY)
/* /*
* Check that an mpi is valid as a private key (SEC1 3.2) * Check validity of a public key for Montgomery curves with x-only schemes
*/ */
int ecp_check_privkey( const ecp_group *grp, const mpi *d ) static int ecp_check_pubkey_mx( const ecp_group *grp, const ecp_point *pt )
{ {
/* We want 1 <= d <= N-1 */ /* [M255 p. 5] Just check X is the correct number of bytes */
if ( mpi_cmp_int( d, 1 ) < 0 || mpi_cmp_mpi( d, &grp->N ) >= 0 ) if( mpi_size( &pt->X ) > ( grp->nbits + 7 ) / 8 )
return( POLARSSL_ERR_ECP_INVALID_KEY ); return( POLARSSL_ERR_ECP_INVALID_KEY );
return( 0 ); return( 0 );
} }
#endif /* POLARSSL_ECP_MONTGOMERY */
/* /*
* Generate a keypair (SEC1 3.2.1) * Check that a point is valid as a public key
*/
int ecp_check_pubkey( const ecp_group *grp, const ecp_point *pt )
{
/* Must use affine coordinates */
if( mpi_cmp_int( &pt->Z, 1 ) != 0 )
return( POLARSSL_ERR_ECP_INVALID_KEY );
#if defined(POLARSSL_ECP_MONTGOMERY)
if( ecp_get_type( grp ) == POLARSSL_ECP_TYPE_MONTGOMERY )
return( ecp_check_pubkey_mx( grp, pt ) );
#endif
#if defined(POLARSSL_ECP_SHORT_WEIERSTRASS)
if( ecp_get_type( grp ) == POLARSSL_ECP_TYPE_SHORT_WEIERSTRASS )
return( ecp_check_pubkey_sw( grp, pt ) );
#endif
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
}
/*
* Check that an mpi is valid as a private key
*/
int ecp_check_privkey( const ecp_group *grp, const mpi *d )
{
#if defined(POLARSSL_ECP_MONTGOMERY)
if( ecp_get_type( grp ) == POLARSSL_ECP_TYPE_MONTGOMERY )
{
/* see [M255] page 5 */
if( mpi_get_bit( d, 0 ) != 0 ||
mpi_get_bit( d, 1 ) != 0 ||
mpi_get_bit( d, 2 ) != 0 ||
mpi_msb( d ) - 1 != grp->nbits ) /* mpi_msb is one-based! */
return( POLARSSL_ERR_ECP_INVALID_KEY );
else
return( 0 );
}
#endif
#if defined(POLARSSL_ECP_SHORT_WEIERSTRASS)
if( ecp_get_type( grp ) == POLARSSL_ECP_TYPE_SHORT_WEIERSTRASS )
{
/* see SEC1 3.2 */
if( mpi_cmp_int( d, 1 ) < 0 ||
mpi_cmp_mpi( d, &grp->N ) >= 0 )
return( POLARSSL_ERR_ECP_INVALID_KEY );
else
return( 0 );
}
#endif
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
}
/*
* Generate a keypair
*/ */
int ecp_gen_keypair( ecp_group *grp, mpi *d, ecp_point *Q, int ecp_gen_keypair( ecp_group *grp, mpi *d, ecp_point *Q,
int (*f_rng)(void *, unsigned char *, size_t), int (*f_rng)(void *, unsigned char *, size_t),
void *p_rng ) void *p_rng )
{ {
int count = 0;
size_t n_size = (grp->nbits + 7) / 8; size_t n_size = (grp->nbits + 7) / 8;
/* #if defined(POLARSSL_ECP_MONTGOMERY)
* Generate d such that 1 <= n < N if( ecp_get_type( grp ) == POLARSSL_ECP_TYPE_MONTGOMERY )
*/ {
/* [M225] page 5 */
size_t b;
mpi_fill_random( d, n_size, f_rng, p_rng );
/* Make sure the most significant bit is nbits */
b = mpi_msb( d ) - 1; /* mpi_msb is one-based */
if( b > grp->nbits )
mpi_shift_r( d, b - grp->nbits );
else
mpi_set_bit( d, grp->nbits, 1 );
/* Make sure the last three bits are unset */
mpi_set_bit( d, 0, 0 );
mpi_set_bit( d, 1, 0 );
mpi_set_bit( d, 2, 0 );
}
else
#endif
#if defined(POLARSSL_ECP_SHORT_WEIERSTRASS)
if( ecp_get_type( grp ) == POLARSSL_ECP_TYPE_SHORT_WEIERSTRASS )
{
/* SEC1 3.2.1: Generate d such that 1 <= n < N */
int count = 0;
do do
{ {
mpi_fill_random( d, n_size, f_rng, p_rng ); mpi_fill_random( d, n_size, f_rng, p_rng );
@ -1428,6 +1759,10 @@ int ecp_gen_keypair( ecp_group *grp, mpi *d, ecp_point *Q,
return( POLARSSL_ERR_ECP_RANDOM_FAILED ); return( POLARSSL_ERR_ECP_RANDOM_FAILED );
} }
while( mpi_cmp_int( d, 1 ) < 0 ); while( mpi_cmp_int( d, 1 ) < 0 );
}
else
#endif
return( POLARSSL_ERR_ECP_BAD_INPUT_DATA );
return( ecp_mul( grp, Q, d, &grp->G, f_rng, p_rng ) ); return( ecp_mul( grp, Q, d, &grp->G, f_rng, p_rng ) );
} }

99
library/ecp_curves.c
View file

@ -322,16 +322,29 @@ cleanup:
#if defined(POLARSSL_ECP_NIST_OPTIM) #if defined(POLARSSL_ECP_NIST_OPTIM)
/* Forward declarations */ /* Forward declarations */
#if defined(POLARSSL_ECP_DP_SECP192R1_ENABLED)
static int ecp_mod_p192( mpi * ); static int ecp_mod_p192( mpi * );
#endif
#if defined(POLARSSL_ECP_DP_SECP224R1_ENABLED)
static int ecp_mod_p224( mpi * ); static int ecp_mod_p224( mpi * );
#endif
#if defined(POLARSSL_ECP_DP_SECP256R1_ENABLED)
static int ecp_mod_p256( mpi * ); static int ecp_mod_p256( mpi * );
#endif
#if defined(POLARSSL_ECP_DP_SECP384R1_ENABLED)
static int ecp_mod_p384( mpi * ); static int ecp_mod_p384( mpi * );
#endif
#if defined(POLARSSL_ECP_DP_SECP521R1_ENABLED)
static int ecp_mod_p521( mpi * ); static int ecp_mod_p521( mpi * );
#endif
#if defined(POLARSSL_ECP_DP_M255_ENABLED)
static int ecp_mod_p255( mpi * );
#endif
#define NIST_MODP( P ) grp->modp = ecp_mod_ ## P; #define NIST_MODP( P ) grp->modp = ecp_mod_ ## P;
#else #else
#define NIST_MODP( P ) #define NIST_MODP( P )
#endif #endif /* POLARSSL_ECP_NIST_OPTIM */
#define LOAD_GROUP( G ) ecp_group_read_binary( grp, \ #define LOAD_GROUP( G ) ecp_group_read_binary( grp, \
G ## _p, sizeof( G ## _p ), \ G ## _p, sizeof( G ## _p ), \
@ -341,11 +354,45 @@ static int ecp_mod_p521( mpi * );
G ## _gy, sizeof( G ## _gy ), \ G ## _gy, sizeof( G ## _gy ), \
G ## _n, sizeof( G ## _n ) ) G ## _n, sizeof( G ## _n ) )
/*
* Specialized function for creating the Curve25519 group
*/
static int ecp_use_curve25519( ecp_group *grp )
{
int ret;
/* Actually ( A + 2 ) / 4 */
MPI_CHK( mpi_read_string( &grp->A, 16, "01DB42" ) );
/* P = 2^255 - 19 */
MPI_CHK( mpi_lset( &grp->P, 1 ) );
MPI_CHK( mpi_shift_l( &grp->P, 255 ) );
MPI_CHK( mpi_sub_int( &grp->P, &grp->P, 19 ) );
grp->pbits = mpi_msb( &grp->P );
/* Y intentionaly not set, since we use x/z coordinates.
* This is used as a marker to identify Montgomery curves! */
MPI_CHK( mpi_lset( &grp->G.X, 9 ) );
MPI_CHK( mpi_lset( &grp->G.Z, 1 ) );
mpi_free( &grp->G.Y );
/* Actually, the required msb for private keys */
grp->nbits = 254;
cleanup:
if( ret != 0 )
ecp_group_free( grp );
return( ret );
}
/* /*
* Set a group using well-known domain parameters * Set a group using well-known domain parameters
*/ */
int ecp_use_known_dp( ecp_group *grp, ecp_group_id id ) int ecp_use_known_dp( ecp_group *grp, ecp_group_id id )
{ {
ecp_group_free( grp );
grp->id = id; grp->id = id;
switch( id ) switch( id )
@ -395,6 +442,12 @@ int ecp_use_known_dp( ecp_group *grp, ecp_group_id id )
return( LOAD_GROUP( brainpoolP512r1 ) ); return( LOAD_GROUP( brainpoolP512r1 ) );
#endif /* POLARSSL_ECP_DP_BP512R1_ENABLED */ #endif /* POLARSSL_ECP_DP_BP512R1_ENABLED */
#if defined(POLARSSL_ECP_DP_M255_ENABLED)
case POLARSSL_ECP_DP_M255:
grp->modp = ecp_mod_p255;
return( ecp_use_curve25519( grp ) );
#endif /* POLARSSL_ECP_DP_M255_ENABLED */
default: default:
ecp_group_free( grp ); ecp_group_free( grp );
return( POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE ); return( POLARSSL_ERR_ECP_FEATURE_UNAVAILABLE );
@ -804,4 +857,48 @@ cleanup:
#endif /* POLARSSL_ECP_NIST_OPTIM */ #endif /* POLARSSL_ECP_NIST_OPTIM */
#if defined(POLARSSL_ECP_DP_M255_ENABLED)
/* Size of p255 in terms of t_uint */
#define P255_WIDTH ( 255 / 8 / sizeof( t_uint ) + 1 )
/*
* Fast quasi-reduction modulo p255 = 2^255 - 19
* Write N as A1 + 2^255 A1, return A0 + 19 * A1
*/
static int ecp_mod_p255( mpi *N )
{
int ret;
size_t i;
mpi M;
t_uint Mp[P255_WIDTH + 2];
if( N->n < P255_WIDTH )
return( 0 );
/* M = A1 */
M.s = 1;
M.n = N->n - ( P255_WIDTH - 1 );
if( M.n > P255_WIDTH + 1 )
M.n = P255_WIDTH + 1;
M.p = Mp;
memset( Mp, 0, sizeof Mp );
memcpy( Mp, N->p + P255_WIDTH - 1, M.n * sizeof( t_uint ) );
MPI_CHK( mpi_shift_r( &M, 255 % ( 8 * sizeof( t_uint ) ) ) );
M.n++; /* Make room for multiplication by 19 */
/* N = A0 */
mpi_set_bit( N, 255, 0 );
for( i = P255_WIDTH; i < N->n; i++ )
N->p[i] = 0;
/* N = A0 + 19 * A1 */
MPI_CHK( mpi_mul_int( &M, &M, 19 ) );
MPI_CHK( mpi_add_abs( N, N, &M ) );
cleanup:
return( ret );
}
#endif /* POLARSSL_ECP_DP_M255_ENABLED */
#endif #endif

58
tests/suites/test_suite_ecp.data
View file

@ -159,6 +159,12 @@ ecp_small_check_pub:0:2:1:0
ECP small check pubkey #10 ECP small check pubkey #10
ecp_small_check_pub:10:25:1:POLARSSL_ERR_ECP_INVALID_KEY ecp_small_check_pub:10:25:1:POLARSSL_ERR_ECP_INVALID_KEY
ECP check pubkey Montgomery #1 (too big)
ecp_check_pub_mx:POLARSSL_ECP_DP_M255:"010000000000000000000000000000000000000000000000000000000000000000":POLARSSL_ERR_ECP_INVALID_KEY
ECP check pubkey Montgomery #2 (biggest)
ecp_check_pub_mx:POLARSSL_ECP_DP_M255:"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF":0
ECP write binary #0 (zero, bad format) ECP write binary #0 (zero, bad format)
depends_on:POLARSSL_ECP_DP_SECP192R1_ENABLED depends_on:POLARSSL_ECP_DP_SECP192R1_ENABLED
ecp_write_binary:POLARSSL_ECP_DP_SECP192R1:"01":"01":"00":POLARSSL_ECP_PF_UNKNOWN:"00":1:POLARSSL_ERR_ECP_BAD_INPUT_DATA ecp_write_binary:POLARSSL_ECP_DP_SECP192R1:"01":"01":"00":POLARSSL_ECP_PF_UNKNOWN:"00":1:POLARSSL_ERR_ECP_BAD_INPUT_DATA
@ -271,14 +277,58 @@ ECP tls write-read group #2
depends_on:POLARSSL_ECP_DP_SECP521R1_ENABLED depends_on:POLARSSL_ECP_DP_SECP521R1_ENABLED
ecp_tls_write_read_group:POLARSSL_ECP_DP_SECP521R1 ecp_tls_write_read_group:POLARSSL_ECP_DP_SECP521R1
ECP check privkey ECP check privkey #1 (short weierstrass, too small)
depends_on:POLARSSL_ECP_DP_SECP192R1_ENABLED depends_on:POLARSSL_ECP_DP_SECP192R1_ENABLED
ecp_check_privkey:POLARSSL_ECP_DP_SECP192R1 ecp_check_privkey:POLARSSL_ECP_DP_SECP192R1:"00":POLARSSL_ERR_ECP_INVALID_KEY
ECP check privkey #2 (short weierstrass, smallest)
depends_on:POLARSSL_ECP_DP_SECP192R1_ENABLED
ecp_check_privkey:POLARSSL_ECP_DP_SECP192R1:"01":0
ECP check privkey #3 (short weierstrass, biggest)
depends_on:POLARSSL_ECP_DP_SECP192R1_ENABLED
ecp_check_privkey:POLARSSL_ECP_DP_SECP192R1:"FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22830":0
ECP check privkey #4 (short weierstrass, too big)
depends_on:POLARSSL_ECP_DP_SECP192R1_ENABLED
ecp_check_privkey:POLARSSL_ECP_DP_SECP192R1:"FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831":POLARSSL_ERR_ECP_INVALID_KEY
ECP check privkey #5 (montgomery, too big)
depends_on:POLARSSL_ECP_DP_M255_ENABLED
ecp_check_privkey:POLARSSL_ECP_DP_M255:"C000000000000000000000000000000000000000000000000000000000000000":POLARSSL_ERR_ECP_INVALID_KEY
ECP check privkey #6 (montgomery, not big enough)
depends_on:POLARSSL_ECP_DP_M255_ENABLED
ecp_check_privkey:POLARSSL_ECP_DP_M255:"3FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0":POLARSSL_ERR_ECP_INVALID_KEY
ECP check privkey #7 (montgomery, msb OK)
depends_on:POLARSSL_ECP_DP_M255_ENABLED
ecp_check_privkey:POLARSSL_ECP_DP_M255:"4000000000000000000000000000000000000000000000000000000000000000":0
ECP check privkey #8 (montgomery, bit 0 set)
depends_on:POLARSSL_ECP_DP_M255_ENABLED
ecp_check_privkey:POLARSSL_ECP_DP_M255:"4000000000000000000000000000000000000000000000000000000000000001":POLARSSL_ERR_ECP_INVALID_KEY
ECP check privkey #9 (montgomery, bit 1 set)
depends_on:POLARSSL_ECP_DP_M255_ENABLED
ecp_check_privkey:POLARSSL_ECP_DP_M255:"4000000000000000000000000000000000000000000000000000000000000002":POLARSSL_ERR_ECP_INVALID_KEY
ECP check privkey #10 (montgomery, bit 2 set)
depends_on:POLARSSL_ECP_DP_M255_ENABLED
ecp_check_privkey:POLARSSL_ECP_DP_M255:"4000000000000000000000000000000000000000000000000000000000000004":POLARSSL_ERR_ECP_INVALID_KEY
ECP check privkey #11 (montgomery, OK)
depends_on:POLARSSL_ECP_DP_M255_ENABLED
ecp_check_privkey:POLARSSL_ECP_DP_M255:"7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8":0
ECP gen keypair ECP gen keypair
depends_on:POLARSSL_ECP_DP_SECP192R1_ENABLED depends_on:POLARSSL_ECP_DP_SECP192R1_ENABLED
ecp_gen_keypair:POLARSSL_ECP_DP_SECP192R1 ecp_gen_keypair:POLARSSL_ECP_DP_SECP192R1
ECP gen keypair
depends_on:POLARSSL_ECP_DP_M255_ENABLED
ecp_gen_keypair:POLARSSL_ECP_DP_M255
ECP gen keypair wrapper ECP gen keypair wrapper
depends_on:POLARSSL_ECP_DP_SECP192R1_ENABLED depends_on:POLARSSL_ECP_DP_SECP192R1_ENABLED
ecp_gen_key:POLARSSL_ECP_DP_SECP192R1 ecp_gen_key:POLARSSL_ECP_DP_SECP192R1
@ -367,5 +417,9 @@ ECP test vectors brainpoolP512r1 rfc 7027
depends_on:POLARSSL_ECP_DP_BP512R1_ENABLED depends_on:POLARSSL_ECP_DP_BP512R1_ENABLED
ecp_test_vect:POLARSSL_ECP_DP_BP512R1:"16302FF0DBBB5A8D733DAB7141C1B45ACBC8715939677F6A56850A38BD87BD59B09E80279609FF333EB9D4C061231FB26F92EEB04982A5F1D1764CAD57665422":"0A420517E406AAC0ACDCE90FCD71487718D3B953EFD7FBEC5F7F27E28C6149999397E91E029E06457DB2D3E640668B392C2A7E737A7F0BF04436D11640FD09FD":"72E6882E8DB28AAD36237CD25D580DB23783961C8DC52DFA2EC138AD472A0FCEF3887CF62B623B2A87DE5C588301EA3E5FC269B373B60724F5E82A6AD147FDE7":"230E18E1BCC88A362FA54E4EA3902009292F7F8033624FD471B5D8ACE49D12CFABBC19963DAB8E2F1EBA00BFFB29E4D72D13F2224562F405CB80503666B25429":"9D45F66DE5D67E2E6DB6E93A59CE0BB48106097FF78A081DE781CDB31FCE8CCBAAEA8DD4320C4119F1E9CD437A2EAB3731FA9668AB268D871DEDA55A5473199F":"2FDC313095BCDD5FB3A91636F07A959C8E86B5636A1E930E8396049CB481961D365CC11453A06C719835475B12CB52FC3C383BCE35E27EF194512B71876285FA":"A7927098655F1F9976FA50A9D566865DC530331846381C87256BAF3226244B76D36403C024D7BBF0AA0803EAFF405D3D24F11A9B5C0BEF679FE1454B21C4CD1F":"7DB71C3DEF63212841C463E881BDCF055523BD368240E6C3143BD8DEF8B3B3223B95E0F53082FF5E412F4222537A43DF1C6D25729DDB51620A832BE6A26680A2" ecp_test_vect:POLARSSL_ECP_DP_BP512R1:"16302FF0DBBB5A8D733DAB7141C1B45ACBC8715939677F6A56850A38BD87BD59B09E80279609FF333EB9D4C061231FB26F92EEB04982A5F1D1764CAD57665422":"0A420517E406AAC0ACDCE90FCD71487718D3B953EFD7FBEC5F7F27E28C6149999397E91E029E06457DB2D3E640668B392C2A7E737A7F0BF04436D11640FD09FD":"72E6882E8DB28AAD36237CD25D580DB23783961C8DC52DFA2EC138AD472A0FCEF3887CF62B623B2A87DE5C588301EA3E5FC269B373B60724F5E82A6AD147FDE7":"230E18E1BCC88A362FA54E4EA3902009292F7F8033624FD471B5D8ACE49D12CFABBC19963DAB8E2F1EBA00BFFB29E4D72D13F2224562F405CB80503666B25429":"9D45F66DE5D67E2E6DB6E93A59CE0BB48106097FF78A081DE781CDB31FCE8CCBAAEA8DD4320C4119F1E9CD437A2EAB3731FA9668AB268D871DEDA55A5473199F":"2FDC313095BCDD5FB3A91636F07A959C8E86B5636A1E930E8396049CB481961D365CC11453A06C719835475B12CB52FC3C383BCE35E27EF194512B71876285FA":"A7927098655F1F9976FA50A9D566865DC530331846381C87256BAF3226244B76D36403C024D7BBF0AA0803EAFF405D3D24F11A9B5C0BEF679FE1454B21C4CD1F":"7DB71C3DEF63212841C463E881BDCF055523BD368240E6C3143BD8DEF8B3B3223B95E0F53082FF5E412F4222537A43DF1C6D25729DDB51620A832BE6A26680A2"
ECP test vectors M255 aka Curve25519
depends_on:POLARSSL_ECP_DP_M255_ENABLED
ecp_test_vec_x:POLARSSL_ECP_DP_M255:"5AC99F33632E5A768DE7E81BF854C27C46E3FBF2ABBACD29EC4AFF517369C660":"057E23EA9F1CBE8A27168F6E696A791DE61DD3AF7ACD4EEACC6E7BA514FDA863":"47DC3D214174820E1154B49BC6CDB2ABD45EE95817055D255AA35831B70D3260":"6EB89DA91989AE37C7EAC7618D9E5C4951DBA1D73C285AE1CD26A855020EEF04":"61450CD98E36016B58776A897A9F0AEF738B99F09468B8D6B8511184D53494AB"
ECP selftest ECP selftest
ecp_selftest: ecp_selftest:

80
tests/suites/test_suite_ecp.function
View file

@ -188,6 +188,27 @@ void ecp_small_check_pub( int x, int y, int z, int ret )
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE */
void ecp_check_pub_mx( int grp_id, char *key_hex, int ret )
{
ecp_group grp;
ecp_point P;
ecp_group_init( &grp );
ecp_point_init( &P );
TEST_ASSERT( ecp_use_known_dp( &grp, grp_id ) == 0 );
TEST_ASSERT( mpi_read_string( &P.X, 16, key_hex ) == 0 );
TEST_ASSERT( mpi_lset( &P.Z, 1 ) == 0 );
TEST_ASSERT( ecp_check_pubkey( &grp, &P ) == ret );
ecp_group_free( &grp );
ecp_point_free( &P );
}
/* END_CASE */
/* BEGIN_CASE */ /* BEGIN_CASE */
void ecp_test_vect( int id, char *dA_str, char *xA_str, char *yA_str, void ecp_test_vect( int id, char *dA_str, char *xA_str, char *yA_str,
char *dB_str, char *xB_str, char *yB_str, char *xZ_str, char *dB_str, char *xB_str, char *yB_str, char *xZ_str,
@ -242,6 +263,56 @@ void ecp_test_vect( int id, char *dA_str, char *xA_str, char *yA_str,
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE */
void ecp_test_vec_x( int id, char *dA_hex, char *xA_hex,
char *dB_hex, char *xB_hex, char *xS_hex )
{
ecp_group grp;
ecp_point R;
mpi dA, xA, dB, xB, xS;
rnd_pseudo_info rnd_info;
ecp_group_init( &grp ); ecp_point_init( &R );
mpi_init( &dA ); mpi_init( &xA );
mpi_init( &dB ); mpi_init( &xB );
mpi_init( &xS );
memset( &rnd_info, 0x00, sizeof( rnd_pseudo_info ) );
TEST_ASSERT( ecp_use_known_dp( &grp, id ) == 0 );
TEST_ASSERT( ecp_check_pubkey( &grp, &grp.G ) == 0 );
TEST_ASSERT( mpi_read_string( &dA, 16, dA_hex ) == 0 );
TEST_ASSERT( mpi_read_string( &dB, 16, dB_hex ) == 0 );
TEST_ASSERT( mpi_read_string( &xA, 16, xA_hex ) == 0 );
TEST_ASSERT( mpi_read_string( &xB, 16, xB_hex ) == 0 );
TEST_ASSERT( mpi_read_string( &xS, 16, xS_hex ) == 0 );
TEST_ASSERT( ecp_mul( &grp, &R, &dA, &grp.G,
&rnd_pseudo_rand, &rnd_info ) == 0 );
TEST_ASSERT( ecp_check_pubkey( &grp, &R ) == 0 );
TEST_ASSERT( mpi_cmp_mpi( &R.X, &xA ) == 0 );
TEST_ASSERT( ecp_mul( &grp, &R, &dB, &R,
&rnd_pseudo_rand, &rnd_info ) == 0 );
TEST_ASSERT( ecp_check_pubkey( &grp, &R ) == 0 );
TEST_ASSERT( mpi_cmp_mpi( &R.X, &xS ) == 0 );
TEST_ASSERT( ecp_mul( &grp, &R, &dB, &grp.G, NULL, NULL ) == 0 );
TEST_ASSERT( ecp_check_pubkey( &grp, &R ) == 0 );
TEST_ASSERT( mpi_cmp_mpi( &R.X, &xB ) == 0 );
TEST_ASSERT( ecp_mul( &grp, &R, &dA, &R, NULL, NULL ) == 0 );
TEST_ASSERT( ecp_check_pubkey( &grp, &R ) == 0 );
TEST_ASSERT( mpi_cmp_mpi( &R.X, &xS ) == 0 );
ecp_group_free( &grp ); ecp_point_free( &R );
mpi_free( &dA ); mpi_free( &xA );
mpi_free( &dB ); mpi_free( &xB );
mpi_free( &xS );
}
/* END_CASE */
/* BEGIN_CASE */ /* BEGIN_CASE */
void ecp_fast_mod( int id, char *N_str ) void ecp_fast_mod( int id, char *N_str )
{ {
@ -490,7 +561,7 @@ void ecp_tls_write_read_group( int id )
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE */ /* BEGIN_CASE */
void ecp_check_privkey( int id ) void ecp_check_privkey( int id, char *key_hex, int ret )
{ {
ecp_group grp; ecp_group grp;
mpi d; mpi d;
@ -499,12 +570,9 @@ void ecp_check_privkey( int id )
mpi_init( &d ); mpi_init( &d );
TEST_ASSERT( ecp_use_known_dp( &grp, id ) == 0 ); TEST_ASSERT( ecp_use_known_dp( &grp, id ) == 0 );
TEST_ASSERT( mpi_read_string( &d, 16, key_hex ) == 0 );
TEST_ASSERT( mpi_lset( &d, 0 ) == 0 ); TEST_ASSERT( ecp_check_privkey( &grp, &d ) == ret );
TEST_ASSERT( ecp_check_privkey( &grp, &d ) == POLARSSL_ERR_ECP_INVALID_KEY );
TEST_ASSERT( mpi_copy( &d, &grp.N ) == 0 );
TEST_ASSERT( ecp_check_privkey( &grp, &d ) == POLARSSL_ERR_ECP_INVALID_KEY );
ecp_group_free( &grp ); ecp_group_free( &grp );
mpi_free( &d ); mpi_free( &d );

24
tests/suites/test_suite_mpi.data
View file

@ -223,6 +223,24 @@ mpi_safe_cond_assign:-1:"01":+1:"02"
Test mpi_safe_cond_assign #6 Test mpi_safe_cond_assign #6
mpi_safe_cond_assign:-1:"01":-1:"02" mpi_safe_cond_assign:-1:"01":-1:"02"
Test mpi_safe_cond_swap #1
mpi_safe_cond_swap:+1:"01":+1:"02"
Test mpi_safe_cond_swap #2
mpi_safe_cond_swap:+1:"FF000000000000000001":+1:"02"
Test mpi_safe_cond_swap #3
mpi_safe_cond_swap:+1:"01":+1:"FF000000000000000002"
Test mpi_safe_cond_swap #4
mpi_safe_cond_swap:+1:"01":-1:"02"
Test mpi_safe_cond_swap #5
mpi_safe_cond_swap:-1:"01":+1:"02"
Test mpi_safe_cond_swap #6
mpi_safe_cond_swap:-1:"01":-1:"02"
Base test mpi_add_abs #1 Base test mpi_add_abs #1
mpi_add_abs:10:"12345678":10:"642531":10:"12988209" mpi_add_abs:10:"12345678":10:"642531":10:"12988209"
@ -665,6 +683,12 @@ mpi_set_bit:10:"49979687":80:0:10:"49979687"
Test bit set (Add above existing limbs with a 1) Test bit set (Add above existing limbs with a 1)
mpi_set_bit:10:"49979687":80:1:10:"1208925819614629224685863" mpi_set_bit:10:"49979687":80:1:10:"1208925819614629224685863"
Test bit set (Bit index larger than 31 with a 0)
mpi_set_bit:16:"FFFFFFFFFFFFFFFF":32:0:16:"FFFFFFFEFFFFFFFF"
Test bit set (Bit index larger than 31 with a 1)
mpi_set_bit:16:"00":32:1:16:"0100000000"
MPI Selftest MPI Selftest
depends_on:POLARSSL_SELF_TEST depends_on:POLARSSL_SELF_TEST
mpi_selftest: mpi_selftest:

30
tests/suites/test_suite_mpi.function
View file

@ -331,6 +331,36 @@ void mpi_safe_cond_assign( int x_sign, char *x_str,
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE */
void mpi_safe_cond_swap( int x_sign, char *x_str,
int y_sign, char *y_str )
{
mpi X, Y, XX, YY;
mpi_init( &X ); mpi_init( &Y );
mpi_init( &XX ); mpi_init( &YY );
TEST_ASSERT( mpi_read_string( &X, 16, x_str ) == 0 );
X.s = x_sign;
TEST_ASSERT( mpi_read_string( &Y, 16, y_str ) == 0 );
Y.s = y_sign;
TEST_ASSERT( mpi_copy( &XX, &X ) == 0 );
TEST_ASSERT( mpi_copy( &YY, &Y ) == 0 );
TEST_ASSERT( mpi_safe_cond_swap( &X, &Y, 0 ) == 0 );
TEST_ASSERT( mpi_cmp_mpi( &X, &XX ) == 0 );
TEST_ASSERT( mpi_cmp_mpi( &Y, &YY ) == 0 );
TEST_ASSERT( mpi_safe_cond_swap( &X, &Y, 1 ) == 0 );
TEST_ASSERT( mpi_cmp_mpi( &Y, &XX ) == 0 );
TEST_ASSERT( mpi_cmp_mpi( &X, &YY ) == 0 );
mpi_free( &X ); mpi_free( &Y );
mpi_free( &XX ); mpi_free( &YY );
}
/* END_CASE */
/* BEGIN_CASE */ /* BEGIN_CASE */
void mpi_swap( int input_X, int input_Y ) void mpi_swap( int input_X, int input_Y )
{ {