From 96584ddd4bf9cb821b5037b534cdf009675aa762 Mon Sep 17 00:00:00 2001 From: gabor-mezei-arm Date: Mon, 27 Sep 2021 12:15:19 +0200 Subject: [PATCH] Move mbedtls_cf_size_bool_eq function to the constant-time module There were multiple functions called mbedtls_cf_size_bool_eq. They had exactly the same behavior, so move the one in bignum.c and remove the other. Signed-off-by: Gabor Mezei --- library/bignum.c | 37 +------------------------------------ library/constant_time.c | 36 ++++++++++++++++++++++++++++++++++++ library/constant_time.h | 2 ++ library/ssl_msg.c | 35 ----------------------------------- 4 files changed, 39 insertions(+), 71 deletions(-) diff --git a/library/bignum.c b/library/bignum.c index d15bc1a96..bc2dbfa16 100644 --- a/library/bignum.c +++ b/library/bignum.c @@ -41,6 +41,7 @@ #include "mbedtls/bn_mul.h" #include "mbedtls/platform_util.h" #include "mbedtls/error.h" +#include "constant_time.h" #include @@ -2227,42 +2228,6 @@ static void mpi_montred( mbedtls_mpi *A, const mbedtls_mpi *N, mpi_montmul( A, &U, N, mm, T ); } -/* - * Constant-flow boolean "equal" comparison: - * return x == y - * - * This function can be used to write constant-time code by replacing branches - * with bit operations - it can be used in conjunction with - * mbedtls_ssl_cf_mask_from_bit(). - * - * This function is implemented without using comparison operators, as those - * might be translated to branches by some compilers on some platforms. - */ -static size_t mbedtls_cf_size_bool_eq( size_t x, size_t y ) -{ - /* diff = 0 if x == y, non-zero otherwise */ - const size_t diff = x ^ y; - - /* MSVC has a warning about unary minus on unsigned integer types, - * but this is well-defined and precisely what we want to do here. */ -#if defined(_MSC_VER) -#pragma warning( push ) -#pragma warning( disable : 4146 ) -#endif - - /* diff_msb's most significant bit is equal to x != y */ - const size_t diff_msb = ( diff | (size_t) -diff ); - -#if defined(_MSC_VER) -#pragma warning( pop ) -#endif - - /* diff1 = (x != y) ? 1 : 0 */ - const size_t diff1 = diff_msb >> ( sizeof( diff_msb ) * 8 - 1 ); - - return( 1 ^ diff1 ); -} - /** * Select an MPI from a table without leaking the index. * diff --git a/library/constant_time.c b/library/constant_time.c index b53d06ba6..d73f4fe44 100644 --- a/library/constant_time.c +++ b/library/constant_time.c @@ -177,3 +177,39 @@ size_t mbedtls_cf_size_mask_ge( size_t x, size_t y ) { return( ~mbedtls_cf_size_mask_lt( x, y ) ); } + +/* + * Constant-flow boolean "equal" comparison: + * return x == y + * + * This function can be used to write constant-time code by replacing branches + * with bit operations - it can be used in conjunction with + * mbedtls_ssl_cf_mask_from_bit(). + * + * This function is implemented without using comparison operators, as those + * might be translated to branches by some compilers on some platforms. + */ +size_t mbedtls_cf_size_bool_eq( size_t x, size_t y ) +{ + /* diff = 0 if x == y, non-zero otherwise */ + const size_t diff = x ^ y; + + /* MSVC has a warning about unary minus on unsigned integer types, + * but this is well-defined and precisely what we want to do here. */ +#if defined(_MSC_VER) +#pragma warning( push ) +#pragma warning( disable : 4146 ) +#endif + + /* diff_msb's most significant bit is equal to x != y */ + const size_t diff_msb = ( diff | (size_t) -diff ); + +#if defined(_MSC_VER) +#pragma warning( pop ) +#endif + + /* diff1 = (x != y) ? 1 : 0 */ + const size_t diff1 = diff_msb >> ( sizeof( diff_msb ) * 8 - 1 ); + + return( 1 ^ diff1 ); +} diff --git a/library/constant_time.h b/library/constant_time.h index 8e8992d6f..50108d7d9 100644 --- a/library/constant_time.h +++ b/library/constant_time.h @@ -37,3 +37,5 @@ size_t mbedtls_cf_size_mask( size_t bit ); size_t mbedtls_cf_size_mask_lt( size_t x, size_t y ); size_t mbedtls_cf_size_mask_ge( size_t x, size_t y ); + +size_t mbedtls_cf_size_bool_eq( size_t x, size_t y ); diff --git a/library/ssl_msg.c b/library/ssl_msg.c index 1ea7c5fc0..020abf637 100644 --- a/library/ssl_msg.c +++ b/library/ssl_msg.c @@ -1045,41 +1045,6 @@ int mbedtls_ssl_encrypt_buf( mbedtls_ssl_context *ssl, } #if defined(MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC) -/* - * Constant-flow boolean "equal" comparison: - * return x == y - * - * This function can be used to write constant-time code by replacing branches - * with bit operations - it can be used in conjunction with - * mbedtls_cf_size_mask(). - * - * This function is implemented without using comparison operators, as those - * might be translated to branches by some compilers on some platforms. - */ -static size_t mbedtls_cf_size_bool_eq( size_t x, size_t y ) -{ - /* diff = 0 if x == y, non-zero otherwise */ - const size_t diff = x ^ y; - - /* MSVC has a warning about unary minus on unsigned integer types, - * but this is well-defined and precisely what we want to do here. */ -#if defined(_MSC_VER) -#pragma warning( push ) -#pragma warning( disable : 4146 ) -#endif - - /* diff_msb's most significant bit is equal to x != y */ - const size_t diff_msb = ( diff | -diff ); - -#if defined(_MSC_VER) -#pragma warning( pop ) -#endif - - /* diff1 = (x != y) ? 1 : 0 */ - const size_t diff1 = diff_msb >> ( sizeof( diff_msb ) * 8 - 1 ); - - return( 1 ^ diff1 ); -} /* * Constant-flow conditional memcpy: