mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2024-12-23 14:55:33 +00:00
Make memory access pattern constant
This commit is contained in:
parent
aade42fd88
commit
d728350cee
|
@ -246,7 +246,8 @@ void mpi_swap( mpi *X, mpi *Y );
|
||||||
* if( assign ) mpi_copy( X, Y );
|
* if( assign ) mpi_copy( X, Y );
|
||||||
* except that it avoids leaking any information about whether
|
* except that it avoids leaking any information about whether
|
||||||
* the assignment was done or not (the above code may leak
|
* the assignment was done or not (the above code may leak
|
||||||
* information through branch prediction analysis).
|
* information through branch prediction and/or memory access
|
||||||
|
* patterns analysis).
|
||||||
*/
|
*/
|
||||||
int mpi_safe_cond_assign( mpi *X, mpi *Y, unsigned char assign );
|
int mpi_safe_cond_assign( mpi *X, mpi *Y, unsigned char assign );
|
||||||
|
|
||||||
|
|
|
@ -463,15 +463,15 @@ int ecp_sub( const ecp_group *grp, ecp_point *R,
|
||||||
* or P is not a valid pubkey,
|
* or P is not a valid pubkey,
|
||||||
* POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
|
* POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
|
||||||
*
|
*
|
||||||
* \note In order to prevent simple timing attacks, this function
|
* \note In order to prevent timing attacks, this function
|
||||||
* executes a constant number of operations (that is, point
|
* executes the exact same sequence of (base field)
|
||||||
* doubling and addition of distinct points) for random m in
|
* operations for any valid m. It avoids any if-branch or
|
||||||
* the allowed range.
|
* array index depending on the value of m.
|
||||||
*
|
*
|
||||||
* \note If f_rng is not NULL, it is used to randomize intermediate
|
* \note If f_rng is not NULL, it is used to randomize intermediate
|
||||||
* results in order to prevent potential attacks targetting
|
* results in order to prevent potential timing attacks
|
||||||
* these results. It is recommended to always provide a
|
* targetting these results. It is recommended to always
|
||||||
* non-NULL f_rng (the overhead is negligible).
|
* provide a non-NULL f_rng (the overhead is negligible).
|
||||||
*/
|
*/
|
||||||
int ecp_mul( ecp_group *grp, ecp_point *R,
|
int ecp_mul( ecp_group *grp, ecp_point *R,
|
||||||
const mpi *m, const ecp_point *P,
|
const mpi *m, const ecp_point *P,
|
||||||
|
|
|
@ -1385,14 +1385,23 @@ cleanup:
|
||||||
* Select precomputed point: R = sign(i) * T[ abs(i) / 2 ]
|
* Select precomputed point: R = sign(i) * T[ abs(i) / 2 ]
|
||||||
*/
|
*/
|
||||||
static int ecp_select_comb( const ecp_group *grp, ecp_point *R,
|
static int ecp_select_comb( const ecp_group *grp, ecp_point *R,
|
||||||
const ecp_point T[], unsigned char i )
|
ecp_point T[], unsigned char t_len,
|
||||||
|
unsigned char i )
|
||||||
{
|
{
|
||||||
int ret;
|
int ret;
|
||||||
|
unsigned char ii, j;
|
||||||
|
|
||||||
/* Ignore the "sign" bit */
|
/* Ignore the "sign" bit and scale down */
|
||||||
MPI_CHK( ecp_copy( R, &T[ ( i & 0x7Fu ) >> 1 ] ) );
|
ii = ( i & 0x7Fu ) >> 1;
|
||||||
|
|
||||||
/* Restore the Z coordinate */
|
/* Read the whole table to thwart cache-based timing attacks */
|
||||||
|
for( j = 0; j < t_len; j++ )
|
||||||
|
{
|
||||||
|
MPI_CHK( mpi_safe_cond_assign( &R->X, &T[j].X, j == ii ) );
|
||||||
|
MPI_CHK( mpi_safe_cond_assign( &R->Y, &T[j].Y, j == ii ) );
|
||||||
|
}
|
||||||
|
|
||||||
|
/* The Z coordinate is always 1 */
|
||||||
MPI_CHK( mpi_lset( &R->Z, 1 ) );
|
MPI_CHK( mpi_lset( &R->Z, 1 ) );
|
||||||
|
|
||||||
/* Safely invert result if i is "negative" */
|
/* Safely invert result if i is "negative" */
|
||||||
|
@ -1409,7 +1418,7 @@ cleanup:
|
||||||
* Cost: d A + d D + 1 R
|
* Cost: d A + d D + 1 R
|
||||||
*/
|
*/
|
||||||
static int ecp_mul_comb_core( const ecp_group *grp, ecp_point *R,
|
static int ecp_mul_comb_core( const ecp_group *grp, ecp_point *R,
|
||||||
const ecp_point T[],
|
ecp_point T[], unsigned char t_len,
|
||||||
const unsigned char x[], size_t d,
|
const unsigned char x[], size_t d,
|
||||||
int (*f_rng)(void *, unsigned char *, size_t),
|
int (*f_rng)(void *, unsigned char *, size_t),
|
||||||
void *p_rng )
|
void *p_rng )
|
||||||
|
@ -1422,14 +1431,14 @@ static int ecp_mul_comb_core( const ecp_group *grp, ecp_point *R,
|
||||||
|
|
||||||
/* Start with a non-zero point and randomize its coordinates */
|
/* Start with a non-zero point and randomize its coordinates */
|
||||||
i = d;
|
i = d;
|
||||||
MPI_CHK( ecp_select_comb( grp, R, T, x[i] ) );
|
MPI_CHK( ecp_select_comb( grp, R, T, t_len, x[i] ) );
|
||||||
if( f_rng != 0 )
|
if( f_rng != 0 )
|
||||||
MPI_CHK( ecp_randomize_coordinates( grp, R, f_rng, p_rng ) );
|
MPI_CHK( ecp_randomize_coordinates( grp, R, f_rng, p_rng ) );
|
||||||
|
|
||||||
while( i-- != 0 )
|
while( i-- != 0 )
|
||||||
{
|
{
|
||||||
MPI_CHK( ecp_double_jac( grp, R, R ) );
|
MPI_CHK( ecp_double_jac( grp, R, R ) );
|
||||||
MPI_CHK( ecp_select_comb( grp, &Txi, T, x[i] ) );
|
MPI_CHK( ecp_select_comb( grp, &Txi, T, t_len, x[i] ) );
|
||||||
MPI_CHK( ecp_add_mixed( grp, R, R, &Txi ) );
|
MPI_CHK( ecp_add_mixed( grp, R, R, &Txi ) );
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -1447,8 +1456,8 @@ int ecp_mul( ecp_group *grp, ecp_point *R,
|
||||||
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
|
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
|
||||||
{
|
{
|
||||||
int ret;
|
int ret;
|
||||||
unsigned char w, m_is_odd, p_eq_g;
|
unsigned char w, m_is_odd, p_eq_g, pre_len, i;
|
||||||
size_t pre_len, d, i;
|
size_t d;
|
||||||
unsigned char k[COMB_MAX_D + 1];
|
unsigned char k[COMB_MAX_D + 1];
|
||||||
ecp_point *T;
|
ecp_point *T;
|
||||||
mpi M, mm;
|
mpi M, mm;
|
||||||
|
@ -1542,7 +1551,7 @@ int ecp_mul( ecp_group *grp, ecp_point *R,
|
||||||
* Go for comb multiplication, R = M * P
|
* Go for comb multiplication, R = M * P
|
||||||
*/
|
*/
|
||||||
ecp_comb_fixed( k, d, w, &M );
|
ecp_comb_fixed( k, d, w, &M );
|
||||||
ecp_mul_comb_core( grp, R, T, k, d, f_rng, p_rng );
|
MPI_CHK( ecp_mul_comb_core( grp, R, T, pre_len, k, d, f_rng, p_rng ) );
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Now get m * P from M * P and normalize it
|
* Now get m * P from M * P and normalize it
|
||||||
|
|
Loading…
Reference in a new issue