wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-06 17:20:53 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2982 from SparkiDev/ecc_sc

Browse Source 
ECC now calls mp_submod_ct and mp_addmod_ct
This commit is contained in:
toddouska
2020-08-11 09:26:56 -07:00
committed by GitHub
parent 8b7f588aaf 6467de5a88
commit 4e6bc02257
15 changed files with 1148 additions and 364 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mcapi/crypto.c
+18
View File
@@ -702,14 +702,32 @@ int CRYPT_ECC_DHE_SharedSecretMake(CRYPT_ECC_CTX* priv, CRYPT_ECC_CTX* pub,
{
int ret;
unsigned int inOut = outSz;
#if defined(ECC_TIMING_RESISTANT)
WC_RNG rng;
#endif
if (priv == NULL || pub == NULL || out == NULL || usedSz == NULL)
return BAD_FUNC_ARG;
#if defined(ECC_TIMING_RESISTANT)
ret = wc_InitRng(&rng);
if (ret != 0)
return ret;
ret = wc_ecc_set_rng((ecc_key*)priv->holder, &rng);
if (ret != 0) {
wc_FreeRng(&rng);
return ret;
}
#endif
ret = wc_ecc_shared_secret((ecc_key*)priv->holder, (ecc_key*)pub->holder,
out, &inOut);
*usedSz = inOut;
#if defined(ECC_TIMING_RESISTANT)
wc_FreeRng(&rng);
#endif
return ret;
}
src/internal.c
+7 -1
View File
@@ -4243,7 +4243,13 @@ int EccSharedSecret(WOLFSSL* ssl, ecc_key* priv_key, ecc_key* pub_key,
else
#endif
{
ret = wc_ecc_shared_secret(priv_key, pub_key, out, outlen);
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
ret = wc_ecc_set_rng(priv_key, ssl->rng);
if (ret == 0)
#endif
ret = wc_ecc_shared_secret(priv_key, pub_key, out, outlen);
}
/* Handle async pending response */
src/tls.c
+9
View File
@@ -7509,6 +7509,15 @@ static int TLSX_KeyShare_ProcessEcc(WOLFSSL* ssl, KeyShareEntry* keyShareEntry)
}
ssl->ecdhCurveOID = ssl->peerEccKey->dp->oidSum;
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
ret = wc_ecc_set_rng(keyShareKey, ssl->rng);
if (ret != 0) {
return ret;
}
#endif
do {
#if defined(WOLFSSL_ASYNC_CRYPT)
ret = wc_AsyncWait(ret, &keyShareKey->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
tests/api.c
+39
View File
@@ -19056,6 +19056,14 @@ static int test_wc_ecc_shared_secret (void)
ret = wc_ecc_make_key(&rng, keySz, &pubKey);
}
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
if (ret == 0) {
ret = wc_ecc_set_rng(&key, &rng);
}
#endif
printf(testingFmt, "wc_ecc_shared_secret()");
if (ret == 0) {
ret = wc_ecc_shared_secret(&key, &pubKey, out, &outlen);
@@ -20021,6 +20029,17 @@ static int test_wc_ecc_encryptDecrypt (void)
}
}
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
if (ret == 0) {
ret = wc_ecc_set_rng(&srvKey, &rng);
}
if (ret == 0) {
ret = wc_ecc_set_rng(&cliKey, &rng);
}
#endif
printf(testingFmt, "wc_ecc_encrypt()");
if (ret == 0) {
@@ -20353,6 +20372,14 @@ static int test_wc_ecc_shared_secret_ssh (void)
printf(testingFmt, "ecc_shared_secret_ssh()");
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
if (ret == 0) {
ret = wc_ecc_set_rng(&key, &rng);
}
#endif
if (ret == 0) {
ret = wc_ecc_shared_secret_ssh(&key, &key2.pubkey, secret, &secretLen);
}
@@ -22203,6 +22230,7 @@ static void test_wc_PKCS7_EncodeDecodeEnvelopedData (void)
{
#if defined(HAVE_PKCS7)
PKCS7* pkcs7;
WC_RNG rng;
word32 tempWrd32 = 0;
byte* tmpBytePtr = NULL;
const char input[] = "Test data to encode.";
@@ -22370,6 +22398,10 @@ static void test_wc_PKCS7_EncodeDecodeEnvelopedData (void)
#endif /* END HAVE_ECC */
}; /* END pkcs7EnvelopedVector */
#ifdef ECC_TIMING_RESISTANT
AssertIntEQ(wc_InitRng(&rng), 0);
#endif
printf(testingFmt, "wc_PKCS7_EncodeEnvelopedData()");
AssertNotNull(pkcs7 = wc_PKCS7_New(HEAP_HINT, devId));
@@ -22379,6 +22411,9 @@ static void test_wc_PKCS7_EncodeDecodeEnvelopedData (void)
for (i = 0; i < testSz; i++) {
AssertIntEQ(wc_PKCS7_InitWithCert(pkcs7, (testVectors + i)->cert,
(word32)(testVectors + i)->certSz), 0);
#ifdef ECC_TIMING_RESISTANT
pkcs7->rng = &rng;
#endif
pkcs7->content = (byte*)(testVectors + i)->content;
pkcs7->contentSz = (testVectors + i)->contentSz;
@@ -22501,6 +22536,10 @@ static void test_wc_PKCS7_EncodeDecodeEnvelopedData (void)
}
#endif /* HAVE_ECC */
#ifdef ECC_TIMING_RESISTANT
wc_FreeRng(&rng);
#endif
#endif /* HAVE_PKCS7 */
} /* END test_wc_PKCS7_EncodeEnvelopedData() */
wolfcrypt/benchmark/benchmark.c
+7
View File
@@ -5311,6 +5311,13 @@ void bench_ecc(int doAsync)
}
#ifdef HAVE_ECC_DHE
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
for (i = 0; i < BENCH_MAX_PENDING; i++) {
(void)wc_ecc_set_rng(&genKey[i], &gRng);
}
#endif
/* ECC Shared Secret */
bench_stats_start(&count, &start);
wolfcrypt/src/ecc.c
+689 -341
View File
File diff suppressed because it is too large Load Diff
wolfcrypt/src/evp.c
+24
View File
@@ -1413,16 +1413,40 @@ int wolfSSL_EVP_PKEY_derive(WOLFSSL_EVP_PKEY_CTX *ctx, unsigned char *key, size_
}
if (key) {
word32 len32 = (word32)len;
#if defined(ECC_TIMING_RESISTANT) && !defined(HAVE_FIPS) && \
!defined(HAVE_SELFTEST)
WC_RNG rng;
if (wc_InitRng(&rng) != MP_OKAY) {
WOLFSSL_MSG("Init RNG failed");
return WOLFSSL_FAILURE;
}
((ecc_key*)ctx->pkey->ecc->internal)->rng = &rng;
#endif
if (*keylen < len32) {
WOLFSSL_MSG("buffer too short");
#if defined(ECC_TIMING_RESISTANT) && !defined(HAVE_FIPS) && \
!defined(HAVE_SELFTEST)
((ecc_key*)ctx->pkey->ecc->internal)->rng = NULL;
wc_FreeRng(&rng);
#endif
return WOLFSSL_FAILURE;
}
if (wc_ecc_shared_secret_ssh((ecc_key*)ctx->pkey->ecc->internal,
(ecc_point*)ctx->peerKey->ecc->pub_key->internal,
key, &len32) != MP_OKAY) {
WOLFSSL_MSG("wc_ecc_shared_secret failed");
#if defined(ECC_TIMING_RESISTANT) && !defined(HAVE_FIPS) && \
!defined(HAVE_SELFTEST)
((ecc_key*)ctx->pkey->ecc->internal)->rng = NULL;
wc_FreeRng(&rng);
#endif
return WOLFSSL_FAILURE;
}
#if defined(ECC_TIMING_RESISTANT) && !defined(HAVE_FIPS) && \
!defined(HAVE_SELFTEST)
((ecc_key*)ctx->pkey->ecc->internal)->rng = NULL;
wc_FreeRng(&rng);
#endif
len = (int)len32;
}
*keylen = (size_t)len;
wolfcrypt/src/integer.c
+44
View File
@@ -1577,6 +1577,24 @@ int mp_div_2(mp_int * a, mp_int * b)
return MP_OKAY;
}
/* c = a / 2 (mod b) - constant time (a < b and positive) */
int mp_div_2_mod_ct(mp_int *a, mp_int *b, mp_int *c)
{
int res;
if (mp_isodd(a)) {
res = mp_add(a, b, c);
if (res == MP_OKAY) {
res = mp_div_2(c, c);
}
}
else {
res = mp_div_2(a, c);
}
return res;
}
/* high level addition (handles signs) */
int mp_add (mp_int * a, mp_int * b, mp_int * c)
@@ -2994,6 +3012,32 @@ int mp_addmod(mp_int* a, mp_int* b, mp_int* c, mp_int* d)
return res;
}
/* d = a - b (mod c) - a < c and b < c and positive */
int mp_submod_ct(mp_int* a, mp_int* b, mp_int* c, mp_int* d)
{
int res;
res = mp_sub(a, b, d);
if (res == MP_OKAY && mp_isneg(d)) {
res = mp_add(d, c, d);
}
return res;
}
/* d = a + b (mod c) - a < c and b < c and positive */
int mp_addmod_ct(mp_int* a, mp_int* b, mp_int* c, mp_int* d)
{
int res;
res = mp_add(a, b, d);
if (res == MP_OKAY && mp_cmp(d, c) != MP_LT) {
res = mp_sub(d, c, d);
}
return res;
}
/* computes b = a*a */
int mp_sqr (mp_int * a, mp_int * b)
{
wolfcrypt/src/pkcs7.c
+17 -3
View File
@@ -5531,7 +5531,7 @@ static int wc_PKCS7_KariGenerateSharedInfo(WC_PKCS7_KARI* kari, int keyWrapOID)
/* create key encryption key (KEK) using key wrap algorithm and key encryption
* algorithm, place in kari->kek. return 0 on success, <0 on error. */
static int wc_PKCS7_KariGenerateKEK(WC_PKCS7_KARI* kari,
static int wc_PKCS7_KariGenerateKEK(WC_PKCS7_KARI* kari, WC_RNG* rng,
int keyWrapOID, int keyEncOID)
{
int ret;
@@ -5566,6 +5566,19 @@ static int wc_PKCS7_KariGenerateKEK(WC_PKCS7_KARI* kari,
if (secret == NULL)
return MEMORY_E;
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
ret = wc_ecc_set_rng(kari->senderKey, rng);
if (ret != 0)
return ret;
ret = wc_ecc_set_rng(kari->recipKey, rng);
if (ret != 0)
return ret;
#else
(void)rng;
#endif
if (kari->direction == WC_PKCS7_ENCODE) {
ret = wc_ecc_shared_secret(kari->senderKey, kari->recipKey,
@@ -5797,7 +5810,7 @@ int wc_PKCS7_AddRecipient_KARI(PKCS7* pkcs7, const byte* cert, word32 certSz,
}
/* generate KEK (key encryption key) */
ret = wc_PKCS7_KariGenerateKEK(kari, keyWrapOID, keyAgreeOID);
ret = wc_PKCS7_KariGenerateKEK(kari, pkcs7->rng, keyWrapOID, keyAgreeOID);
if (ret != 0) {
wc_PKCS7_KariFree(kari);
#ifdef WOLFSSL_SMALL_STACK
@@ -9397,7 +9410,8 @@ static int wc_PKCS7_DecryptKari(PKCS7* pkcs7, byte* in, word32 inSz,
}
else {
/* create KEK */
ret = wc_PKCS7_KariGenerateKEK(kari, keyWrapOID, pkcs7->keyAgreeOID);
ret = wc_PKCS7_KariGenerateKEK(kari, pkcs7->rng, keyWrapOID,
pkcs7->keyAgreeOID);
if (ret != 0) {
wc_PKCS7_KariFree(kari);
#ifdef WOLFSSL_SMALL_STACK
wolfcrypt/src/tfm.c
+164 -12
View File
@@ -103,6 +103,26 @@ word32 CheckRunTimeFastMath(void)
/* Functions */
static int fp_cmp_mag_ct(fp_int *a, fp_int *b, int len)
{
int i;
fp_digit r = FP_EQ;
fp_digit mask = (fp_digit)-1;
for (i = len - 1; i >= 0; i--) {
/* 0 is placed into unused digits. */
fp_digit ad = a->dp[i];
fp_digit bd = b->dp[i];
r |= mask & (ad > bd);
mask &= (ad > bd) - 1;
r |= mask & (-(ad < bd));
mask &= (ad < bd) - 1;
}
return (int)r;
}
int fp_add(fp_int *a, fp_int *b, fp_int *c)
{
int sa, sb;
@@ -639,7 +659,8 @@ int fp_div(fp_int *a, fp_int *b, fp_int *c, fp_int *d)
}
/* if a < b then q=0, r = a */
if (fp_cmp_mag (a, b) == FP_LT) {
if (fp_cmp_mag (a, b) == FP_LT)
{
if (d != NULL) {
fp_copy (a, d);
}
@@ -878,6 +899,31 @@ void fp_div_2(fp_int * a, fp_int * b)
fp_clamp (b);
}
/* c = a / 2 (mod b) - constant time (a < b and positive) */
int fp_div_2_mod_ct(fp_int *a, fp_int *b, fp_int *c)
{
fp_word w = 0;
fp_digit mask;
int i;
mask = 0 - (a->dp[0] & 1);
for (i = 0; i < b->used; i++) {
fp_digit mask_a = 0 - (i < a->used);
w += b->dp[i] & mask;
w += a->dp[i] & mask_a;
c->dp[i] = (fp_digit)w;
w >>= DIGIT_BIT;
}
c->dp[i] = (fp_digit)w;
c->used = i + 1;
c->sign = FP_ZPOS;
fp_clamp(c);
fp_div_2(c, c);
return FP_OKAY;
}
/* c = a / 2**b */
void fp_div_2d(fp_int *a, int b, fp_int *c, fp_int *d)
{
@@ -1546,6 +1592,54 @@ int fp_addmod(fp_int *a, fp_int *b, fp_int *c, fp_int *d)
return err;
}
/* d = a - b (mod c) - constant time (a < c and b < c and positive) */
int fp_submod_ct(fp_int *a, fp_int *b, fp_int *c, fp_int *d)
{
fp_word w = 0;
fp_digit mask;
int i;
mask = 0 - (fp_cmp_mag_ct(a, b, c->used + 1) == FP_LT);
for (i = 0; i < c->used + 1; i++) {
fp_digit mask_a = 0 - (i < a->used);
w += c->dp[i] & mask;
w += a->dp[i] & mask_a;
d->dp[i] = (fp_digit)w;
w >>= DIGIT_BIT;
}
d->dp[i] = (fp_digit)w;
d->used = i + 1;
d->sign = FP_ZPOS;
fp_clamp(d);
s_fp_sub(d, b, d);
return FP_OKAY;
}
/* d = a + b (mod c) - constant time (|a| < c and |b| < c and positive) */
int fp_addmod_ct(fp_int *a, fp_int *b, fp_int *c, fp_int *d)
{
fp_word w = 0;
fp_digit mask;
int i;
s_fp_add(a, b, d);
mask = 0 - (fp_cmp_mag_ct(d, c, c->used + 1) != FP_LT);
for (i = 0; i < c->used; i++) {
w += c->dp[i] & mask;
w = d->dp[i] - w;
d->dp[i] = (fp_digit)w;
w = (w >> DIGIT_BIT)&1;
}
d->dp[i] = 0;
d->used = i;
d->sign = a->sign;
fp_clamp(d);
return FP_OKAY;
}
#ifdef TFM_TIMING_RESISTANT
#ifdef WC_RSA_NONBLOCK
@@ -2033,7 +2127,7 @@ static int _fp_exptmod_nct(fp_int * G, fp_int * X, fp_int * P, fp_int * Y)
fp_copy (&M[1], &M[(word32)(1 << (winsize - 1))]);
for (x = 0; x < (winsize - 1); x++) {
fp_sqr (&M[(word32)(1 << (winsize - 1))], &M[(word32)(1 << (winsize - 1))]);
err = fp_montgomery_reduce (&M[(word32)(1 << (winsize - 1))], P, mp);
err = fp_montgomery_reduce_ex(&M[(word32)(1 << (winsize - 1))], P, mp, 0);
if (err != FP_OKAY) {
#ifndef WOLFSSL_NO_MALLOC
XFREE(M, NULL, DYNAMIC_TYPE_BIGINT);
@@ -2051,7 +2145,7 @@ static int _fp_exptmod_nct(fp_int * G, fp_int * X, fp_int * P, fp_int * Y)
#endif
return err;
}
err = fp_montgomery_reduce(&M[x], P, mp);
err = fp_montgomery_reduce_ex(&M[x], P, mp, 0);
if (err != FP_OKAY) {
#ifndef WOLFSSL_NO_MALLOC
XFREE(M, NULL, DYNAMIC_TYPE_BIGINT);
@@ -2102,7 +2196,7 @@ static int _fp_exptmod_nct(fp_int * G, fp_int * X, fp_int * P, fp_int * Y)
#endif
return err;
}
fp_montgomery_reduce(res, P, mp);
fp_montgomery_reduce_ex(res, P, mp, 0);
if (err != FP_OKAY) {
#ifndef WOLFSSL_NO_MALLOC
XFREE(M, NULL, DYNAMIC_TYPE_BIGINT);
@@ -2127,7 +2221,7 @@ static int _fp_exptmod_nct(fp_int * G, fp_int * X, fp_int * P, fp_int * Y)
#endif
return err;
}
err = fp_montgomery_reduce(res, P, mp);
err = fp_montgomery_reduce_ex(res, P, mp, 0);
if (err != FP_OKAY) {
#ifndef WOLFSSL_NO_MALLOC
XFREE(M, NULL, DYNAMIC_TYPE_BIGINT);
@@ -2144,7 +2238,7 @@ static int _fp_exptmod_nct(fp_int * G, fp_int * X, fp_int * P, fp_int * Y)
#endif
return err;
}
err = fp_montgomery_reduce(res, P, mp);
err = fp_montgomery_reduce_ex(res, P, mp, 0);
if (err != FP_OKAY) {
#ifndef WOLFSSL_NO_MALLOC
XFREE(M, NULL, DYNAMIC_TYPE_BIGINT);
@@ -2170,7 +2264,7 @@ static int _fp_exptmod_nct(fp_int * G, fp_int * X, fp_int * P, fp_int * Y)
#endif
return err;
}
err = fp_montgomery_reduce(res, P, mp);
err = fp_montgomery_reduce_ex(res, P, mp, 0);
if (err != FP_OKAY) {
#ifndef WOLFSSL_NO_MALLOC
XFREE(M, NULL, DYNAMIC_TYPE_BIGINT);
@@ -2189,7 +2283,7 @@ static int _fp_exptmod_nct(fp_int * G, fp_int * X, fp_int * P, fp_int * Y)
#endif
return err;
}
err = fp_montgomery_reduce(res, P, mp);
err = fp_montgomery_reduce_ex(res, P, mp, 0);
if (err != FP_OKAY) {
#ifndef WOLFSSL_NO_MALLOC
XFREE(M, NULL, DYNAMIC_TYPE_BIGINT);
@@ -2206,7 +2300,7 @@ static int _fp_exptmod_nct(fp_int * G, fp_int * X, fp_int * P, fp_int * Y)
* to reduce one more time to cancel out the factor
* of R.
*/
err = fp_montgomery_reduce(res, P, mp);
err = fp_montgomery_reduce_ex(res, P, mp, 0);
/* swap res with Y */
fp_copy (res, Y);
@@ -3119,6 +3213,7 @@ int fp_cmp_mag(fp_int *a, fp_int *b)
return FP_EQ;
}
/* sets up the montgomery reduction */
int fp_montgomery_setup(fp_int *a, fp_digit *rho)
{
@@ -3198,7 +3293,7 @@ static WC_INLINE void innermul8_mulx(fp_digit *c_mulx, fp_digit *cy_mulx, fp_dig
}
/* computes x/R == x (mod N) via Montgomery Reduction */
static int fp_montgomery_reduce_mulx(fp_int *a, fp_int *m, fp_digit mp)
static int fp_montgomery_reduce_mulx(fp_int *a, fp_int *m, fp_digit mp, int ct)
{
#ifndef WOLFSSL_SMALL_STACK
fp_digit c[FP_SIZE+1];
@@ -3279,10 +3374,20 @@ static int fp_montgomery_reduce_mulx(fp_int *a, fp_int *m, fp_digit mp)
a->used = pa+1;
fp_clamp(a);
#ifdef WOLFSSL_MONT_RED_NCT
/* if A >= m then A = A - m */
if (fp_cmp_mag (a, m) != FP_LT) {
s_fp_sub (a, m, a);
}
(void)ct;
#else
if (ct) {
fp_submod_ct(a, m, m, a);
}
else if (fp_cmp_mag (a, m) != FP_LT) {
s_fp_sub (a, m, a);
}
#endif
#ifdef WOLFSSL_SMALL_STACK
XFREE(c, NULL, DYNAMIC_TYPE_BIGINT);
@@ -3292,7 +3397,7 @@ static int fp_montgomery_reduce_mulx(fp_int *a, fp_int *m, fp_digit mp)
#endif
/* computes x/R == x (mod N) via Montgomery Reduction */
int fp_montgomery_reduce(fp_int *a, fp_int *m, fp_digit mp)
int fp_montgomery_reduce_ex(fp_int *a, fp_int *m, fp_digit mp, int ct)
{
#ifndef WOLFSSL_SMALL_STACK
fp_digit c[FP_SIZE+1];
@@ -3302,7 +3407,7 @@ int fp_montgomery_reduce(fp_int *a, fp_int *m, fp_digit mp)
fp_digit *_c, *tmpm, mu = 0;
int oldused, x, y, pa, err = 0;
IF_HAVE_INTEL_MULX(err = fp_montgomery_reduce_mulx(a, m, mp), return err) ;
IF_HAVE_INTEL_MULX(err=fp_montgomery_reduce_mulx(a, m, mp, ct), return err) ;
(void)err;
/* bail if too large */
@@ -3330,7 +3435,16 @@ int fp_montgomery_reduce(fp_int *a, fp_int *m, fp_digit mp)
pa = m->used;
/* copy the input */
#ifdef TFM_TIMING_RESISTANT
if (a->used <= m->used) {
oldused = m->used;
}
else {
oldused = m->used * 2;
}
#else
oldused = a->used;
#endif
for (x = 0; x < oldused; x++) {
c[x] = a->dp[x];
}
@@ -3378,10 +3492,20 @@ int fp_montgomery_reduce(fp_int *a, fp_int *m, fp_digit mp)
a->used = pa+1;
fp_clamp(a);
#ifndef WOLFSSL_MONT_RED_CT
/* if A >= m then A = A - m */
if (fp_cmp_mag (a, m) != FP_LT) {
s_fp_sub (a, m, a);
}
(void)ct;
#else
if (ct) {
fp_submod_ct(a, m, m, a);
}
else if (fp_cmp_mag (a, m) != FP_LT) {
s_fp_sub (a, m, a);
}
#endif
#ifdef WOLFSSL_SMALL_STACK
XFREE(c, NULL, DYNAMIC_TYPE_BIGINT);
@@ -3389,6 +3513,11 @@ int fp_montgomery_reduce(fp_int *a, fp_int *m, fp_digit mp)
return FP_OKAY;
}
int fp_montgomery_reduce(fp_int *a, fp_int *m, fp_digit mp)
{
return fp_montgomery_reduce_ex(a, m, mp, 1);
}
int fp_read_unsigned_bin(fp_int *a, const unsigned char *b, int c)
{
#if defined(ALT_ECC_SIZE) || defined(HAVE_WOLF_BIGINT)
@@ -4007,6 +4136,18 @@ int mp_addmod(mp_int *a, mp_int *b, mp_int *c, mp_int *d)
return fp_addmod(a, b, c, d);
}
/* d = a - b (mod c) - constant time (a < c and b < c) */
int mp_submod_ct(mp_int *a, mp_int *b, mp_int *c, mp_int *d)
{
return fp_submod_ct(a, b, c, d);
}
/* d = a + b (mod c) - constant time (a < c and b < c) */
int mp_addmod_ct(mp_int *a, mp_int *b, mp_int *c, mp_int *d)
{
return fp_addmod_ct(a, b, c, d);
}
/* c = a mod b, 0 <= c < b */
#if defined(FREESCALE_LTC_TFM)
int wolfcrypt_mp_mod (mp_int * a, mp_int * b, mp_int * c)
@@ -5221,6 +5362,11 @@ int mp_montgomery_reduce(fp_int *a, fp_int *m, fp_digit mp)
return fp_montgomery_reduce(a, m, mp);
}
int mp_montgomery_reduce_ex(fp_int *a, fp_int *m, fp_digit mp, int ct)
{
return fp_montgomery_reduce_ex(a, m, mp, ct);
}
/* fast math conversion */
int mp_montgomery_setup(fp_int *a, fp_digit *rho)
@@ -5234,6 +5380,12 @@ int mp_div_2(fp_int * a, fp_int * b)
return MP_OKAY;
}
/* c = a / 2 (mod b) - constant time (a < b and positive) */
int mp_div_2_mod_ct(mp_int *a, mp_int *b, mp_int *c)
{
return fp_div_2_mod_ct(a, b, c);
}
int mp_init_copy(fp_int * a, fp_int * b)
{
wolfcrypt/test/test.c
+91 -7
View File
@@ -18260,7 +18260,7 @@ done:
#endif
#ifdef HAVE_ECC_CDH
static int ecc_test_cdh_vectors(void)
static int ecc_test_cdh_vectors(WC_RNG* rng)
{
int ret;
ecc_key pub_key, priv_key;
@@ -18292,6 +18292,16 @@ static int ecc_test_cdh_vectors(void)
if (ret != 0)
goto done;
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
ret = wc_ecc_set_rng(&priv_key, rng);
if (ret != 0)
goto done;
#else
(void)rng;
#endif
/* compute ECC Cofactor shared secret */
x = sizeof(sharedA);
do {
@@ -18517,6 +18527,14 @@ static int ecc_test_make_pub(WC_RNG* rng)
}
TEST_SLEEP();
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
ret = wc_ecc_set_rng(&key, rng);
if (ret != 0)
goto done;
#endif
x = sizeof(exportBuf);
do {
#if defined(WOLFSSL_ASYNC_CRYPT)
@@ -18766,6 +18784,17 @@ static int ecc_test_curve_size(WC_RNG* rng, int keySize, int testVerifyCount,
}
#ifdef HAVE_ECC_DHE
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
ret = wc_ecc_set_rng(&userA, rng);
if (ret != 0)
goto done;
ret = wc_ecc_set_rng(&userB, rng);
if (ret != 0)
goto done;
#endif
x = ECC_SHARED_SIZE;
do {
#if defined(WOLFSSL_ASYNC_CRYPT)
@@ -19528,7 +19557,7 @@ done:
#endif
#ifdef HAVE_ECC_DHE
static int ecc_ssh_test(ecc_key* key)
static int ecc_ssh_test(ecc_key* key, WC_RNG* rng)
{
int ret;
byte out[128];
@@ -19548,6 +19577,16 @@ static int ecc_ssh_test(ecc_key* key)
if (ret != BAD_FUNC_ARG)
return -9747;
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
ret = wc_ecc_set_rng(key, rng);
if (ret != 0)
return -9748;
#else
(void)rng;
#endif
/* Use API. */
ret = 0;
do {
@@ -19558,7 +19597,7 @@ static int ecc_ssh_test(ecc_key* key)
ret = wc_ecc_shared_secret_ssh(key, &key->pubkey, out, &outLen);
} while (ret == WC_PENDING_E);
if (ret != 0)
return -9748;
return -9749;
TEST_SLEEP();
return 0;
}
@@ -19613,7 +19652,7 @@ static int ecc_def_curve_test(WC_RNG *rng)
goto done;
#endif
#ifdef HAVE_ECC_DHE
ret = ecc_ssh_test(&key);
ret = ecc_ssh_test(&key, rng);
if (ret < 0)
goto done;
#endif
@@ -20667,7 +20706,7 @@ int ecc_test(void)
}
#endif
#ifdef HAVE_ECC_CDH
ret = ecc_test_cdh_vectors();
ret = ecc_test_cdh_vectors(&rng);
if (ret != 0) {
printf("ecc_test_cdh_vectors failed! %d\n", ret);
goto done;
@@ -20773,6 +20812,19 @@ int ecc_encrypt_test(void)
for (i = 0; i < (int)sizeof(msg); i++)
msg[i] = i;
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
ret = wc_ecc_set_rng(&userA, &rng);
if (ret != 0) {
ret = -10011; goto done;
}
ret = wc_ecc_set_rng(&userB, &rng);
if (ret != 0) {
ret = -10012; goto done;
}
#endif
/* encrypt msg to B */
ret = wc_ecc_encrypt(&userA, &userB, msg, sizeof(msg), out, &outSz, NULL);
if (ret != 0) {
@@ -20923,6 +20975,15 @@ int ecc_test_buffers(void) {
if (ret != 0)
return -10015;
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2))) && \
!defined(HAVE_SELFTEST)
ret = wc_ecc_set_rng(&cliKey, &rng);
if (ret != 0) {
return -10023;
}
#endif
#if defined(HAVE_ECC_ENCRYPT) && defined(HAVE_HKDF)
{
word32 y;
@@ -24856,6 +24917,7 @@ static int pkcs7enveloped_run_vectors(byte* rsaCert, word32 rsaCertSz,
byte enveloped[2048];
byte decoded[2048];
PKCS7* pkcs7;
WC_RNG rng;
#ifdef PKCS7_OUTPUT_TEST_BUNDLES
XFILE pkcs7File;
#endif
@@ -25012,6 +25074,17 @@ static int pkcs7enveloped_run_vectors(byte* rsaCert, word32 rsaCertSz,
testSz = sizeof(testVectors) / sizeof(pkcs7EnvelopedVector);
#ifdef ECC_TIMING_RESISTANT
#ifndef HAVE_FIPS
ret = wc_InitRng_ex(&rng, HEAP_HINT, devId);
#else
ret = wc_InitRng(&rng);
#endif
if (ret != 0) {
return -11760;
}
#endif
for (i = 0; i < testSz; i++) {
pkcs7 = wc_PKCS7_New(HEAP_HINT,
#ifdef WOLFSSL_ASYNC_CRYPT
@@ -25172,6 +25245,9 @@ static int pkcs7enveloped_run_vectors(byte* rsaCert, word32 rsaCertSz,
}
}
#ifdef ECC_TIMING_RESISTANT
pkcs7->rng = &rng;
#endif
/* encode envelopedData */
envelopedSz = wc_PKCS7_EncodeEnvelopedData(pkcs7, enveloped,
sizeof(enveloped));
@@ -25233,6 +25309,10 @@ static int pkcs7enveloped_run_vectors(byte* rsaCert, word32 rsaCertSz,
pkcs7 = NULL;
}
#ifdef ECC_TIMING_RESISTANT
wc_FreeRng(&rng);
#endif
(void)eccCert;
(void)eccCertSz;
(void)eccPrivKey;
@@ -25633,8 +25713,6 @@ static int pkcs7authenveloped_run_vectors(byte* rsaCert, word32 rsaCertSz,
wc_FreeRng(&rng);
return -11806;
}
wc_FreeRng(&rng);
}
for (i = 0; i < testSz; i++) {
@@ -25808,6 +25886,10 @@ static int pkcs7authenveloped_run_vectors(byte* rsaCert, word32 rsaCertSz,
}
}
#ifdef ECC_TIMING_RESISTANT
pkcs7->rng = &rng;
#endif
/* encode envelopedData */
envelopedSz = wc_PKCS7_EncodeAuthEnvelopedData(pkcs7, enveloped,
sizeof(enveloped));
@@ -25869,6 +25951,8 @@ static int pkcs7authenveloped_run_vectors(byte* rsaCert, word32 rsaCertSz,
pkcs7 = NULL;
}
wc_FreeRng(&rng);
#if !defined(HAVE_ECC) || defined(NO_AES)
(void)eccCert;
(void)eccCertSz;
wolfssl/test.h
+7
View File
@@ -2673,6 +2673,13 @@ static WC_INLINE int myEccSharedSecret(WOLFSSL* ssl, ecc_key* otherKey,
ret = BAD_FUNC_ARG;
}
#if defined(ECC_TIMING_RESISTANT) && !defined(HAVE_FIPS) && \
!defined(HAVE_SELFTEST)
if (ret == 0) {
ret = wc_ecc_set_rng(privKey, wolfSSL_GetRNG(ssl));
}
#endif
/* generate shared secret and return it */
if (ret == 0) {
ret = wc_ecc_shared_secret(privKey, pubKey, out, outlen);
wolfssl/wolfcrypt/ecc.h
+13
View File
@@ -431,6 +431,9 @@ struct ecc_key {
#ifdef WOLFSSL_DSP
remote_handle64 handle;
#endif
#ifdef ECC_TIMING_RESISTANT
WC_RNG* rng;
#endif
#ifdef WC_ECC_NONBLOCK
ecc_nb_ctx_t* nb_ctx;
#endif
@@ -476,6 +479,8 @@ int wc_ecc_make_key_ex(WC_RNG* rng, int keysize, ecc_key* key, int curve_id);
WOLFSSL_API
int wc_ecc_make_pub(ecc_key* key, ecc_point* pubOut);
WOLFSSL_API
int wc_ecc_make_pub_ex(ecc_key* key, ecc_point* pubOut, WC_RNG* rng);
WOLFSSL_API
int wc_ecc_check_key(ecc_key* key);
WOLFSSL_API
int wc_ecc_is_point(ecc_point* ecp, mp_int* a, mp_int* b, mp_int* prime);
@@ -545,6 +550,10 @@ WOLFSSL_API
void wc_ecc_fp_free(void);
WOLFSSL_LOCAL
void wc_ecc_fp_init(void);
#ifdef ECC_TIMING_RESISTANT
WOLFSSL_API
int wc_ecc_set_rng(ecc_key* key, WC_RNG* rng);
#endif
WOLFSSL_API
int wc_ecc_set_curve(ecc_key* key, int keysize, int curve_id);
@@ -600,6 +609,10 @@ int wc_ecc_mulmod(mp_int* k, ecc_point *G, ecc_point *R,
WOLFSSL_LOCAL
int wc_ecc_mulmod_ex(mp_int* k, ecc_point *G, ecc_point *R,
mp_int* a, mp_int* modulus, int map, void* heap);
WOLFSSL_LOCAL
int wc_ecc_mulmod_ex2(mp_int* k, ecc_point *G, ecc_point *R, mp_int* a,
mp_int* modulus, mp_int* order, WC_RNG* rng, int map,
void* heap);
#endif /* !WOLFSSL_ATECC508A */
wolfssl/wolfcrypt/integer.h
+4
View File
@@ -318,6 +318,7 @@ MP_API int mp_is_bit_set (mp_int * a, mp_digit b);
MP_API int mp_mod (mp_int * a, mp_int * b, mp_int * c);
MP_API int mp_div(mp_int * a, mp_int * b, mp_int * c, mp_int * d);
MP_API int mp_div_2(mp_int * a, mp_int * b);
MP_API int mp_div_2_mod_ct (mp_int* a, mp_int* b, mp_int* c);
MP_API int mp_add (mp_int * a, mp_int * b, mp_int * c);
int s_mp_add (mp_int * a, mp_int * b, mp_int * c);
int s_mp_sub (mp_int * a, mp_int * b, mp_int * c);
@@ -332,6 +333,7 @@ MP_API int mp_exptmod_base_2 (mp_int * X, mp_int * P, mp_int * Y);
MP_API int mp_montgomery_setup (mp_int * n, mp_digit * rho);
int fast_mp_montgomery_reduce (mp_int * x, mp_int * n, mp_digit rho);
MP_API int mp_montgomery_reduce (mp_int * x, mp_int * n, mp_digit rho);
#define mp_montgomery_reduce_ex(x, n, rho, ct) mp_montgomery_reduce (x, n, rho)
MP_API void mp_dr_setup(mp_int *a, mp_digit *d);
MP_API int mp_dr_reduce (mp_int * x, mp_int * n, mp_digit k);
MP_API int mp_reduce_2k(mp_int *a, mp_int *n, mp_digit d);
@@ -355,6 +357,8 @@ MP_API int mp_sqr (mp_int * a, mp_int * b);
MP_API int mp_mulmod (mp_int * a, mp_int * b, mp_int * c, mp_int * d);
MP_API int mp_submod (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
MP_API int mp_addmod (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
MP_API int mp_submod_ct (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
MP_API int mp_addmod_ct (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
MP_API int mp_mul_d (mp_int * a, mp_digit b, mp_int * c);
MP_API int mp_2expt (mp_int * a, int b);
MP_API int mp_set_bit (mp_int * a, int b);
wolfssl/wolfcrypt/tfm.h
+15
View File
@@ -474,6 +474,9 @@ int fp_mul_2d(fp_int *a, int b, fp_int *c);
void fp_2expt (fp_int *a, int b);
int fp_mul_2(fp_int *a, fp_int *c);
void fp_div_2(fp_int *a, fp_int *c);
/* c = a / 2 (mod b) - constant time (a < b and positive) */
int fp_div_2_mod_ct(fp_int *a, fp_int *b, fp_int *c);
/* Counts the number of lsbs which are zero before the first zero bit */
int fp_cnt_lsb(fp_int *a);
@@ -530,6 +533,12 @@ int fp_submod(fp_int *a, fp_int *b, fp_int *c, fp_int *d);
/* d = a + b (mod c) */
int fp_addmod(fp_int *a, fp_int *b, fp_int *c, fp_int *d);
/* d = a - b (mod c) - constant time (a < c and b < c) */
int fp_submod_ct(fp_int *a, fp_int *b, fp_int *c, fp_int *d);
/* d = a + b (mod c) - constant time (a < c and b < c) */
int fp_addmod_ct(fp_int *a, fp_int *b, fp_int *c, fp_int *d);
/* c = a * a (mod b) */
int fp_sqrmod(fp_int *a, fp_int *b, fp_int *c);
@@ -553,6 +562,7 @@ int fp_montgomery_calc_normalization(fp_int *a, fp_int *b);
/* computes x/R == x (mod N) via Montgomery Reduction */
int fp_montgomery_reduce(fp_int *a, fp_int *m, fp_digit mp);
int fp_montgomery_reduce_ex(fp_int *a, fp_int *m, fp_digit mp, int ct);
/* d = a**b (mod c) */
int fp_exptmod(fp_int *a, fp_int *b, fp_int *c, fp_int *d);
@@ -743,6 +753,8 @@ MP_API int mp_mul_d (mp_int * a, mp_digit b, mp_int * c);
MP_API int mp_mulmod (mp_int * a, mp_int * b, mp_int * c, mp_int * d);
MP_API int mp_submod (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
MP_API int mp_addmod (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
MP_API int mp_submod_ct (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
MP_API int mp_addmod_ct (mp_int* a, mp_int* b, mp_int* c, mp_int* d);
MP_API int mp_mod(mp_int *a, mp_int *b, mp_int *c);
MP_API int mp_invmod(mp_int *a, mp_int *b, mp_int *c);
MP_API int mp_invmod_mont_ct(mp_int *a, mp_int *b, mp_int *c, fp_digit mp);
@@ -791,8 +803,11 @@ MP_API int mp_radix_size (mp_int * a, int radix, int *size);
#ifdef HAVE_ECC
MP_API int mp_sqr(fp_int *a, fp_int *b);
MP_API int mp_montgomery_reduce(fp_int *a, fp_int *m, fp_digit mp);
MP_API int mp_montgomery_reduce_ex(fp_int *a, fp_int *m, fp_digit mp,
int ct);
MP_API int mp_montgomery_setup(fp_int *a, fp_digit *rho);
MP_API int mp_div_2(fp_int * a, fp_int * b);
MP_API int mp_div_2_mod_ct(mp_int *a, mp_int *b, mp_int *c);
MP_API int mp_init_copy(fp_int * a, fp_int * b);
#endif