mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-04-25 09:02:48 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Extract Secp521r1 from the prototype

Browse Source 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
This commit is contained in:
Gabor Mezei 2023-02-01 13:58:04 +01:00
parent e2a9f86755
commit 42df16c84b
No known key found for this signature in database
GPG Key ID: FEE76C0CF8C6267D
1 changed files with 34 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
library/ecp_curves.c
View File

@ -5189,11 +5189,6 @@ cleanup:
MBEDTLS_ECP_DP_SECP384R1_ENABLED */ MBEDTLS_ECP_DP_SECP384R1_ENABLED */
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
/*
* Here we have an actual Mersenne prime, so things are more straightforward.
* However, chunks are aligned on a 'weird' boundary (521 bits).
*/
/* Size of p521 in terms of mbedtls_mpi_uint */ /* Size of p521 in terms of mbedtls_mpi_uint */
#define P521_WIDTH (521 / 8 / sizeof(mbedtls_mpi_uint) + 1) #define P521_WIDTH (521 / 8 / sizeof(mbedtls_mpi_uint) + 1)
@ -5201,48 +5196,56 @@ cleanup:
#define P521_MASK 0x01FF #define P521_MASK 0x01FF
/* /*
* Fast quasi-reduction modulo p521 (FIPS 186-3 D.2.5) * Fast quasi-reduction modulo p521 = 2^521 - 1 (FIPS 186-3 D.2.5)
* Write N as A1 + 2^521 A0, return A0 + A1
*/ */
static int ecp_mod_p521(mbedtls_mpi *N) static int ecp_mod_p521(mbedtls_mpi *N)
{ {
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
size_t i; size_t expected_width = 2 * ((521 + biL - 1) / biL);
mbedtls_mpi M; MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width));
mbedtls_mpi_uint Mp[P521_WIDTH + 1]; ret = ecp_mod_p521_raw(N->p, expected_width);
/* Worst case for the size of M is when mbedtls_mpi_uint is 16 bits: cleanup:
* we need to hold bits 513 to 1056, which is 34 limbs, that is return ret;
* P521_WIDTH + 1. Otherwise P521_WIDTH is enough. */ }
static int ecp_mod_p521_raw(mbedtls_mpi_uint *N_p, size_t N_n)
{
mbedtls_mpi_uint carry = 0;
if (N->n < P521_WIDTH) { if (N_n > 2*P521_WIDTH) {
N_n = 2*P521_WIDTH;
}
if (N_n < P521_WIDTH) {
return 0; return 0;
} }
/* M = A1 */ /* Step 1: Reduction to P521_WIDTH limbs */
M.s = 1; if (N_n > P521_WIDTH) {
M.n = N->n - (P521_WIDTH - 1); /* Helper references for top part of N */
if (M.n > P521_WIDTH + 1) { mbedtls_mpi_uint *NT_p = N_p + P521_WIDTH;
M.n = P521_WIDTH + 1; size_t NT_n = N_n - P521_WIDTH;
}
M.p = Mp;
memcpy(Mp, N->p + P521_WIDTH - 1, M.n * sizeof(mbedtls_mpi_uint));
MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&M, 521 % (8 * sizeof(mbedtls_mpi_uint))));
/* N = A0 */ /* Split N as A0 + 2^(512 + biL) A1 and compute A0 + 2^(biL - 9) * A1.
N->p[P521_WIDTH - 1] &= P521_MASK; * This can be done in place. */
for (i = P521_WIDTH; i < N->n; i++) { mbedtls_mpi_uint shift = ((mbedtls_mpi_uint) 1u) << (biL - 9);
N->p[i] = 0; carry = MPI_CORE(mla)(N_p, P521_WIDTH, NT_p, NT_n, shift);
/* Clear top part */
memset(NT_p, 0, sizeof(mbedtls_mpi_uint) * NT_n);
} }
/* N = A0 + A1 */ /* Step 2: Reduction to < 2p.
MBEDTLS_MPI_CHK(mbedtls_mpi_add_abs(N, N, &M)); * Now split as A0 + 2^521 * c, with c a scalar, and compute A0 + c. */
carry <<= (biL - 9);
carry += (N_p[P521_WIDTH-1] >> 9);
N_p[P521_WIDTH-1] &= P521_MASK;
(void) mbedtls_core_add_int(N_p, N_p, carry, P521_WIDTH);
cleanup: return 0;
return ret;
} }
#undef P521_WIDTH #undef P521_WIDTH
#undef P521_MASK #undef P521_MASK
#endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */ #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
#endif /* MBEDTLS_ECP_NIST_OPTIM */ #endif /* MBEDTLS_ECP_NIST_OPTIM */