From 6fb105fb2e70ad6a47ccbd1c1c9bfea4be0755b2 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Wed, 22 Feb 2023 15:28:20 +0000 Subject: [PATCH 1/7] ecp_curves: Ported prototypes Signed-off-by: Minos Galanakis --- library/ecp_curves.c | 212 +++++++++++++---------------------------- library/ecp_invasive.h | 21 ++++ 2 files changed, 85 insertions(+), 148 deletions(-) diff --git a/library/ecp_curves.c b/library/ecp_curves.c index db21d7d8cf..179016b5d4 100644 --- a/library/ecp_curves.c +++ b/library/ecp_curves.c @@ -4585,6 +4585,8 @@ int mbedtls_ecp_mod_p256_raw(mbedtls_mpi_uint *X, size_t X_limbs); #endif #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) static int ecp_mod_p384(mbedtls_mpi *); +MBEDTLS_STATIC_TESTABLE +int mbedtls_ecp_mod_p384_raw(mbedtls_mpi_uint *N_p, size_t N_n); #endif #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) static int ecp_mod_p521(mbedtls_mpi *); @@ -5181,160 +5183,34 @@ int mbedtls_ecp_mod_p256_raw(mbedtls_mpi_uint *X, size_t X_limbs) #endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */ -#undef LOAD32 -#undef MAX32 -#undef A -#undef STORE32 -#undef STORE0 -#undef ADD -#undef SUB -#undef ADD_CARRY -#undef SUB_CARRY -#undef ADD_LAST -#undef SUB_LAST -#undef INIT -#undef NEXT -#undef RESET -#undef LAST - -#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED || - MBEDTLS_ECP_DP_SECP256R1_ENABLED || - MBEDTLS_ECP_DP_SECP384R1_ENABLED */ - -#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) -/* - * The reader is advised to first understand ecp_mod_p192() since the same - * general structure is used here, but with additional complications: - * (1) chunks of 32 bits, and (2) subtractions. - */ - -/* - * For these primes, we need to handle data in chunks of 32 bits. - * This makes it more complicated if we use 64 bits limbs in MPI, - * which prevents us from using a uniform access method as for p192. - * - * So, we define a mini abstraction layer to access 32 bit chunks, - * load them in 'cur' for work, and store them back from 'cur' when done. - * - * While at it, also define the size of N in terms of 32-bit chunks. - */ -#define LOAD32 cur = A(i); - -#if defined(MBEDTLS_HAVE_INT32) /* 32 bit */ - -#define MAX32 N->n -#define A(j) N->p[j] -#define STORE32 N->p[i] = cur; - -#else /* 64-bit */ - -#define MAX32 N->n * 2 -#define A(j) (j) % 2 ? (uint32_t) (N->p[(j)/2] >> 32) : \ - (uint32_t) (N->p[(j)/2]) -#define STORE32 \ - if (i % 2) { \ - N->p[i/2] &= 0x00000000FFFFFFFF; \ - N->p[i/2] |= ((mbedtls_mpi_uint) cur) << 32; \ - } else { \ - N->p[i/2] &= 0xFFFFFFFF00000000; \ - N->p[i/2] |= (mbedtls_mpi_uint) cur; \ - } - -#endif /* sizeof( mbedtls_mpi_uint ) */ - -/* - * Helpers for addition and subtraction of chunks, with signed carry. - */ -static inline void add32(uint32_t *dst, uint32_t src, signed char *carry) -{ - *dst += src; - *carry += (*dst < src); -} - -static inline void sub32(uint32_t *dst, uint32_t src, signed char *carry) -{ - *carry -= (*dst < src); - *dst -= src; -} - -#define ADD(j) add32(&cur, A(j), &c); -#define SUB(j) sub32(&cur, A(j), &c); - -/* - * Helpers for the main 'loop' - */ -#define INIT(b) \ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; \ - signed char c = 0, cc; \ - uint32_t cur; \ - size_t i = 0, bits = (b); \ - /* N is the size of the product of two b-bit numbers, plus one */ \ - /* limb for fix_negative */ \ - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, (b) * 2 / biL + 1)); \ - LOAD32; - -#define NEXT \ - STORE32; i++; LOAD32; \ - cc = c; c = 0; \ - if (cc < 0) \ - sub32(&cur, -cc, &c); \ - else \ - add32(&cur, cc, &c); \ - -#define LAST \ - STORE32; i++; \ - cur = c > 0 ? c : 0; STORE32; \ - cur = 0; while (++i < MAX32) { STORE32; } \ - if (c < 0) mbedtls_ecp_fix_negative(N, c, bits); - -/* - * If the result is negative, we get it in the form - * c * 2^bits + N, with c negative and N positive shorter than 'bits' - */ -MBEDTLS_STATIC_TESTABLE -void mbedtls_ecp_fix_negative(mbedtls_mpi *N, signed char c, size_t bits) -{ - size_t i; - - /* Set N := 2^bits - 1 - N. We know that 0 <= N < 2^bits, so - * set the absolute value to 0xfff...fff - N. There is no carry - * since we're subtracting from all-bits-one. */ - for (i = 0; i <= bits / 8 / sizeof(mbedtls_mpi_uint); i++) { - N->p[i] = ~(mbedtls_mpi_uint) 0 - N->p[i]; - } - /* Add 1, taking care of the carry. */ - i = 0; - do { - ++N->p[i]; - } while (N->p[i++] == 0 && i <= bits / 8 / sizeof(mbedtls_mpi_uint)); - /* Invert the sign. - * Now N = N0 - 2^bits where N0 is the initial value of N. */ - N->s = -1; - - /* Add |c| * 2^bits to the absolute value. Since c and N are - * negative, this adds c * 2^bits. */ - mbedtls_mpi_uint msw = (mbedtls_mpi_uint) -c; -#if defined(MBEDTLS_HAVE_INT64) - if (bits == 224) { - msw <<= 32; - } -#endif - N->p[bits / 8 / sizeof(mbedtls_mpi_uint)] += msw; -} - #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) /* * Fast quasi-reduction modulo p384 (FIPS 186-3 D.2.4) */ static int ecp_mod_p384(mbedtls_mpi *N) { + int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; + size_t expected_width = 2 * ((384 + biL - 1) / biL); + MBEDTLS_MPI_CHK(mbedtls_mpi_grow(N, expected_width)); + ret = mbedtls_ecp_mod_p384_raw(N->p, expected_width); +cleanup: + return ret; +} + +MBEDTLS_STATIC_TESTABLE +int mbedtls_ecp_mod_p384_raw(mbedtls_mpi_uint *X, size_t X_limbs) +{ + if (X_limbs != 2*((384 + biL - 1)/biL)) { + return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; + } + INIT(384); ADD(12); ADD(21); ADD(20); SUB(23); NEXT; // A0 ADD(13); ADD(22); ADD(23); - SUB(12); SUB(20); NEXT; // A2 + SUB(12); SUB(20); NEXT; // A1 ADD(14); ADD(23); SUB(13); SUB(21); NEXT; // A2 @@ -5364,22 +5240,62 @@ static int ecp_mod_p384(mbedtls_mpi *N) SUB(21); NEXT; // A10 ADD(23); ADD(20); ADD(19); - SUB(22); LAST; // A11 + SUB(22); // A11 -cleanup: - return ret; + RESET; + + ADD_LAST; NEXT; // A0 + SUB_LAST; NEXT; // A1 + NEXT; // A2 + ADD_LAST; NEXT; // A3 + ADD_LAST; NEXT; // A4 + NEXT; // A5 + NEXT; // A6 + NEXT; // A7 + NEXT; // A8 + NEXT; // A9 + NEXT; // A10 + // A11 + + RESET; + + ADD_LAST; NEXT; // A0 + SUB_LAST; NEXT; // A1 + NEXT; // A2 + ADD_LAST; NEXT; // A3 + ADD_LAST; NEXT; // A4 + NEXT; // A5 + NEXT; // A6 + NEXT; // A7 + NEXT; // A8 + NEXT; // A9 + NEXT; // A10 + // A11 + + LAST; + + return 0; } #endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */ -#undef A #undef LOAD32 -#undef STORE32 #undef MAX32 +#undef A +#undef STORE32 +#undef STORE0 +#undef ADD +#undef SUB +#undef ADD_CARRY +#undef SUB_CARRY +#undef ADD_LAST +#undef SUB_LAST #undef INIT #undef NEXT +#undef RESET #undef LAST -#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED || +#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED || + MBEDTLS_ECP_DP_SECP256R1_ENABLED || MBEDTLS_ECP_DP_SECP384R1_ENABLED */ #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) diff --git a/library/ecp_invasive.h b/library/ecp_invasive.h index cb16d23728..501152c038 100644 --- a/library/ecp_invasive.h +++ b/library/ecp_invasive.h @@ -160,6 +160,27 @@ int mbedtls_ecp_mod_p521_raw(mbedtls_mpi_uint *X, size_t X_limbs); #endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */ +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) + +/** Fast quasi-reduction modulo p384 (FIPS 186-3 D.2.4) + * + * \param[in,out] X The address of the MPI to be converted. + * Must have exact limb size of `(766 / biL) + 1`. + * Upon return holds the reduced value which is + * in range `0 <= X < 2 * N` (where N is the modulus). + * The bitlength of the reduced value is the same as + * that of the modulus (384 bits). + * \param[in] X_limbs The length of \p N in limbs. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p N_n does not have + * twice as many limbs as the modulus. + */ +MBEDTLS_STATIC_TESTABLE +int mbedtls_ecp_mod_p384_raw(mbedtls_mpi_uint *X, size_t X_limbs); + +#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */ + /** Initialise a modulus with hard-coded const curve data. * * \note The caller is responsible for the \p N modulus' memory. From 619385d8bcd8d658b40894dc805b791ec25dd00f Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 6 Mar 2023 10:00:46 +0000 Subject: [PATCH 2/7] test_suite_ecp: Added ecp_mod_p384_raw() test case. Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ecp.function | 43 ++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function index ecb35464a8..440a1e30d6 100644 --- a/tests/suites/test_suite_ecp.function +++ b/tests/suites/test_suite_ecp.function @@ -1430,6 +1430,49 @@ exit: } /* END_CASE */ +/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */ +void ecp_mod_p384_raw(char *input_N, + char *input_X, + char *result) +{ + mbedtls_mpi_uint *X = NULL; + mbedtls_mpi_uint *N = NULL; + mbedtls_mpi_uint *res = NULL; + size_t limbs_X; + size_t limbs_N; + size_t limbs_res; + + mbedtls_mpi_mod_modulus m; + mbedtls_mpi_mod_modulus_init(&m); + + TEST_EQUAL(mbedtls_test_read_mpi_core(&X, &limbs_X, input_X), 0); + TEST_EQUAL(mbedtls_test_read_mpi_core(&N, &limbs_N, input_N), 0); + TEST_EQUAL(mbedtls_test_read_mpi_core(&res, &limbs_res, result), 0); + + size_t limbs = limbs_N; + size_t bytes = limbs * sizeof(mbedtls_mpi_uint); + + TEST_EQUAL(limbs_X, (766 / biL) + 1); + TEST_EQUAL(limbs_res, limbs); + + TEST_EQUAL(mbedtls_mpi_mod_modulus_setup( + &m, N, limbs, + MBEDTLS_MPI_MOD_REP_MONTGOMERY), 0); + + TEST_EQUAL(mbedtls_ecp_mod_p384_raw(X, limbs_X), 0); + TEST_LE_U(mbedtls_mpi_core_bitlen(X, limbs_X), 384); + mbedtls_mpi_mod_raw_fix_quasi_reduction(X, &m); + ASSERT_COMPARE(X, bytes, res, bytes); + +exit: + mbedtls_free(X); + mbedtls_free(res); + + mbedtls_mpi_mod_modulus_free(&m); + mbedtls_free(N); +} +/* END_CASE */ + /* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */ void ecp_mod_p521_raw(char *input_N, char *input_X, From f359c91f9b6b265bc5f2cbddce54424d430dff6e Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 6 Mar 2023 11:39:54 +0000 Subject: [PATCH 3/7] ecp test generator: Added EcpPp384R1Raw(). Signed-off-by: Minos Galanakis --- scripts/mbedtls_dev/ecp.py | 80 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) diff --git a/scripts/mbedtls_dev/ecp.py b/scripts/mbedtls_dev/ecp.py index ffe48fc5d9..6d3bb0536b 100644 --- a/scripts/mbedtls_dev/ecp.py +++ b/scripts/mbedtls_dev/ecp.py @@ -144,6 +144,86 @@ class EcpP224R1Raw(bignum_common.ModOperationCommon, def is_valid(self) -> bool: return True +class EcpPp384R1Raw(bignum_common.ModOperationCommon, + EcpTarget): + """Test cases for ecp quasi_reduction modulo p384.""" + test_function = "ecp_mod_p384_raw" + test_name = "ecp_mod_p384_raw" + input_style = "arch_split" + arity = 1 + + moduli = [("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" + "fffffeffffffff0000000000000000ffffffff") + ] # type: List[str] + + input_values = [ + "0", "1", + + # Modulus - 1 + ("fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffef" + "fffffff0000000000000000fffffffe"), + + # Maximum canonical P384 multiplication result + ("0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" + "fdfffffffe0000000000000001fffffffc0000000000000000000000000000000" + "10000000200000000fffffffe000000020000000400000000fffffffc00000004"), + + # Testing with overflow in A(12) + A(21) + A(20); + ("497811378624857a2c2af60d70583376545484cfae5c812fe2999fc1abb51d18b" + "559e8ca3b50aaf263fdf8f24bdfb98fffffffff20e65bf9099e4e73a5e8b517cf" + "4fbeb8fd1750fdae6d43f2e53f82d5ffffffffffffffffcc6f1e06111c62e0"), + + # Testing with underflow in A(13) + A(22) + A(23) - A(12) - A(20); + ("dfdd25e96777406b3c04b8c7b406f5fcf287e1e576003a092852a6fbe517f2712" + "b68abef41dbd35183a0614fb7222606ffffffff84396eee542f18a9189d94396c" + "784059c17a9f18f807214ef32f2f10ffffffff8a77fac20000000000000000"), + + # First 8 number generated by random.getrandbits(768) - seed(2,2) + ("ffed9235288bc781ae66267594c9c9500925e4749b575bd13653f8dd9b1f282e" + "4067c3584ee207f8da94e3e8ab73738fcf1822ffbc6887782b491044d5e34124" + "5c6e433715ba2bdd177219d30e7a269fd95bafc8f2a4d27bdcf4bb99f4bea973"), + ("e8624fab5186ee32ee8d7ee9770348a05d300cb90706a045defc044a09325626" + "e6b58de744ab6cce80877b6f71e1f6d2ef8acd128b4f2fc15f3f57ebf30b94fa" + "82523e86feac7eb7dc38f519b91751dacdbd47d364be8049a372db8f6e405d93"), + ("fec3f6b32e8d4b8a8f54f8ceacaab39e83844b40ffa9b9f15c14bc4a829e07b0" + "829a48d422fe99a22c70501e533c91352d3d854e061b90303b08c6e33c729578" + "2d6c797f8f7d9b782a1be9cd8697bbd0e2520e33e44c50556c71c4a66148a86f"), + ("bd143fa9b714210c665d7435c1066932f4767f26294365b2721dea3bf63f23d0" + "dbe53fcafb2147df5ca495fa5a91c89b97eeab64ca2ce6bc5d3fd983c34c769f" + "e89204e2e8168561867e5e15bc01bfce6a27e0dfcbf8754472154e76e4c11ab2"), + ("8ebdbfe3eb9ac688b9d39cca91551e8259cc60b17604e4b4e73695c3e652c71a" + "74667bffe202849da9643a295a9ac6decbd4d3e2d4dec9ef83f0be4e80371eb9" + "7f81375eecc1cb6347733e847d718d733ff98ff387c56473a7a83ee0761ebfd2"), + ("d4c0dca8b4c9e755cc9c3adcf515a8234da4daeb4f3f87777ad1f45ae9500ec9" + "c5e2486c44a4a8f69dc8db48e86ec9c6e06f291b2a838af8d5c44a4eb3172062" + "d08f1bb2531d6460f0caeef038c89b38a8acb5137c9260dc74e088a9b9492f25"), + ("227eeb7b9d7d01f5769da05d205bbfcc8c69069134bccd3e1cf4f589f8e4ce0a" + "f29d115ef24bd625dd961e6830b54fa7d28f93435339774bb1e386c4fd5079e6" + "81b8f5896838b769da59b74a6c3181c81e220df848b1df78feb994a81167346"), + ("d322a7353ead4efe440e2b4fda9c025a22f1a83185b98f5fc11e60de1b343f52" + "ea748db9e020307aaeb6db2c3a038a709779ac1f45e9dd320c855fdfa7251af0" + "930cdbd30f0ad2a81b2d19a2beaa14a7ff3fe32a30ffc4eed0a7bd04e85bfcdd"), + + # Next 2 number generated by random.getrandbits(384) + ("5c3747465cc36c270e8a35b10828d569c268a20eb78ac332e5e138e26c4454b9" + "0f756132e16dce72f18e859835e1f291"), + ("eb2b5693babb7fbb0a76c196067cfdcb11457d9cf45e2fa01d7f427515392480" + "0600571fac3a5b263fdf57cd2c006497") + ] + + @property + def arg_a(self) -> str: + hex_digits = bignum_common.hex_digits_for_limb((766 // self.bits_in_limb) + 1, + self.bits_in_limb) + return super().format_arg('{:x}'.format(self.int_a)).zfill(hex_digits) + + def result(self) -> List[str]: + result = self.int_a % self.int_n + return [self.format_result(result)] + + @property + def is_valid(self) -> bool: + return True class EcpP256R1Raw(bignum_common.ModOperationCommon, EcpTarget): From 37f4cb6d0e55dd14e1aa29dd19a1e82d52823885 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 9 Mar 2023 11:15:15 +0000 Subject: [PATCH 4/7] ecp_curves: Minor rework for p384 This patch adjusts formatting, documentation and testing. Signed-off-by: Minos Galanakis --- library/ecp_curves.c | 53 ++++++++++++++-------------- library/ecp_invasive.h | 2 +- scripts/mbedtls_dev/ecp.py | 23 ++++++++---- tests/suites/test_suite_ecp.function | 2 +- 4 files changed, 45 insertions(+), 35 deletions(-) diff --git a/library/ecp_curves.c b/library/ecp_curves.c index 179016b5d4..c23ff2c7e4 100644 --- a/library/ecp_curves.c +++ b/library/ecp_curves.c @@ -4586,7 +4586,7 @@ int mbedtls_ecp_mod_p256_raw(mbedtls_mpi_uint *X, size_t X_limbs); #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) static int ecp_mod_p384(mbedtls_mpi *); MBEDTLS_STATIC_TESTABLE -int mbedtls_ecp_mod_p384_raw(mbedtls_mpi_uint *N_p, size_t N_n); +int mbedtls_ecp_mod_p384_raw(mbedtls_mpi_uint *X, size_t X_limbs); #endif #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) static int ecp_mod_p521(mbedtls_mpi *); @@ -5207,69 +5207,70 @@ int mbedtls_ecp_mod_p384_raw(mbedtls_mpi_uint *X, size_t X_limbs) INIT(384); ADD(12); ADD(21); ADD(20); - SUB(23); NEXT; // A0 + SUB(23); NEXT; // A0 ADD(13); ADD(22); ADD(23); - SUB(12); SUB(20); NEXT; // A1 + SUB(12); SUB(20); NEXT; // A1 ADD(14); ADD(23); - SUB(13); SUB(21); NEXT; // A2 + SUB(13); SUB(21); NEXT; // A2 ADD(15); ADD(12); ADD(20); ADD(21); - SUB(14); SUB(22); SUB(23); NEXT; // A3 + SUB(14); SUB(22); SUB(23); NEXT; // A3 ADD(21); ADD(21); ADD(16); ADD(13); ADD(12); ADD(20); ADD(22); - SUB(15); SUB(23); SUB(23); NEXT; // A4 + SUB(15); SUB(23); SUB(23); NEXT; // A4 ADD(22); ADD(22); ADD(17); ADD(14); ADD(13); ADD(21); ADD(23); - SUB(16); NEXT; // A5 + SUB(16); NEXT; // A5 ADD(23); ADD(23); ADD(18); ADD(15); ADD(14); ADD(22); - SUB(17); NEXT; // A6 + SUB(17); NEXT; // A6 ADD(19); ADD(16); ADD(15); ADD(23); - SUB(18); NEXT; // A7 + SUB(18); NEXT; // A7 ADD(20); ADD(17); ADD(16); - SUB(19); NEXT; // A8 + SUB(19); NEXT; // A8 ADD(21); ADD(18); ADD(17); - SUB(20); NEXT; // A9 + SUB(20); NEXT; // A9 ADD(22); ADD(19); ADD(18); - SUB(21); NEXT; // A10 + SUB(21); NEXT; // A10 ADD(23); ADD(20); ADD(19); SUB(22); // A11 RESET; + /* Use 2^384 = P + 2^128 + 2^96 - 2^32 + 1 to modulo reduce the final carry */ ADD_LAST; NEXT; // A0 SUB_LAST; NEXT; // A1 - NEXT; // A2 + ; NEXT; // A2 ADD_LAST; NEXT; // A3 ADD_LAST; NEXT; // A4 - NEXT; // A5 - NEXT; // A6 - NEXT; // A7 - NEXT; // A8 - NEXT; // A9 - NEXT; // A10 + ; NEXT; // A5 + ; NEXT; // A6 + ; NEXT; // A7 + ; NEXT; // A8 + ; NEXT; // A9 + ; NEXT; // A10 // A11 RESET; ADD_LAST; NEXT; // A0 SUB_LAST; NEXT; // A1 - NEXT; // A2 + ; NEXT; // A2 ADD_LAST; NEXT; // A3 ADD_LAST; NEXT; // A4 - NEXT; // A5 - NEXT; // A6 - NEXT; // A7 - NEXT; // A8 - NEXT; // A9 - NEXT; // A10 + ; NEXT; // A5 + ; NEXT; // A6 + ; NEXT; // A7 + ; NEXT; // A8 + ; NEXT; // A9 + ; NEXT; // A10 // A11 LAST; diff --git a/library/ecp_invasive.h b/library/ecp_invasive.h index 501152c038..d2ac20ac4c 100644 --- a/library/ecp_invasive.h +++ b/library/ecp_invasive.h @@ -165,7 +165,7 @@ int mbedtls_ecp_mod_p521_raw(mbedtls_mpi_uint *X, size_t X_limbs); /** Fast quasi-reduction modulo p384 (FIPS 186-3 D.2.4) * * \param[in,out] X The address of the MPI to be converted. - * Must have exact limb size of `(766 / biL) + 1`. + * Must have exact limb size of `768 / biL`. * Upon return holds the reduced value which is * in range `0 <= X < 2 * N` (where N is the modulus). * The bitlength of the reduced value is the same as diff --git a/scripts/mbedtls_dev/ecp.py b/scripts/mbedtls_dev/ecp.py index 6d3bb0536b..10fcc5e475 100644 --- a/scripts/mbedtls_dev/ecp.py +++ b/scripts/mbedtls_dev/ecp.py @@ -144,12 +144,13 @@ class EcpP224R1Raw(bignum_common.ModOperationCommon, def is_valid(self) -> bool: return True -class EcpPp384R1Raw(bignum_common.ModOperationCommon, - EcpTarget): + +class EcpP384R1Raw(bignum_common.ModOperationCommon, + EcpTarget): """Test cases for ecp quasi_reduction modulo p384.""" test_function = "ecp_mod_p384_raw" test_name = "ecp_mod_p384_raw" - input_style = "arch_split" + input_style = "fixed" arity = 1 moduli = [("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" @@ -164,7 +165,7 @@ class EcpPp384R1Raw(bignum_common.ModOperationCommon, "fffffff0000000000000000fffffffe"), # Maximum canonical P384 multiplication result - ("0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" + ("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" "fdfffffffe0000000000000001fffffffc0000000000000000000000000000000" "10000000200000000fffffffe000000020000000400000000fffffffc00000004"), @@ -178,6 +179,16 @@ class EcpPp384R1Raw(bignum_common.ModOperationCommon, "b68abef41dbd35183a0614fb7222606ffffffff84396eee542f18a9189d94396c" "784059c17a9f18f807214ef32f2f10ffffffff8a77fac20000000000000000"), + # Testing with overflow in A(23) + A(20) + A(19) - A(22); + ("783753f8a5afba6c1862eead1deb2fcdd907272be3ffd18542b24a71ee8b26ca" + "b0aa33513610ff973042bbe1637cc9fc99ad36c7f703514572cf4f5c3044469a" + "8f5be6312c19e5d3f8fc1ac6ffffffffffffffff8c86252400000000ffffffff"), + + # Testing with underflow in A(23) + A(20) + A(19) - A(22); + ("65e1d2362fce922663b7fd517586e88842a9b4bd092e93e6251c9c69f278cbf8" + "285d99ae3b53da5ba36e56701e2b17c225f1239556c5f00117fa140218b46ebd8" + "e34f50d0018701fa8a0a5cc00000000000000004410bcb4ffffffff00000000"), + # First 8 number generated by random.getrandbits(768) - seed(2,2) ("ffed9235288bc781ae66267594c9c9500925e4749b575bd13653f8dd9b1f282e" "4067c3584ee207f8da94e3e8ab73738fcf1822ffbc6887782b491044d5e34124" @@ -213,9 +224,7 @@ class EcpPp384R1Raw(bignum_common.ModOperationCommon, @property def arg_a(self) -> str: - hex_digits = bignum_common.hex_digits_for_limb((766 // self.bits_in_limb) + 1, - self.bits_in_limb) - return super().format_arg('{:x}'.format(self.int_a)).zfill(hex_digits) + return super().format_arg('{:x}'.format(self.int_a)).zfill(2 * self.hex_digits) def result(self) -> List[str]: result = self.int_a % self.int_n diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function index 440a1e30d6..78aca8a1c8 100644 --- a/tests/suites/test_suite_ecp.function +++ b/tests/suites/test_suite_ecp.function @@ -1452,7 +1452,7 @@ void ecp_mod_p384_raw(char *input_N, size_t limbs = limbs_N; size_t bytes = limbs * sizeof(mbedtls_mpi_uint); - TEST_EQUAL(limbs_X, (766 / biL) + 1); + TEST_EQUAL(limbs_X, 2 * limbs); TEST_EQUAL(limbs_res, limbs); TEST_EQUAL(mbedtls_mpi_mod_modulus_setup( From 4af90bbcdae46a3698132653b6263d481a7aaee9 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 20 Mar 2023 12:20:46 +0000 Subject: [PATCH 5/7] EcpP384R1Raw: Added test case for 2nd round of carry reduction. Signed-off-by: Minos Galanakis --- scripts/mbedtls_dev/ecp.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/scripts/mbedtls_dev/ecp.py b/scripts/mbedtls_dev/ecp.py index 10fcc5e475..aee8718316 100644 --- a/scripts/mbedtls_dev/ecp.py +++ b/scripts/mbedtls_dev/ecp.py @@ -189,6 +189,11 @@ class EcpP384R1Raw(bignum_common.ModOperationCommon, "285d99ae3b53da5ba36e56701e2b17c225f1239556c5f00117fa140218b46ebd8" "e34f50d0018701fa8a0a5cc00000000000000004410bcb4ffffffff00000000"), + # Testing the second round of carry reduction + ("000000000000000000000000ffffffffffffffffffffffffffffffffffffffff" + "ffffffffffffffff00000000000000000000000000000000ffffffff00000000" + "000000000000000100000000000000000000000000000000ffffffff00000001"), + # First 8 number generated by random.getrandbits(768) - seed(2,2) ("ffed9235288bc781ae66267594c9c9500925e4749b575bd13653f8dd9b1f282e" "4067c3584ee207f8da94e3e8ab73738fcf1822ffbc6887782b491044d5e34124" From 68d64a10b6d4e734b5844a92704059cb3af4f7ee Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Wed, 22 Mar 2023 11:28:15 +0000 Subject: [PATCH 6/7] ecp_curves: Re-introduced `mbedtls_ecp_fix_negative()` This patch re-introduces `mbedtls_ecp_fix_negative` and appropriately adjusts its' define guards. Signed-off-by: Minos Galanakis --- library/ecp_curves.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/library/ecp_curves.c b/library/ecp_curves.c index c23ff2c7e4..6ee3d6c538 100644 --- a/library/ecp_curves.c +++ b/library/ecp_curves.c @@ -5299,6 +5299,39 @@ int mbedtls_ecp_mod_p384_raw(mbedtls_mpi_uint *X, size_t X_limbs) MBEDTLS_ECP_DP_SECP256R1_ENABLED || MBEDTLS_ECP_DP_SECP384R1_ENABLED */ +#if defined(MBEDTLS_TEST_HOOKS) && defined(MBEDTLS_ECP_C) +MBEDTLS_STATIC_TESTABLE +void mbedtls_ecp_fix_negative(mbedtls_mpi *N, signed char c, size_t bits) +{ + size_t i; + + /* Set N := 2^bits - 1 - N. We know that 0 <= N < 2^bits, so + * set the absolute value to 0xfff...fff - N. There is no carry + * since we're subtracting from all-bits-one. */ + for (i = 0; i <= bits / 8 / sizeof(mbedtls_mpi_uint); i++) { + N->p[i] = ~(mbedtls_mpi_uint) 0 - N->p[i]; + } + /* Add 1, taking care of the carry. */ + i = 0; + do { + ++N->p[i]; + } while (N->p[i++] == 0 && i <= bits / 8 / sizeof(mbedtls_mpi_uint)); + /* Invert the sign. + * Now N = N0 - 2^bits where N0 is the initial value of N. */ + N->s = -1; + + /* Add |c| * 2^bits to the absolute value. Since c and N are + * negative, this adds c * 2^bits. */ + mbedtls_mpi_uint msw = (mbedtls_mpi_uint) -c; +#if defined(MBEDTLS_HAVE_INT64) + if (bits == 224) { + msw <<= 32; + } +#endif + N->p[bits / 8 / sizeof(mbedtls_mpi_uint)] += msw; +} +#endif /* MBEDTLS_TEST_HOOKS & MBEDTLS_ECP_C */ + #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) /* Size of p521 in terms of mbedtls_mpi_uint */ #define P521_WIDTH (521 / 8 / sizeof(mbedtls_mpi_uint) + 1) From f9fca53cb44f3e75d9a0889541719257297c9d9a Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 23 Mar 2023 10:36:53 +0000 Subject: [PATCH 7/7] ecp_curves: Updated ecp_mod_p384_raw documentation Signed-off-by: Minos Galanakis --- library/ecp_invasive.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/library/ecp_invasive.h b/library/ecp_invasive.h index d2ac20ac4c..05522b6a52 100644 --- a/library/ecp_invasive.h +++ b/library/ecp_invasive.h @@ -165,7 +165,8 @@ int mbedtls_ecp_mod_p521_raw(mbedtls_mpi_uint *X, size_t X_limbs); /** Fast quasi-reduction modulo p384 (FIPS 186-3 D.2.4) * * \param[in,out] X The address of the MPI to be converted. - * Must have exact limb size of `768 / biL`. + * Must have exact limb size that stores a 768-bit MPI + * (double the bitlength of the modulus). * Upon return holds the reduced value which is * in range `0 <= X < 2 * N` (where N is the modulus). * The bitlength of the reduced value is the same as