ECDSA verification: Use wNAF-based multiplication for non-nistz256 implementations

Cargo.toml

@@ -71,6 +71,7 @@ include = [
  "crypto/fipsmodule/ec/ecp_nistz.h",
  "crypto/fipsmodule/ec/ecp_nistz384.h",
  "crypto/fipsmodule/ec/ecp_nistz384.inl",
+ "crypto/fipsmodule/ec/internal.h",
  "crypto/fipsmodule/ec/gfp_p256.c",
  "crypto/fipsmodule/ec/gfp_p384.c",
  "crypto/fipsmodule/ec/p256.c",
@@ -80,6 +81,7 @@ include = [
  "crypto/fipsmodule/ec/p256_shared.h",
  "crypto/fipsmodule/ec/p256_table.h",
  "crypto/fipsmodule/ec/util.h",
+ "crypto/fipsmodule/ec/wnaf.c",
  "crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt",
  "crypto/fipsmodule/modes/asm/aesni-gcm-x86_64.pl",
  "crypto/fipsmodule/modes/asm/ghash-armv4.pl",

build.rs

@@ -42,6 +42,7 @@ const RING_SRCS: &[(&[&str], &str)] = &[
  (&[], "crypto/fipsmodule/ec/gfp_p256.c"),
  (&[], "crypto/fipsmodule/ec/gfp_p384.c"),
  (&[], "crypto/fipsmodule/ec/p256.c"),
+ (&[], "crypto/fipsmodule/ec/wnaf.c"),
  (&[], "crypto/limbs/limbs.c"),
  (&[], "crypto/mem.c"),
  (&[], "crypto/poly1305/poly1305.c"),
@@ -903,6 +904,7 @@ fn prefix_all_symbols(pp: char, prefix_prefix: &str, prefix: &str) -> String {
  "LIMBS_reduce_once",
  "LIMBS_select_512_32",
  "LIMBS_shl_mod",
+ "LIMBS_sub_from_assign",
  "LIMBS_sub_mod",
  "LIMBS_window5_split_window",
  "LIMBS_window5_unsplit_window",
@@ -933,6 +935,7 @@ fn prefix_all_symbols(pp: char, prefix_prefix: &str, prefix: &str) -> String {
  "bssl_constant_time_test_main",
  "chacha20_poly1305_open",
  "chacha20_poly1305_seal",
+ "ec_compute_wNAF",
  "fiat_curve25519_adx_mul",
  "fiat_curve25519_adx_square",
  "gcm_ghash_avx",

crypto/fipsmodule/ec/wnaf.c

@@ -0,0 +1,144 @@
+/* Originally written by Bodo Moeller for the OpenSSL project.
+ * ====================================================================
+ * Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ * software must display the following acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ * endorse or promote products derived from this software without
+ * prior written permission. For written permission, please contact
+ * [email protected].
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ * nor may "OpenSSL" appear in their names without prior written
+ * permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ * acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * ([email protected]). This product includes software written by Tim
+ * Hudson ([email protected]).
+ *
+ */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ *
+ * Portions of the attached software ("Contribution") are developed by
+ * SUN MICROSYSTEMS, INC., and are contributed to the OpenSSL project.
+ *
+ * The Contribution is licensed pursuant to the OpenSSL open source
+ * license provided above.
+ *
+ * The elliptic curve binary polynomial software is originally written by
+ * Sheueling Chang Shantz and Douglas Stebila of Sun Microsystems
+ * Laboratories. */
+
+#include "../bn/internal.h"
+#include "../../internal.h"
+#include "../../limbs/limbs.h"
+
+static int is_bit_set(const Limb limbs[], size_t num_limbs, size_t bit) {
+ size_t i = bit / LIMB_BITS;
+ if (i >= num_limbs) {
+ return 0;
+ }
+ size_t shift = bit % LIMB_BITS;
+ return (limbs[i] >> shift) & 1;
+}
+
+// This file implements the wNAF-based interleaving multi-exponentiation method
+// at:
+// http://link.springer.com/chapter/10.1007%2F3-540-45537-X_13
+// http://www.bmoeller.de/pdf/TI-01-08.multiexp.pdf
+
+void ec_compute_wNAF(int8_t *out, const Limb scalar[], size_t scalar_limbs, size_t bits, int w) {
+ // 'int8_t' can represent integers with absolute values less than 2^7.
+ debug_assert_nonsecret(0 < w && w <= 7);
+ debug_assert_nonsecret(bits != 0);
+ int bit = 1 << w; // 2^w, at most 128
+ int next_bit = bit << 1; // 2^(w+1), at most 256
+ int mask = next_bit - 1; // at most 255
+
+ int window_val = ((int)scalar[0]) & mask;
+ for (size_t j = 0; j < bits + 1; j++) {
+ debug_assert_nonsecret(0 <= window_val && window_val <= next_bit);
+ int digit = 0;
+ if (window_val & 1) {
+ debug_assert_nonsecret(0 < window_val && window_val < next_bit);
+ if (window_val & bit) {
+ digit = window_val - next_bit;
+ // We know -next_bit < digit < 0 and window_val - digit = next_bit.
+
+ // modified wNAF
+ if (j + ((size_t)w) + 1 >= bits) {
+ // special case for generating modified wNAFs:
+ // no new bits will be added into window_val,
+ // so using a positive digit here will decrease
+ // the total length of the representation
+
+ digit = window_val & (mask >> 1);
+ // We know 0 < digit < bit and window_val - digit = bit.
+ }
+ } else {
+ digit = window_val;
+ // We know 0 < digit < bit and window_val - digit = 0.
+ }
+
+ window_val -= digit;
+
+ // Now window_val is 0 or 2^(w+1) in standard wNAF generation.
+ // For modified window NAFs, it may also be 2^w.
+ //
+ // See the comments above for the derivation of each of these bounds.
+ debug_assert_nonsecret(window_val == 0 || window_val == next_bit || window_val == bit);
+ debug_assert_nonsecret(-bit < digit && digit < bit);
+
+ // window_val was odd, so digit is also odd.
+ debug_assert_nonsecret(digit & 1);
+ }
+
+ out[j] = (int8_t)digit;
+
+ // Incorporate the next bit. Previously, |window_val| <= |next_bit|, so if
+ // we shift and add at most one copy of |bit|, this will continue to hold
+ // afterwards.
+ window_val >>= 1;
+ window_val += bit * is_bit_set(scalar, scalar_limbs, j + (size_t)w + 1);
+ debug_assert_nonsecret(window_val <= next_bit);
+ }
+
+ // bits + 1 entries should be sufficient to consume all bits.
+ debug_assert_nonsecret(window_val == 0);
+}

crypto/limbs/limbs.c

@@ -122,6 +122,11 @@ void LIMBS_add_mod(Limb r[], const Limb a[], const Limb b[], const Limb m[],
  }
 }
 
+// r := a - r.
+void LIMBS_sub_from_assign(Limb r[], const Limb a[], size_t num_limbs) {
+ (void)limbs_sub(r, a, r, num_limbs);
+}
+
 void LIMBS_sub_mod(Limb r[], const Limb a[], const Limb b[], const Limb m[],
  size_t num_limbs) {
  Limb underflow =

src/bits.rs

@@ -49,7 +49,7 @@ impl BitLength {
 
  /// The number of bits this bit length represents, as a `usize`.
  #[inline]
- pub fn as_usize_bits(&self) -> usize {
+ pub const fn as_usize_bits(&self) -> usize {
  self.0
  }