You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

390 lines
12 KiB

  1. /*
  2. conversions
  3. */
  4. static void
  5. ge25519_p1p1_to_partial(ge25519 *r, const ge25519_p1p1 *p) {
  6. packed64bignum25519 ALIGN(16) xz, tt, xzout;
  7. curve25519_mul(r->y, p->y, p->z);
  8. curve25519_tangle64(xz, p->x, p->z);
  9. curve25519_tangleone64(tt, p->t);
  10. curve25519_mul_packed64(xzout, xz, tt);
  11. curve25519_untangle64(r->x, r->z, xzout);
  12. }
  13. static void
  14. ge25519_p1p1_to_full(ge25519 *r, const ge25519_p1p1 *p) {
  15. packed64bignum25519 ALIGN(16) zy, xt, xx, zz, ty;
  16. curve25519_tangle64(ty, p->t, p->y);
  17. curve25519_tangleone64(xx, p->x);
  18. curve25519_mul_packed64(xt, xx, ty);
  19. curve25519_untangle64(r->x, r->t, xt);
  20. curve25519_tangleone64(zz, p->z);
  21. curve25519_mul_packed64(zy, zz, ty);
  22. curve25519_untangle64(r->z, r->y, zy);
  23. }
  24. static void
  25. ge25519_full_to_pniels(ge25519_pniels *p, const ge25519 *r) {
  26. curve25519_sub(p->ysubx, r->y, r->x);
  27. curve25519_add(p->xaddy, r->x, r->y);
  28. curve25519_copy(p->z, r->z);
  29. curve25519_mul(p->t2d, r->t, ge25519_ec2d);
  30. }
  31. /*
  32. adding & doubling
  33. */
  34. static void
  35. ge25519_add_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519 *q) {
  36. bignum25519 ALIGN(16) a,b,c,d;
  37. packed32bignum25519 ALIGN(16) xx, yy, yypxx, yymxx, bd, ac, bdmac, bdpac;
  38. packed64bignum25519 ALIGN(16) at, bu, atbu, ptz, qtz, cd;
  39. curve25519_tangle32(yy, p->y, q->y);
  40. curve25519_tangle32(xx, p->x, q->x);
  41. curve25519_add_packed32(yypxx, yy, xx);
  42. curve25519_sub_packed32(yymxx, yy, xx);
  43. curve25519_tangle64_from32(at, bu, yymxx, yypxx);
  44. curve25519_mul_packed64(atbu, at, bu);
  45. curve25519_untangle64(a, b, atbu);
  46. curve25519_tangle64(ptz, p->t, p->z);
  47. curve25519_tangle64(qtz, q->t, q->z);
  48. curve25519_mul_packed64(cd, ptz, qtz);
  49. curve25519_untangle64(c, d, cd);
  50. curve25519_mul(c, c, ge25519_ec2d);
  51. curve25519_add_reduce(d, d, d);
  52. /* reduce, so no after_basic is needed later */
  53. curve25519_tangle32(bd, b, d);
  54. curve25519_tangle32(ac, a, c);
  55. curve25519_sub_packed32(bdmac, bd, ac);
  56. curve25519_add_packed32(bdpac, bd, ac);
  57. curve25519_untangle32(r->x, r->t, bdmac);
  58. curve25519_untangle32(r->y, r->z, bdpac);
  59. }
  60. static void
  61. ge25519_double_p1p1(ge25519_p1p1 *r, const ge25519 *p) {
  62. bignum25519 ALIGN(16) a,b,c,x;
  63. packed64bignum25519 ALIGN(16) xy, zx, ab, cx;
  64. packed32bignum25519 ALIGN(16) xc, yz, xt, yc, ac, bc;
  65. curve25519_add(x, p->x, p->y);
  66. curve25519_tangle64(xy, p->x, p->y);
  67. curve25519_square_packed64(ab, xy);
  68. curve25519_untangle64(a, b, ab);
  69. curve25519_tangle64(zx, p->z, x);
  70. curve25519_square_packed64(cx, zx);
  71. curve25519_untangle64(c, x, cx);
  72. curve25519_tangle32(bc, b, c);
  73. curve25519_tangle32(ac, a, c);
  74. curve25519_add_reduce_packed32(yc, bc, ac);
  75. curve25519_untangle32(r->y, c, yc);
  76. curve25519_sub(r->z, b, a);
  77. curve25519_tangle32(yz, r->y, r->z);
  78. curve25519_tangle32(xc, x, c);
  79. curve25519_sub_after_basic_packed32(xt, xc, yz);
  80. curve25519_untangle32(r->x, r->t, xt);
  81. }
  82. static void
  83. ge25519_nielsadd2_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519_niels *q, unsigned char signbit) {
  84. const bignum25519 *qb = (const bignum25519 *)q;
  85. bignum25519 *rb = (bignum25519 *)r;
  86. bignum25519 ALIGN(16) a,b,c;
  87. packed64bignum25519 ALIGN(16) ab, yx, aybx;
  88. packed32bignum25519 ALIGN(16) bd, ac, bdac;
  89. curve25519_sub(a, p->y, p->x);
  90. curve25519_add(b, p->y, p->x);
  91. curve25519_tangle64(ab, a, b);
  92. curve25519_tangle64(yx, qb[signbit], qb[signbit^1]);
  93. curve25519_mul_packed64(aybx, ab, yx);
  94. curve25519_untangle64(a, b, aybx);
  95. curve25519_add(r->y, b, a);
  96. curve25519_add_reduce(r->t, p->z, p->z);
  97. curve25519_mul(c, p->t, q->t2d);
  98. curve25519_copy(r->z, r->t);
  99. curve25519_add(rb[2+signbit], rb[2+signbit], c);
  100. curve25519_tangle32(bd, b, rb[2+(signbit^1)]);
  101. curve25519_tangle32(ac, a, c);
  102. curve25519_sub_packed32(bdac, bd, ac);
  103. curve25519_untangle32(r->x, rb[2+(signbit^1)], bdac);
  104. }
  105. static void
  106. ge25519_pnielsadd_p1p1(ge25519_p1p1 *r, const ge25519 *p, const ge25519_pniels *q, unsigned char signbit) {
  107. const bignum25519 *qb = (const bignum25519 *)q;
  108. bignum25519 *rb = (bignum25519 *)r;
  109. bignum25519 ALIGN(16) a,b,c;
  110. packed64bignum25519 ALIGN(16) ab, yx, aybx, zt, zt2d, tc;
  111. packed32bignum25519 ALIGN(16) bd, ac, bdac;
  112. curve25519_sub(a, p->y, p->x);
  113. curve25519_add(b, p->y, p->x);
  114. curve25519_tangle64(ab, a, b);
  115. curve25519_tangle64(yx, qb[signbit], qb[signbit^1]);
  116. curve25519_mul_packed64(aybx, ab, yx);
  117. curve25519_untangle64(a, b, aybx);
  118. curve25519_add(r->y, b, a);
  119. curve25519_tangle64(zt, p->z, p->t);
  120. curve25519_tangle64(zt2d, q->z, q->t2d);
  121. curve25519_mul_packed64(tc, zt, zt2d);
  122. curve25519_untangle64(r->t, c, tc);
  123. curve25519_add_reduce(r->t, r->t, r->t);
  124. curve25519_copy(r->z, r->t);
  125. curve25519_add(rb[2+signbit], rb[2+signbit], c);
  126. curve25519_tangle32(bd, b, rb[2+(signbit^1)]);
  127. curve25519_tangle32(ac, a, c);
  128. curve25519_sub_packed32(bdac, bd, ac);
  129. curve25519_untangle32(r->x, rb[2+(signbit^1)], bdac);
  130. }
  131. static void
  132. ge25519_double(ge25519 *r, const ge25519 *p) {
  133. ge25519_p1p1 ALIGN(16) t;
  134. ge25519_double_p1p1(&t, p);
  135. ge25519_p1p1_to_full(r, &t);
  136. }
  137. static void
  138. ge25519_add(ge25519 *r, const ge25519 *p, const ge25519 *q) {
  139. ge25519_p1p1 ALIGN(16) t;
  140. ge25519_add_p1p1(&t, p, q);
  141. ge25519_p1p1_to_full(r, &t);
  142. }
  143. static void
  144. ge25519_double_partial(ge25519 *r, const ge25519 *p) {
  145. ge25519_p1p1 ALIGN(16) t;
  146. ge25519_double_p1p1(&t, p);
  147. ge25519_p1p1_to_partial(r, &t);
  148. }
  149. static void
  150. ge25519_nielsadd2(ge25519 *r, const ge25519_niels *q) {
  151. packed64bignum25519 ALIGN(16) ab, yx, aybx, eg, ff, hh, xz, ty;
  152. packed32bignum25519 ALIGN(16) bd, ac, bdac;
  153. bignum25519 ALIGN(16) a,b,c,d,e,f,g,h;
  154. curve25519_sub(a, r->y, r->x);
  155. curve25519_add(b, r->y, r->x);
  156. curve25519_tangle64(ab, a, b);
  157. curve25519_tangle64(yx, q->ysubx, q->xaddy);
  158. curve25519_mul_packed64(aybx, ab, yx);
  159. curve25519_untangle64(a, b, aybx);
  160. curve25519_add(h, b, a);
  161. curve25519_add_reduce(d, r->z, r->z);
  162. curve25519_mul(c, r->t, q->t2d);
  163. curve25519_add(g, d, c); /* d is reduced, so no need for after_basic */
  164. curve25519_tangle32(bd, b, d);
  165. curve25519_tangle32(ac, a, c);
  166. curve25519_sub_packed32(bdac, bd, ac); /* d is reduced, so no need for after_basic */
  167. curve25519_untangle32(e, f, bdac);
  168. curve25519_tangle64(eg, e, g);
  169. curve25519_tangleone64(ff, f);
  170. curve25519_mul_packed64(xz, eg, ff);
  171. curve25519_untangle64(r->x, r->z, xz);
  172. curve25519_tangleone64(hh, h);
  173. curve25519_mul_packed64(ty, eg, hh);
  174. curve25519_untangle64(r->t, r->y, ty);
  175. }
  176. static void
  177. ge25519_pnielsadd(ge25519_pniels *r, const ge25519 *p, const ge25519_pniels *q) {
  178. ge25519_p1p1 ALIGN(16) t;
  179. ge25519 ALIGN(16) f;
  180. ge25519_pnielsadd_p1p1(&t, p, q, 0);
  181. ge25519_p1p1_to_full(&f, &t);
  182. ge25519_full_to_pniels(r, &f);
  183. }
  184. /*
  185. pack & unpack
  186. */
  187. static void
  188. ge25519_pack(unsigned char r[32], const ge25519 *p) {
  189. bignum25519 ALIGN(16) tx, ty, zi;
  190. unsigned char parity[32];
  191. curve25519_recip(zi, p->z);
  192. curve25519_mul(tx, p->x, zi);
  193. curve25519_mul(ty, p->y, zi);
  194. curve25519_contract(r, ty);
  195. curve25519_contract(parity, tx);
  196. r[31] ^= ((parity[0] & 1) << 7);
  197. }
  198. static int
  199. ge25519_unpack_negative_vartime(ge25519 *r, const unsigned char p[32]) {
  200. static const bignum25519 ALIGN(16) one = {1};
  201. static const unsigned char zero[32] = {0};
  202. unsigned char parity = p[31] >> 7;
  203. unsigned char check[32];
  204. bignum25519 ALIGN(16) t, root, num, den, d3;
  205. curve25519_expand(r->y, p);
  206. curve25519_copy(r->z, one);
  207. curve25519_square_times(num, r->y, 1); /* x = y^2 */
  208. curve25519_mul(den, num, ge25519_ecd); /* den = dy^2 */
  209. curve25519_sub_reduce(num, num, r->z); /* x = y^2 - 1 */
  210. curve25519_add(den, den, r->z); /* den = dy^2 + 1 */
  211. /* Computation of sqrt(num/den) */
  212. /* 1.: computation of num^((p-5)/8)*den^((7p-35)/8) = (num*den^7)^((p-5)/8) */
  213. curve25519_square_times(t, den, 1);
  214. curve25519_mul(d3, t, den);
  215. curve25519_square_times(r->x, d3, 1);
  216. curve25519_mul(r->x, r->x, den);
  217. curve25519_mul(r->x, r->x, num);
  218. curve25519_pow_two252m3(r->x, r->x);
  219. /* 2. computation of r->x = t * num * den^3 */
  220. curve25519_mul(r->x, r->x, d3);
  221. curve25519_mul(r->x, r->x, num);
  222. /* 3. Check if either of the roots works: */
  223. curve25519_square_times(t, r->x, 1);
  224. curve25519_mul(t, t, den);
  225. curve25519_copy(root, t);
  226. curve25519_sub_reduce(root, root, num);
  227. curve25519_contract(check, root);
  228. if (!ed25519_verify(check, zero, 32)) {
  229. curve25519_add_reduce(t, t, num);
  230. curve25519_contract(check, t);
  231. if (!ed25519_verify(check, zero, 32))
  232. return 0;
  233. curve25519_mul(r->x, r->x, ge25519_sqrtneg1);
  234. }
  235. curve25519_contract(check, r->x);
  236. if ((check[0] & 1) == parity) {
  237. curve25519_copy(t, r->x);
  238. curve25519_neg(r->x, t);
  239. }
  240. curve25519_mul(r->t, r->x, r->y);
  241. return 1;
  242. }
  243. /*
  244. scalarmults
  245. */
  246. #define S1_SWINDOWSIZE 5
  247. #define S1_TABLE_SIZE (1<<(S1_SWINDOWSIZE-2))
  248. #define S2_SWINDOWSIZE 7
  249. #define S2_TABLE_SIZE (1<<(S2_SWINDOWSIZE-2))
  250. static void
  251. ge25519_double_scalarmult_vartime(ge25519 *r, const ge25519 *p1, const bignum256modm s1, const bignum256modm s2) {
  252. signed char slide1[256], slide2[256];
  253. ge25519_pniels ALIGN(16) pre1[S1_TABLE_SIZE];
  254. ge25519 ALIGN(16) d1;
  255. ge25519_p1p1 ALIGN(16) t;
  256. int32_t i;
  257. contract256_slidingwindow_modm(slide1, s1, S1_SWINDOWSIZE);
  258. contract256_slidingwindow_modm(slide2, s2, S2_SWINDOWSIZE);
  259. ge25519_double(&d1, p1);
  260. ge25519_full_to_pniels(pre1, p1);
  261. for (i = 0; i < S1_TABLE_SIZE - 1; i++)
  262. ge25519_pnielsadd(&pre1[i+1], &d1, &pre1[i]);
  263. /* set neutral */
  264. memset(r, 0, sizeof(ge25519));
  265. r->y[0] = 1;
  266. r->z[0] = 1;
  267. i = 255;
  268. while ((i >= 0) && !(slide1[i] | slide2[i]))
  269. i--;
  270. for (; i >= 0; i--) {
  271. ge25519_double_p1p1(&t, r);
  272. if (slide1[i]) {
  273. ge25519_p1p1_to_full(r, &t);
  274. ge25519_pnielsadd_p1p1(&t, r, &pre1[abs(slide1[i]) / 2], (unsigned char)slide1[i] >> 7);
  275. }
  276. if (slide2[i]) {
  277. ge25519_p1p1_to_full(r, &t);
  278. ge25519_nielsadd2_p1p1(&t, r, &ge25519_niels_sliding_multiples[abs(slide2[i]) / 2], (unsigned char)slide2[i] >> 7);
  279. }
  280. ge25519_p1p1_to_partial(r, &t);
  281. }
  282. }
  283. #if !defined(HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS)
  284. static uint32_t
  285. ge25519_windowb_equal(uint32_t b, uint32_t c) {
  286. return ((b ^ c) - 1) >> 31;
  287. }
  288. static void
  289. ge25519_scalarmult_base_choose_niels(ge25519_niels *t, const uint8_t table[256][96], uint32_t pos, signed char b) {
  290. bignum25519 ALIGN(16) neg;
  291. uint32_t sign = (uint32_t)((unsigned char)b >> 7);
  292. uint32_t mask = ~(sign - 1);
  293. uint32_t u = (b + mask) ^ mask;
  294. uint32_t i;
  295. /* ysubx, xaddy, t2d in packed form. initialize to ysubx = 1, xaddy = 1, t2d = 0 */
  296. uint8_t ALIGN(16) packed[96] = {0};
  297. packed[0] = 1;
  298. packed[32] = 1;
  299. for (i = 0; i < 8; i++)
  300. curve25519_move_conditional_bytes(packed, table[(pos * 8) + i], ge25519_windowb_equal(u, i + 1));
  301. /* expand in to t */
  302. curve25519_expand(t->ysubx, packed + 0);
  303. curve25519_expand(t->xaddy, packed + 32);
  304. curve25519_expand(t->t2d , packed + 64);
  305. /* adjust for sign */
  306. curve25519_swap_conditional(t->ysubx, t->xaddy, sign);
  307. curve25519_neg(neg, t->t2d);
  308. curve25519_swap_conditional(t->t2d, neg, sign);
  309. }
  310. #endif /* HAVE_GE25519_SCALARMULT_BASE_CHOOSE_NIELS */
  311. static void
  312. ge25519_scalarmult_base_niels(ge25519 *r, const uint8_t table[256][96], const bignum256modm s) {
  313. signed char b[64];
  314. uint32_t i;
  315. ge25519_niels ALIGN(16) t;
  316. contract256_window4_modm(b, s);
  317. ge25519_scalarmult_base_choose_niels(&t, table, 0, b[1]);
  318. curve25519_sub_reduce(r->x, t.xaddy, t.ysubx);
  319. curve25519_add_reduce(r->y, t.xaddy, t.ysubx);
  320. memset(r->z, 0, sizeof(bignum25519));
  321. r->z[0] = 2;
  322. curve25519_copy(r->t, t.t2d);
  323. for (i = 3; i < 64; i += 2) {
  324. ge25519_scalarmult_base_choose_niels(&t, table, i / 2, b[i]);
  325. ge25519_nielsadd2(r, &t);
  326. }
  327. ge25519_double_partial(r, r);
  328. ge25519_double_partial(r, r);
  329. ge25519_double_partial(r, r);
  330. ge25519_double(r, r);
  331. ge25519_scalarmult_base_choose_niels(&t, table, 0, b[0]);
  332. curve25519_mul(t.t2d, t.t2d, ge25519_ecd);
  333. ge25519_nielsadd2(r, &t);
  334. for(i = 2; i < 64; i += 2) {
  335. ge25519_scalarmult_base_choose_niels(&t, table, i / 2, b[i]);
  336. ge25519_nielsadd2(r, &t);
  337. }
  338. }