Commit graph

213 commits

Author SHA1 Message Date
Paul Elliott
4fa8334bae Convert curve 448 to use ecp core functions
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2023-05-16 17:51:48 +01:00
Gabor Mezei
caac83c517
Fix comment
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-16 17:41:26 +02:00
Gabor Mezei
03558b847e
Add _raw function to P256K1
Modified the testing to use the generic fast reduction test function.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-16 17:30:03 +02:00
Gabor Mezei
e42bb6294e
Add _raw function to P224K1
Modified the testing to use the generic fast reduction test function.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-16 17:30:03 +02:00
Gabor Mezei
dacfe56370
Add _raw function to P192K1
Modified the testing to use the generic fast reduction test function.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-16 17:29:57 +02:00
Gabor Mezei
a274041190
Fix comment
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-15 14:50:17 +02:00
Gabor Mezei
b6653f3e27
Update comments
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-12 12:34:12 +02:00
Gabor Mezei
dcaf99ebb8
Add another round in the Koblitz reduction
The addition can result in an overflow so another round is needed
in the reduction.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-12 12:34:05 +02:00
Paul Elliott
481a6a8edb
Merge pull request #7482 from gabor-mezei-arm/6029_use_core_api_in_ecp_mod_koblitz
[Bignum] Use core API in ecp_mod_koblitz()
2023-05-10 17:24:46 +01:00
Gabor Mezei
908f40014c
Determine special cases in-place in the common Koblitz function
Remove parameter used by the special cases and check for special cases in-place.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-05-05 16:31:19 +02:00
Paul Elliott
47a3c82118 Enable curve 448 to be tested
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2023-04-26 22:23:13 +01:00
Gabor Mezei
19c6f47dbc
Allocate the right amount of memory
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 15:22:11 +02:00
Gabor Mezei
fead53311b
Remove unused macro
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 15:20:01 +02:00
Gabor Mezei
03367fe42d
Ignore carry since it can not be generated
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 14:08:45 +02:00
Gabor Mezei
d2c0ba172c
Fix value in comment
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 14:08:44 +02:00
Gabor Mezei
7097447b84
Ensure input parameter size for Koblitz reduction
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 14:08:35 +02:00
Gabor Mezei
8183c5dcc3
Use core API in ecp_mod_koblitz()
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-26 14:03:29 +02:00
Janos Follath
91a618375a
Merge pull request #7427 from minosgalanakis/ecp/7258_ecp_mod_p256K1_add_test_cases
ECP: Add Unit Tests for secp256k1
2023-04-26 08:52:24 +01:00
Minos Galanakis
9c2c81f996 ecp_curves: Renamed ecp_mod_p256k1 -> mbedtls_ecp_mod_p256k1
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-04-25 13:30:59 +01:00
Minos Galanakis
d6751dcd8b ecp_curves: Added unit-tests for secp256k1
This patch introduces basic unit-testing for the `ecp_mod_p256k1()`.

The method is exposed through the ecp_invasive interface, and
the standard testing data is being provided by the python framework.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-04-25 13:30:59 +01:00
Gabor Mezei
f921f4d228
Use loop for two passes in the reduction
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-21 14:09:06 +02:00
Minos Galanakis
9d80879f90 ecp_curves: Introduced mbedtls_ecp_mod_p224k1()
This patch introduces a `MBEDTLS_STATIC_TESTABLE` helper
method which exposes `ecp_mod_p256k1()` to the test-framework

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-04-18 14:13:20 +01:00
Minos Galanakis
e5dab975c6 ecp_curves: Added unit-tests for secp224k1
This patch introduces basic unit-testing for the `ecp_mod_p224k1()`.

The method is exposed through the ecp_invasive interface, and
the standard testing data is being provided by the python framework.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-04-18 14:13:20 +01:00
Janos Follath
3c3b94a31b
Merge pull request #7424 from gabor-mezei-arm/7256_unit_tests_for_p192k1
Add unit tests for ecp_mod_p192k1()
2023-04-18 12:19:40 +01:00
Gabor Mezei
0a11ee6da8
Fix function declaration
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-13 12:48:06 +02:00
Gabor Mezei
83669d910e
Add a testable function for ecp_mod_p192k1
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-04-13 12:44:37 +02:00
Valerio Setti
d4a5d461de library: add remaining changes for the new ECP_LIGHT symbol
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-04-11 11:33:50 +02:00
Janos Follath
44c6694be7
Merge pull request #7351 from gabor-mezei-arm/7109_ecp_fast_reduction_testing
Test unlikely cases of ECC modular reduction
2023-04-06 15:55:19 +01:00
Gabor Mezei
df9c029dd5
Remove obsolete ecp_fix_negative function
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-28 18:43:07 +02:00
Gabor Mezei
514806bbe9
Add a second round of carry reduction for P192 fast reduction
The first round of carry reduction can generate a carry so a
second round is needed.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-28 15:09:34 +02:00
Minos Galanakis
68d64a10b6 ecp_curves: Re-introduced mbedtls_ecp_fix_negative()
This patch re-introduces `mbedtls_ecp_fix_negative` and
appropriately adjusts its' define guards.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-03-22 11:28:15 +00:00
Minos Galanakis
37f4cb6d0e ecp_curves: Minor rework for p384
This patch adjusts formatting, documentation and testing.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-03-21 15:46:50 +00:00
Minos Galanakis
6fb105fb2e ecp_curves: Ported prototypes
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-03-21 15:41:26 +00:00
Janos Follath
c18cd0c8e6
Merge pull request #7230 from gabor-mezei-arm/6850_Secp256r1_fast_reduction
Extract Secp256r1 fast reduction from the prototype
2023-03-16 19:43:25 +00:00
Gabor Mezei
e4710ae9ed
Add and fix comments
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-09 13:43:02 +01:00
Gabor Mezei
716447ff32
Fix limb size calculation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-08 14:09:51 +01:00
Gabor Mezei
ed1acf642c
Apply naming conventions
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-08 14:09:50 +01:00
Gabor Mezei
5221c04b92
Change the p256_raw fuction to be testable
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-08 14:09:50 +01:00
Gabor Mezei
ab6ac91a0a
Extract Secp256r1 from the prototype
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-08 14:09:50 +01:00
Tom Cosgrove
5c8505f061 Fix typos
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2023-03-07 11:39:52 +00:00
Janos Follath
fe780a3c4b
Merge pull request #7184 from gabor-mezei-arm/6349_Secp224r1_fast_reduction
Extract Secp224r1 fast reduction from the prototype
2023-03-07 10:57:58 +00:00
Gabor Mezei
97803abd2a
Update comment
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-06 16:32:16 +01:00
Gabor Mezei
aeadc2d731
Apply naming convention
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-03-01 16:53:03 +01:00
Gabor Mezei
620f0dc850
Fix for 32-bit
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-28 18:42:33 +01:00
Gabor Mezei
08a94953e1
Apply naming convention for p224
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-28 18:40:57 +01:00
Gabor Mezei
5afb80e00a
Fix coding style issues
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-27 17:00:34 +01:00
Gabor Mezei
804cfd32ea
Follow the naming convention
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-27 16:50:09 +01:00
Gabor Mezei
bf506361c4
Revert the illustration and remove unnecessary code
This reverts commit 73e8553273.
Removes the second round of carry reduction from p224.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-27 16:37:32 +01:00
Gabor Mezei
73e8553273
Add comments to illustrate the second round of carry reduction is unnecessary
The first round of carry reduction can not generate a carry thus the
secound round is not needed. The comments illustrating when the
carry is 1. The reduction is simmetric so the case when the carry is
-1 is similar.
The illustration is trying to calculate the input value starting with
setting the carry to 1 before the second round of the carry reduction.
It calculates backwords and tries to determine the value range of
each word. It ends up with a contradiction that A10 must have the
value of 0 and UINT32_MAX.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-27 16:32:42 +01:00
Gabor Mezei
a835d20cde
Add documentation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-27 15:58:30 +01:00
Gabor Mezei
aef0f2de9f
Fix limb size calculation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-21 11:35:31 +01:00
Gabor Mezei
e14b5bdba7
Change the ecp_mod_p224_raw to be testable
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-21 11:35:26 +01:00
Gabor Mezei
66f88a9d22
Extract Secp224r1 from the prototype
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-21 11:32:29 +01:00
Minos Galanakis
a30afe2216 ecp_curves: Minor refactoring.
This patch introduces the following changes:
* Documentation for `mbedtls_ecp_modulus_setup()`
  moved to `ecp_invasive.h`.
* Added invalid modulus selector `MBEDTLS_ECP_MOD_NONE`.
* Adjusted negative tests to use invalid selectors.
* Reworded documentation.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-02-20 13:53:06 +00:00
Minos Galanakis
d2ca802329 ecp_curves: Added mbedtls_ecp_modulus_setup().
This patch introduces a new static method, responsible
for automatically initialising an modulus structure,
based on the curve id and a modulus type selector.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-02-20 13:49:46 +00:00
Gabor Mezei
ac70ad6576
Fix coding style
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-16 19:31:21 +01:00
Gabor Mezei
cf228706cd
Restrict input parameter size for ecp_mod_p521_raw
The imput mpi parameter must have twice as many limbs as the modulus.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:19:08 +01:00
Gabor Mezei
d10d429380
Stack usage optimization for mod_p521
Instead of creating an mpi on the stack, reuse the unused part of the input mpi.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:51 +01:00
Janos Follath
fe24e91a34
mod_p521: document reduction algorithm
Signed-off-by: Janos Follath <janos.follath@arm.com>
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:50 +01:00
Janos Follath
666673e83f
modp521: apply naming conventions
Apply the usual parameter name and align the local variables and
comments. This naming diverges from the standard notation, but this is
beneficial as our variable meanings diverge as well and the difference
can help avoiding confusion.

Signed-off-by: Janos Follath <janos.follath@arm.com>
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:50 +01:00
Janos Follath
13c3aa13af
Revert changes to mod_p521 flow
It is not necessary to save the middle limb upfront as overwriting it is
the desired result: in the first step we are reducing modulo
2^{512+biL}.

Arguably, the original flow is more intuitive and easier to see the idea
behind it.

Signed-off-by: Janos Follath <janos.follath@arm.com>
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:50 +01:00
Gabor Mezei
6bfbd36507
Fix coding style issues
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:49 +01:00
Gabor Mezei
b62ad5d569
Rename function to follow naming convention
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:13:48 +01:00
Gabor Mezei
2cb630edee
Change the ecp_mod_p521_raw to be testable
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:05:22 +01:00
Gabor Mezei
8450ab9c60
Fix Secp521r1 reduction
The prototype calculated with wrong limb size and not taken into account
the overflow in the shared limb.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:03:03 +01:00
Gabor Mezei
42df16c84b
Extract Secp521r1 from the prototype
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-15 18:02:57 +01:00
Gilles Peskine
e2a9f86755
Merge pull request #6971 from gabor-mezei-arm/6026_Secp192r1_fast_reduction
Extract Secp192r1 fast reduction from the prototype
2023-02-15 16:22:36 +01:00
Gabor Mezei
a264831cff
Update documentation and add comments
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-02-13 16:29:05 +01:00
Dave Rodgman
6dd757a8ba Fix use of sizeof without brackets
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-02-02 12:40:50 +00:00
Gabor Mezei
2038ce976e
Rename function to follow naming convention
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-01-31 14:40:05 +01:00
Gabor Mezei
deece2bb65
Change the ecp_mod_p192_raw to be testable
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-01-31 14:40:05 +01:00
Gabor Mezei
b5bba497fe
Extract Secp192r1 from the prototype
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2023-01-31 14:40:05 +01:00
Minos Galanakis
e9fa7a74cd ecp_curves: Update pre-processor define guards for ecp_mpi_load().
This patch adjusts the logic, so that the method is included,
when the following components are enabled:

* MBEDTLS_ECP_DP_CURVE448_ENABLED
* MBEDTLS_ECP_DP_CURVE25519_ENABLED
* ECP_LOAD_GROUP

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-01-19 16:12:07 +00:00
Minos Galanakis
146fed9849 ecp_curves: Hardcode Montgomery const for curve448.
This patch adds two embedded constants used by `ecp_use_curve448()`.
The method has been updated to read that into an mpi instead of
calculating it on the fly.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-01-19 16:11:50 +00:00
Minos Galanakis
bececeb0b9 ecp_curves: Hardcod Montgomery const for curve25519
This patch adds two embedded constants used by `ecp_use_curve25519()`.
The method has been updated to read that into an mpi instead of
calculating it on the fly.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-01-19 11:38:19 +00:00
Gilles Peskine
449bd8303e Switch to the new code style
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-01-11 14:50:10 +01:00
Gilles Peskine
5a34b36bbd Remove more now-redundant definitions of inline
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-11-25 13:26:44 +01:00
Tom Cosgrove
82d3f1e824 Remove bignum_internal.h, moving contents to bignum_core.h
Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-08-23 12:01:39 +01:00
Pol Henarejos
b101cb6111
Since the group is unloaded for all curves, it is better to initialize the group also for all curves.
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
2022-05-06 18:43:58 +02:00
Pol Henarejos
aa68d36234
Fix order value for curve x448.
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
2022-05-05 19:22:29 +02:00
Hanno Becker
0dbf04a9a6 Remove unnecessary memory operations in p25519 quasireduction
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-13 07:26:53 +01:00
Hanno Becker
127fcabb21 Fail gracefully upon unexpectedly large input to p25519 reduction
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-12 22:18:36 +01:00
Hanno Becker
bb04cb992f Fix check in p25519 quasi-reduction
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-12 11:18:11 +01:00
Hanno Becker
d830feb256 Simplify check in p25519 quasi-reduction
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-12 11:10:19 +01:00
Hanno Becker
2ef0cff6c3 Fix size check in p25519 modular reduction
The check was meant to precisely catch an underflow.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-12 11:02:05 +01:00
Hanno Becker
53b3c607a0 Move const keyword prior to type name
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-11 13:46:30 +01:00
Hanno Becker
e9dd9a1f31 Use size_t for number of limbs
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-11 09:06:27 +01:00
Hanno Becker
6454993e2e Safeguard against calling p255 reduction with single-width MPI
(In this case, there's nothing to do anyway since we only do a
quasi-reduction to N+1 limbs)

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-11 07:35:58 +01:00
Hanno Becker
25bb732ea7 Simplify x25519 reduction using internal bignum MLA helper
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2022-04-11 07:03:48 +01:00
Janos Follath
1107ee4e44 Add prefix to BYTES_TO_T_UINT_*
These macros were moved into a header and now check-names.sh is failing.
Add an MBEDTL_ prefix to the macro names to make it pass.

Signed-off-by: Janos Follath <janos.follath@arm.com>
2021-06-25 12:46:40 +01:00
Janos Follath
8b8b781524 Use mbedtls_mpi_lset() more
Signed-off-by: Janos Follath <janos.follath@arm.com>
2021-06-24 15:00:33 +01:00
Janos Follath
8c70e815dd Move mpi constant macros to bn_mul.h
Signed-off-by: Janos Follath <janos.follath@arm.com>
2021-06-24 14:48:38 +01:00
Manuel Pégourié-Gonnard
06215eaa3e Avoid complaints about undeclared non-static symbols
Clang was complaining and check-names.sh too

This only duplicates macros, so no impact on code size. In 3.0 we can
probably avoid the duplication by using an internal header under
library/ but this won't work for 2.16.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2021-06-23 12:59:02 +02:00
Manuel Pégourié-Gonnard
2d457b8fca Use more compact encoding of Montgomery curve constants
Base 256 beats base 16.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2021-06-23 12:44:21 +02:00
Manuel Pégourié-Gonnard
2389a6000e Use a more compact encoding of bad points
Base 10 is horrible, base 256 is much better.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2021-06-23 12:25:48 +02:00
kXuan
ba9cb76e9f
static initialize comb table
MBEDTLS_ECP_FIXED_POINT_OPTIM aims to speed up ecc multiplication performance.

We compute the comb table in runtime now. It is a costly operation.

This patch add a pre-computed table to initialize well-known curves. It speed up ECDSA signature verify process in runtime by using more ROM size.

Signed-off-by: kXuan <kxuanobj@gmail.com>
2021-06-01 10:02:13 +08:00
Gilles Peskine
ff6a32d79c Fix low-probability arithmetic error in ECC
Fix the subtraction in fix_negative, which was incorrectly not looking
for a carry. This caused the result to be wrong when the least
significant limb of N was 0. Fix #4296.

The bug was introduced by d10e8fae9e
"Optimize fix_negative". Thanks to Philippe Antoine (catenacyber) for
reporting the bug which was found by his EC differential fuzzer.
Credit to OSS-Fuzz.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-04 01:10:41 +02:00
Gilles Peskine
349b37273e Fix an incorrect comment about fix_negative
We're subtracting multiples of 2^bits, not 2^(bits+32).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-04 01:10:41 +02:00
Gilles Peskine
618be2ec41 Add unit tests for fix_negative
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-04 01:10:41 +02:00
Gilles Peskine
b76517b764 Cosmetic improvement
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-10 23:44:28 +01:00