aboutsummaryrefslogtreecommitdiff
path: root/networking/tls_fe.c
diff options
context:
space:
mode:
authorDenys Vlasenko <vda.linux@googlemail.com>2021-10-11 16:31:47 +0200
committerDenys Vlasenko <vda.linux@googlemail.com>2021-10-11 16:31:47 +0200
commit23aba8a9a66637fbc6b1eed2a259cb7ddb1a1595 (patch)
tree0f2ce5b0a6da81217e6556458594583e67f1c800 /networking/tls_fe.c
parent74ee3f2f7323489aab6a5da1c84f86955ccbf93e (diff)
downloadbusybox-w32-23aba8a9a66637fbc6b1eed2a259cb7ddb1a1595.tar.gz
busybox-w32-23aba8a9a66637fbc6b1eed2a259cb7ddb1a1595.tar.bz2
busybox-w32-23aba8a9a66637fbc6b1eed2a259cb7ddb1a1595.zip
tls: code shrink curve25519
function old new delta fe_select 39 - -39 curve25519 849 800 -49 ------------------------------------------------------------------------------ (add/remove: 0/1 grow/shrink: 0/1 up/down: 0/-88) Total: -88 bytes Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to '')
-rw-r--r--networking/tls_fe.c54
1 files changed, 39 insertions, 15 deletions
diff --git a/networking/tls_fe.c b/networking/tls_fe.c
index ecb410281..3a0a6776f 100644
--- a/networking/tls_fe.c
+++ b/networking/tls_fe.c
@@ -63,16 +63,22 @@ static void fprime_select(byte *dst, const byte *zero, const byte *one, byte con
63} 63}
64#endif 64#endif
65 65
66#if 0 /* constant-time */
66static void fe_select(byte *dst, 67static void fe_select(byte *dst,
67 const byte *zero, const byte *one, 68 const byte *src,
68 byte condition) 69 byte condition)
69{ 70{
70 const byte mask = -condition; 71 const byte mask = -condition;
71 int i; 72 int i;
72 73
73 for (i = 0; i < F25519_SIZE; i++) 74 for (i = 0; i < F25519_SIZE; i++)
74 dst[i] = zero[i] ^ (mask & (one[i] ^ zero[i])); 75 dst[i] = dst[i] ^ (mask & (src[i] ^ dst[i]));
75} 76}
77#else
78# define fe_select(dst, src, condition) do { \
79 if (condition) lm_copy(dst, src); \
80} while (0)
81#endif
76 82
77#if 0 //UNUSED 83#if 0 //UNUSED
78static void raw_add(byte *x, const byte *p) 84static void raw_add(byte *x, const byte *p)
@@ -225,7 +231,7 @@ static void fe_normalize(byte *x)
225 minusp[31] = (byte)c; 231 minusp[31] = (byte)c;
226 232
227 /* Load x-p if no underflow */ 233 /* Load x-p if no underflow */
228 fe_select(x, minusp, x, (c >> 15) & 1); 234 fe_select(x, minusp, !(c & (1<<15)));
229} 235}
230 236
231static void lm_add(byte* r, const byte* a, const byte* b) 237static void lm_add(byte* r, const byte* a, const byte* b)
@@ -548,26 +554,32 @@ static void curve25519(byte *result, const byte *e, const byte *q)
548{ 554{
549 int i; 555 int i;
550 556
551 struct { 557 struct Z {
552 /* for bbox's special case of q == NULL meaning "use basepoint" */ 558 /* for bbox's special case of q == NULL meaning "use basepoint" */
553 /*static const*/ uint8_t basepoint9[CURVE25519_KEYSIZE]; // = {9}; 559 /*static const*/ uint8_t basepoint9[CURVE25519_KEYSIZE]; // = {9};
554 560
555 /* from wolfssl-3.15.3/wolfssl/wolfcrypt/fe_operations.h */ 561 /* from wolfssl-3.15.3/wolfssl/wolfcrypt/fe_operations.h */
556 /*static const*/ byte f25519_one[F25519_SIZE]; // = {1}; 562 /*static const*/ byte f25519_one[F25519_SIZE]; // = {1};
557 563
558 /* Current point: P_m */
559 byte xm[F25519_SIZE];
560 byte zm[F25519_SIZE]; // = {1};
561 /* Predecessor: P_(m-1) */ 564 /* Predecessor: P_(m-1) */
562 byte xm1[F25519_SIZE]; // = {1}; 565 byte xm1[F25519_SIZE]; // = {1};
563 byte zm1[F25519_SIZE]; // = {0}; 566 byte zm1[F25519_SIZE]; // = {0};
567 /* Current point: P_m */
568 byte xm[F25519_SIZE];
569 byte zm[F25519_SIZE]; // = {1};
570 /* Temporaries */
571 byte xms[F25519_SIZE];
572 byte zms[F25519_SIZE];
564 } z; 573 } z;
574 uint8_t *XM1 = (uint8_t*)&z + offsetof(struct Z,xm1); // gcc 11.0.0 workaround
565#define basepoint9 z.basepoint9 575#define basepoint9 z.basepoint9
566#define f25519_one z.f25519_one 576#define f25519_one z.f25519_one
567#define xm z.xm
568#define zm z.zm
569#define xm1 z.xm1 577#define xm1 z.xm1
570#define zm1 z.zm1 578#define zm1 z.zm1
579#define xm z.xm
580#define zm z.zm
581#define xms z.xms
582#define zms z.zms
571 memset(&z, 0, sizeof(z)); 583 memset(&z, 0, sizeof(z));
572 f25519_one[0] = 1; 584 f25519_one[0] = 1;
573 zm[0] = 1; 585 zm[0] = 1;
@@ -583,8 +595,8 @@ static void curve25519(byte *result, const byte *e, const byte *q)
583 595
584 for (i = 253; i >= 0; i--) { 596 for (i = 253; i >= 0; i--) {
585 const int bit = (e[i >> 3] >> (i & 7)) & 1; 597 const int bit = (e[i >> 3] >> (i & 7)) & 1;
586 byte xms[F25519_SIZE]; 598// byte xms[F25519_SIZE];
587 byte zms[F25519_SIZE]; 599// byte zms[F25519_SIZE];
588 600
589 /* From P_m and P_(m-1), compute P_(2m) and P_(2m-1) */ 601 /* From P_m and P_(m-1), compute P_(2m) and P_(2m-1) */
590 xc_diffadd(xm1, zm1, q, f25519_one, xm, zm, xm1, zm1); 602 xc_diffadd(xm1, zm1, q, f25519_one, xm, zm, xm1, zm1);
@@ -597,10 +609,22 @@ static void curve25519(byte *result, const byte *e, const byte *q)
597 * bit = 1 --> (P_(2m+1), P_(2m)) 609 * bit = 1 --> (P_(2m+1), P_(2m))
598 * bit = 0 --> (P_(2m), P_(2m-1)) 610 * bit = 0 --> (P_(2m), P_(2m-1))
599 */ 611 */
600 fe_select(xm1, xm1, xm, bit); 612#if 0
601 fe_select(zm1, zm1, zm, bit); 613 fe_select(xm1, xm, bit);
602 fe_select(xm, xm, xms, bit); 614 fe_select(zm1, zm, bit);
603 fe_select(zm, zm, zms, bit); 615 fe_select(xm, xms, bit);
616 fe_select(zm, zms, bit);
617#else
618// same as above in about 50 bytes smaller code, but
619// requires that in-memory order is exactly xm1,zm1,xm,zm,xms,zms
620 if (bit) {
621 //memcpy(xm1, xm, 4 * F25519_SIZE);
622 //^^^ gcc 11.0.0 warns of overlapping memcpy
623 //memmove(xm1, xm, 4 * F25519_SIZE);
624 //^^^ gcc 11.0.0 warns of out-of-bounds access to xm1[]
625 memmove(XM1, XM1 + 2 * F25519_SIZE, 4 * F25519_SIZE);
626 }
627#endif
604 } 628 }
605 629
606 /* Freeze out of projective coordinates */ 630 /* Freeze out of projective coordinates */
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-17 09:42:22 +0000