Mop up EC_GROUP precomp machinery.

Since there are now no EC implementations that perform pre-computation at
the EC_GROUP level, remove all of the precomp machinery, including the
extra_data EC_GROUP member.

The ec_wNAF_mul() code is horrific - simply cut out the precomp code,
rather than trying to rewrite it (that's a project for another day).

ok tb@

3 files changed, 10 insertions, 252 deletions

diff --git a/src/lib/libcrypto/ec/ec_lib.c b/src/lib/libcrypto/ec/ec_lib.c
index 817b0239be..93a9065129 100644
--- a/src/lib/libcrypto/ec/ec_lib.c
+++ b/src/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_lib.c,v 1.58 2023/06/20 14:37:15 tb Exp $ */
+/* $OpenBSD: ec_lib.c,v 1.59 2023/06/24 17:49:44 jsing Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -93,8 +93,6 @@ EC_GROUP_new(const EC_METHOD *meth)
         }
         ret->meth = meth;
 
-        ret->extra_data = NULL;
-
         ret->generator = NULL;
         BN_init(&ret->order);
         BN_init(&ret->cofactor);
@@ -123,8 +121,6 @@ EC_GROUP_free(EC_GROUP *group)
         if (group->meth->group_finish != NULL)
                 group->meth->group_finish(group);
 
-        EC_EX_DATA_clear_free_all_data(&group->extra_data);
-
         EC_POINT_free(group->generator);
         BN_free(&group->order);
         BN_free(&group->cofactor);
@@ -142,8 +138,6 @@ EC_GROUP_clear_free(EC_GROUP *group)
 int
 EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
 {
-        EC_EXTRA_DATA *d;
-
         if (dest->meth->group_copy == NULL) {
                 ECerror(ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
                 return 0;
@@ -155,18 +149,6 @@ EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
         if (dest == src)
                 return 1;
 
-        EC_EX_DATA_free_all_data(&dest->extra_data);
-
-        for (d = src->extra_data; d != NULL; d = d->next) {
-                void *t = d->dup_func(d->data);
-
-                if (t == NULL)
-                        return 0;
-                if (!EC_EX_DATA_set_data(&dest->extra_data, t, d->dup_func,
-                    d->free_func, d->clear_free_func))
-                        return 0;
-        }
-
         if (src->generator != NULL) {
                 if (dest->generator == NULL) {
                         dest->generator = EC_POINT_new(dest);
diff --git a/src/lib/libcrypto/ec/ec_local.h b/src/lib/libcrypto/ec/ec_local.h
index d178665c1f..c0689a3c3e 100644
--- a/src/lib/libcrypto/ec/ec_local.h
+++ b/src/lib/libcrypto/ec/ec_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_local.h,v 1.15 2023/06/24 17:18:15 jsing Exp $ */
+/* $OpenBSD: ec_local.h,v 1.16 2023/06/24 17:49:44 jsing Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -209,8 +209,6 @@ struct ec_group_st {
          * if they appear to be generic.
          */
 
-        EC_EXTRA_DATA *extra_data;
-
         /*
          * Field specification. For GF(p) this is the modulus; for GF(2^m),
          * this is the irreducible polynomial defining the field.
diff --git a/src/lib/libcrypto/ec/ec_mult.c b/src/lib/libcrypto/ec/ec_mult.c
index 61428eb142..a0e97437bb 100644
--- a/src/lib/libcrypto/ec/ec_mult.c
+++ b/src/lib/libcrypto/ec/ec_mult.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_mult.c,v 1.30 2023/06/24 17:18:15 jsing Exp $ */
+/* $OpenBSD: ec_mult.c,v 1.31 2023/06/24 17:49:44 jsing Exp $ */
 /*
  * Originally written by Bodo Moeller and Nils Larsch for the OpenSSL project.
  */
@@ -67,7 +67,6 @@
 
 #include "ec_local.h"
 
-
 /*
  * This file implements the wNAF-based interleaving multi-exponentation method
  * (<URL:http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#multiexp>);
@@ -75,91 +74,6 @@
  * (<URL:http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller.html#fastexp>).
  */
 
-
-
-
-/* structure for precomputed multiples of the generator */
-typedef struct ec_pre_comp_st {
-        const EC_GROUP *group;  /* parent EC_GROUP object */
-        size_t blocksize;       /* block size for wNAF splitting */
-        size_t numblocks;       /* max. number of blocks for which we have
-                                 * precomputation */
-        size_t w;               /* window size */
-        EC_POINT **points;      /* array with pre-calculated multiples of
-                                 * generator: 'num' pointers to EC_POINT
-                                 * objects followed by a NULL */
-        size_t num;             /* numblocks * 2^(w-1) */
-        int references;
-} EC_PRE_COMP;
-
-/* functions to manage EC_PRE_COMP within the EC_GROUP extra_data framework */
-static void *ec_pre_comp_dup(void *);
-static void ec_pre_comp_free(void *);
-static void ec_pre_comp_clear_free(void *);
-
-static void *
-ec_pre_comp_dup(void *src_)
-{
-        EC_PRE_COMP *src = src_;
-
-        /* no need to actually copy, these objects never change! */
-
-        CRYPTO_add(&src->references, 1, CRYPTO_LOCK_EC_PRE_COMP);
-
-        return src_;
-}
-
-static void
-ec_pre_comp_free(void *pre_)
-{
-        int i;
-        EC_PRE_COMP *pre = pre_;
-
-        if (!pre)
-                return;
-
-        i = CRYPTO_add(&pre->references, -1, CRYPTO_LOCK_EC_PRE_COMP);
-        if (i > 0)
-                return;
-
-        if (pre->points) {
-                EC_POINT **p;
-
-                for (p = pre->points; *p != NULL; p++)
-                        EC_POINT_free(*p);
-                free(pre->points);
-        }
-        free(pre);
-}
-
-static void
-ec_pre_comp_clear_free(void *pre_)
-{
-        int i;
-        EC_PRE_COMP *pre = pre_;
-
-        if (!pre)
-                return;
-
-        i = CRYPTO_add(&pre->references, -1, CRYPTO_LOCK_EC_PRE_COMP);
-        if (i > 0)
-                return;
-
-        if (pre->points) {
-                EC_POINT **p;
-
-                for (p = pre->points; *p != NULL; p++) {
-                        EC_POINT_free(*p);
-                        explicit_bzero(p, sizeof *p);
-                }
-                free(pre->points);
-        }
-        freezero(pre, sizeof *pre);
-}
-
-
-
-
 /* Determine the modified width-(w+1) Non-Adjacent Form (wNAF) of 'scalar'.
  * This is an array  r[]  of values that are either zero or odd with an
  * absolute value less than  2^w  satisfying
@@ -315,8 +229,7 @@ ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
         const EC_POINT *generator = NULL;
         EC_POINT *tmp = NULL;
         size_t totalnum;
-        size_t blocksize = 0, numblocks = 0;    /* for wNAF splitting */
-        size_t pre_points_per_block = 0;
+        size_t numblocks = 0;   /* for wNAF splitting */
         size_t i, j;
         int k;
         int r_is_inverted = 0;
@@ -331,7 +244,6 @@ ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
         EC_POINT **v;
         EC_POINT ***val_sub = NULL;     /* pointers to sub-arrays of 'val' or
                                          * 'pre_comp->points' */
-        const EC_PRE_COMP *pre_comp = NULL;
         int num_scalar = 0;     /* flag: will be set to 1 if 'scalar' must be
                                  * treated like other scalars, i.e.
                                  * precomputation is not available */
@@ -357,42 +269,10 @@ ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
                         ECerror(EC_R_UNDEFINED_GENERATOR);
                         goto err;
                 }
-                /* look if we can use precomputed multiples of generator */
-
-                pre_comp = EC_EX_DATA_get_data(group->extra_data, ec_pre_comp_dup, ec_pre_comp_free, ec_pre_comp_clear_free);
-
-                if (pre_comp && pre_comp->numblocks &&
-                    (EC_POINT_cmp(group, generator, pre_comp->points[0], ctx) == 0)) {
-                        blocksize = pre_comp->blocksize;
-
-                        /*
-                         * determine maximum number of blocks that wNAF
-                         * splitting may yield (NB: maximum wNAF length is
-                         * bit length plus one)
-                         */
-                        numblocks = (BN_num_bits(scalar) / blocksize) + 1;
 
-                        /*
-                         * we cannot use more blocks than we have
-                         * precomputation for
-                         */
-                        if (numblocks > pre_comp->numblocks)
-                                numblocks = pre_comp->numblocks;
-
-                        pre_points_per_block = (size_t) 1 << (pre_comp->w - 1);
-
-                        /* check that pre_comp looks sane */
-                        if (pre_comp->num != (pre_comp->numblocks * pre_points_per_block)) {
-                                ECerror(ERR_R_INTERNAL_ERROR);
-                                goto err;
-                        }
-                } else {
-                        /* can't use precomputation */
-                        pre_comp = NULL;
-                        numblocks = 1;
-                        num_scalar = 1; /* treat 'scalar' like 'num'-th
-                                         * element of 'scalars' */
-                }
+                numblocks = 1;
+                num_scalar = 1; /* treat 'scalar' like 'num'-th
+                                 * element of 'scalars' */
         }
         totalnum = num + numblocks;
 
@@ -434,111 +314,9 @@ ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
         if (numblocks) {
                 /* we go here iff scalar != NULL */
 
-                if (pre_comp == NULL) {
-                        if (num_scalar != 1) {
-                                ECerror(ERR_R_INTERNAL_ERROR);
-                                goto err;
-                        }
-                        /* we have already generated a wNAF for 'scalar' */
-                } else {
-                        size_t tmp_len = 0;
-
-                        if (num_scalar != 0) {
-                                ECerror(ERR_R_INTERNAL_ERROR);
-                                goto err;
-                        }
-                        /*
-                         * use the window size for which we have
-                         * precomputation
-                         */
-                        wsize[num] = pre_comp->w;
-                        tmp_wNAF = compute_wNAF(scalar, wsize[num], &tmp_len);
-                        if (tmp_wNAF == NULL)
-                                goto err;
-
-                        if (tmp_len <= max_len) {
-                                /*
-                                 * One of the other wNAFs is at least as long
-                                 * as the wNAF belonging to the generator, so
-                                 * wNAF splitting will not buy us anything.
-                                 */
-
-                                numblocks = 1;
-                                totalnum = num + 1;     /* don't use wNAF
-                                                         * splitting */
-                                wNAF[num] = tmp_wNAF;
-                                tmp_wNAF = NULL;
-                                wNAF[num + 1] = NULL;
-                                wNAF_len[num] = tmp_len;
-                                if (tmp_len > max_len)
-                                        max_len = tmp_len;
-                                /*
-                                 * pre_comp->points starts with the points
-                                 * that we need here:
-                                 */
-                                val_sub[num] = pre_comp->points;
-                        } else {
-                                /*
-                                 * don't include tmp_wNAF directly into wNAF
-                                 * array - use wNAF splitting and include the
-                                 * blocks
-                                 */
-
-                                signed char *pp;
-                                EC_POINT **tmp_points;
-
-                                if (tmp_len < numblocks * blocksize) {
-                                        /*
-                                         * possibly we can do with fewer
-                                         * blocks than estimated
-                                         */
-                                        numblocks = (tmp_len + blocksize - 1) / blocksize;
-                                        if (numblocks > pre_comp->numblocks) {
-                                                ECerror(ERR_R_INTERNAL_ERROR);
-                                                goto err;
-                                        }
-                                        totalnum = num + numblocks;
-                                }
-                                /* split wNAF in 'numblocks' parts */
-                                pp = tmp_wNAF;
-                                tmp_points = pre_comp->points;
-
-                                for (i = num; i < totalnum; i++) {
-                                        if (i < totalnum - 1) {
-                                                wNAF_len[i] = blocksize;
-                                                if (tmp_len < blocksize) {
-                                                        ECerror(ERR_R_INTERNAL_ERROR);
-                                                        goto err;
-                                                }
-                                                tmp_len -= blocksize;
-                                        } else
-                                                /*
-                                                 * last block gets whatever
-                                                 * is left (this could be
-                                                 * more or less than
-                                                 * 'blocksize'!)
-                                                 */
-                                                wNAF_len[i] = tmp_len;
-
-                                        wNAF[i + 1] = NULL;
-                                        wNAF[i] = malloc(wNAF_len[i]);
-                                        if (wNAF[i] == NULL) {
-                                                ECerror(ERR_R_MALLOC_FAILURE);
-                                                goto err;
-                                        }
-                                        memcpy(wNAF[i], pp, wNAF_len[i]);
-                                        if (wNAF_len[i] > max_len)
-                                                max_len = wNAF_len[i];
-
-                                        if (*tmp_points == NULL) {
-                                                ECerror(ERR_R_INTERNAL_ERROR);
-                                                goto err;
-                                        }
-                                        val_sub[i] = tmp_points;
-                                        tmp_points += pre_points_per_block;
-                                        pp += blocksize;
-                                }
-                        }
+                if (num_scalar != 1) {
+                        ECerror(ERR_R_INTERNAL_ERROR);
+                        goto err;
                 }
         }
         /*