summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/bn/bn_local.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* bn: add internal BN_MONT_CTX_create()tb2025-02-131-1/+3
| | | | | | | | | | | | | This does what the public BN_MONT_CTX_new() should have done in the first place rather than doing the toolkit thing of returning an invalid object that you need to figure out how to populate and with what because the docs are abysmal. It takes the required arguments and calls BN_MONT_CTX_set(), which all callers do immediately after _new() (except for DSA which managed to squeeze 170 lines of garbage between the two calls). ok jsing
* Rename BN_mod_exp_recp() to BN_mod_exp_reciprocal()tb2025-02-121-2/+2
| | | | | (leaving out a dotasm comment that would become harder to read than it already is)
* Rename BN_div_recp() into BN_div_reciprocal()tb2025-01-221-3/+3
| | | | Requested by jsing
* Split BN_mod_sqr_reciprocal() out of BN_mod_mul_reciprocal()tb2025-01-221-1/+3
| | | | | | | | There's no need for BN_mod_mul_reciprocal() to have this complication. The caller knows when x == y, so place the burden on the caller. This simplifies both the caller side and the implementation in bn_recp.c. ok jsing
* Move BN_RECP_CTX to the heaptb2025-01-211-15/+4
| | | | | | | | | | | | | | This introduces a BN_RECP_CTX_create() function that allocates and populates the BN_RECP_CTX in a single call, without taking an unused BN_CTX argument. At the same time, make the N and Nr members BIGNUMs on the heap which are allocated by BN_RECP_CTX_create() and freed by BN_RECP_CTX_free() and remove the unnecessary flags argument. Garbage collect the now unused BN_RECP_CTX_{new,init,set}(). ok jsing
* BN_div_recp() can't be static since it is directly exercised by bn_test.ctb2025-01-061-1/+3
|
* Shuffle functions into a more sensible ordertb2025-01-061-5/+1
| | | | | | BN_reciprocal() is only called by BN_div_recp() which in turn is only called by BN_mod_mul_reciprocal(). So use this order and make the first two static.
* Provide bn_expand_bytes().jsing2024-04-161-1/+2
| | | | | | This will be used in an upcoming change. ok tb@
* Rename bn_expand() to bn_expand_bits().jsing2024-04-161-2/+2
| | | | | | | Also change the bits type from int to size_t, since that's what the callers are passing and we can avoid unnecessary input validation. ok tb@
* Remove the prototype of BN_gcd_nonct()tb2024-04-101-2/+1
|
* Make BN_mod_exp2_mont() and BN_mod_exp_mont_word() internaltb2024-03-021-1/+7
| | | | | | | | The former could be useful but nothing uses it. The latter is a dangerous implementation detail of Montgomery exponentiation that should never have been leaked out of the library. Fix this. ok jsing
* Make BN_mod_exp_simple() internaltb2024-03-021-1/+4
| | | | | | | This function is very slow and useful for testing purposes only. It should never have been part of the public API. Remove it from there. ok jsing
* Move bn_blind.c to rsa_blinding.ctb2023-08-091-9/+1
| | | | discussed with jsing
* Make declaration and definition of BN_BLINDING_new() match.tb2023-08-091-2/+2
| | | | Also, make mod const.
* Merge BN_BLINDING_create_param() into BN_BLINDING_new()tb2023-08-091-5/+4
|
* Unwrap a linetb2023-08-091-3/+2
|
* Drop the unused BN_BLINDING argument of BN_BLINDING_create_param()tb2023-08-081-3/+2
|
* Make the bn_rand_interval() API a bit more ergonomictb2023-08-031-2/+3
| | | | | | | | | | | | | | | | | | Provide bn_rand_in_range() which is a slightly tweaked version of what was previously called bn_rand_range(). The way bn_rand_range() is called in libcrypto, the lower bound is always expressible as a word. In fact, most of the time it is 1, the DH code uses a 2, the MR tests in BPSW use 3 and an exceptinally high number appears in the Tonelli-Shanks implementation where we use 32. Converting these lower bounds to BIGNUMs on the call site is annoying so let bn_rand_interval() do that internally and route that through bn_rand_in_range(). This way we can avoid using BN_sub_word(). Adjust the bn_isqrt() test to use bn_rand_in_range() since that's the only caller that uses actual BIGNUMs as lower bounds. ok jsing
* Drop the _ex from BN_BLINDING_{convert,invert}_ex()tb2023-08-021-3/+3
|
* Remove the unused BN_BLINDING_{convert,invert}()tb2023-08-021-3/+1
| | | | ok jsing
* Make BN_BLINDING_{new,update}() static in bn_blind.ctb2023-08-021-3/+1
| | | | ok jsing
* Remove the unused flags member of BN_BLINDINGtb2023-08-021-5/+1
| | | | | | | Nothing sets this, so remove it along with BN_BLINDING_NO_{UPDATE,RECREATE} and some checks that are always true. ok jsing
* Remove the unused flags accessors for BN_BLINDINGtb2023-08-021-3/+1
| | | | ok jsing
* Make BN_BLINDING internaltb2023-07-281-1/+22
| | | | | | | | | | RSA is pretty bad. In my most optimistic moments I dream of a world that stopped using it. That won't happen during my lifetime, unfortunately. Blinding is one way of making it a little less leaky. Unfortunately this side-channel leak mitigation leaked out of the library for no good reason. Let's at least fix that aspect of it. ok jsing
* Refactor BN_bn2hex()tb2023-07-091-1/+4
| | | | | | | | | Various outputting functions are variants of BN_bn2hex(). They do not want a sign or they display the BIGNUM at nibble granularity instead of byte granularity. So add this functionality to an internal variant of BN_bn2hex(). with/ok jsing
* Add bn_printf(), a replacement for ASN1_bn_print()tb2023-07-061-1/+5
| | | | | | | | | | ASN1_bn_print() will be removed in an upcoming bump. This adds an internal API that covers the same functionality but doesn't require that the caller pass in a sufficiently large scratch space that ASN1_bn_print() may or may not use. In addition, this takes a format string, which allows us to ditch some extra dances. ok jsing
* Rewrite and simplify bn_sqr()/bn_sqr_normal().jsing2023-06-241-2/+1
| | | | | | | | | Rework bn_sqr()/bn_sqr_normal() so that it is less convoluted and more readable. Instead of recomputing values that the caller has already computed, pass it as an argument. Avoid branching and remove duplication of variables. Consistently use a_len and r_len naming for lengths. ok tb@
* Make BN_num_bits() independent of bn->top.jsing2023-06-211-3/+1
| | | | | | | | Provide bn_bitsize(), which performs a constant time scan of a BN in order to determine the bit size of the BN value. Use this for BN_num_bits() such that it is no longer dependent on the bn->top value. ok tb@
* Add Miller-Rabin test for random bases to BPSWtb2023-05-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The behavior of the BPSW primality test for numbers > 2^64 is not very well understood. While there is no known composite that passes the test, there are heuristics that indicate that there are likely infinitely many. Therefore it seems appropriate to harden the test. Having a settable number of MR rounds before doing a version of BPSW is also the approach taken by Go's primality check in math/big. This adds a new implementation of the old MR test that runs before running the strong Lucas test. I like to imagine that it's slightly cleaner code. We're effectively at about twice the cost of what we had a year ago. In addition, it adds some non-determinism in case there actually are false positives for the BPSW test. The implementation is straightforward. It could easily be tweaked to use the additional gcds in the "enhanced" MR test of FIPS 186-5, but as long as we are only going to throw away the additional info, that's not worth much. This is a first step towards incorporating some of the considerations in "A performant misuse-resistant API for Primality Testing" by Massimo and Paterson. Further work will happen in tree. In particular, there are plans to crank the number of Miller-Rabin tests considerably so as to have a guaranteed baseline. The manual will be updated shortly. positive feedback beck ok jsing
* BN_RECP_CTX moves to internaltb2023-04-251-3/+3
|
* Move a few now internal prototypes to bn_local.htb2023-04-251-1/+16
|
* unifdef BN_RECURSIONjsing2023-04-191-9/+1
| | | | | | | | | | | | This removes a bunch of incomplete and scary code, which potentially leaks secrets and is not constant time. A performance gain is achieved on arm64 for sizes that we care about, while a minimal decrease in performance is noted for larger sizes on some other platforms. While we will potentially reimplement Karatsuba (or Toom-Cook) at a later date, it will be easier and safer to do it from a clean slate. ok tb@
* Add bn_copy(), a sane wrapper of BN_copy() for internal usetb2023-03-271-1/+3
| | | | ok jsing
* Replace bn_sub_part_words() with bn_sub().jsing2023-02-221-3/+1
| | | | | | | | Now that bn_sub() handles word arrays with potentially different lengths, we no longer need bn_sub_part_words() - call bn_sub() instead. This allows us to entirely remove the unnecessarily complex bn_sub_part_words() code. ok tb@
* Rework bn_add()/bn_sub() to operate on word arrays.jsing2023-02-221-1/+6
| | | | | | | | Rather than working on BIGNUMs, change bn_add()/bn_sub() to operate on word arrays that potentially differ in length. This matches the behaviour of s2n-bignum's bignum_add() and bignum_sub(). ok tb@
* Rewrite and simplify BN_MONT_CTX_set()jsing2023-02-221-7/+8
| | | | | | | | | | | | | | OpenSSL commit 4d524040bc8 changed BN_MONT_CTX_set() so that it computed a 64 bit N^-1 on both BN_BITS2 == 32 and BN_BITS2 == 64 platforms. However, the way in which this was done was to duplicate half the code and wrap it in #ifdef. Rewrite this code to use a single code path on all platforms, with #ifdef being limited to setting an additional word in the temporary N and storing the result on BN_BITS2 == 32 platforms. Also remove stack based BIGNUM in favour of using the already present BN_CTX. ok tb@
* Unifdef MONT_WORD.jsing2023-02-211-4/+2
| | | | | | | | | | | It does not make sense to use code that is slower, currently broken and prevents the use of assembly Montgomery implementations. This is the result of `unifdef -m -DMONT_WORD`, followed by some manual clean up and the removal of the Ni bignum from BN_MONT_CTX (which was only used in the non-MONT_WORD case). ok miod@ tb@
* Move BN_MONT_CTX back to bn_local.h for now. It's still used by bn_exp.ctb2023-02-191-1/+13
|
* Move struct bn_mont_ctx_st from bn_local.h to bn_mont.c.jsing2023-02-191-13/+1
| | | | | | No code outside of bn_mont.c needs access to it. ok tb@
* Remove now unused tangle of mul*/sqr* and BN_UMULT_* macros.jsing2023-02-171-251/+1
| | | | | | | No, I'm not trying to overwhelm you... however, we really no longer need this clutter. ok tb@
* Enable s2n-bignum word_clz() on amd64.jsing2023-02-161-1/+3
| | | | | | | | | The BN_num_bits_word() function is a hot path, being called more than 80 million times during a libcrypto regress run. The word_clz() implementation uses five instructions to do the same as the generic code that uses more than 60 instructions. Discussed with tb@
* Remove the misnamed and now unused mul, mul_add and mul_add_c macros.jsing2023-02-141-122/+2
| | | | | | There were only three versions of each one... ok tb@
* Clean up bn_sqr_words()jsing2023-02-091-19/+1
| | | | | | | | | | | Currently there are two versions of bn_sqr_words(), which call the sqr or sqr64 macro. Replace this with a single version that calls bn_umul_hilo() and remove the various implementations of the sqr macro. The only slight downside is that sqr64 does three multiplications instead of four, given that the second and third terms are identical. However, this is a minimal gain for the amount of duplication and entanglement it introduces. ok tb@
* Turn BN_mod_{ct,nonct}() into symbols.jsing2023-02-031-5/+6
| | | | | | Also use accurate/useful variables names. ok tb@
* Provide bn_div_rem_words() and make use of it.jsing2023-01-281-3/+7
| | | | | | | | | | | | | | | | Provide a function that divides a double word (h:l) by d, returning the quotient q and the remainder r, such that q * d + r is equal to the numerator. Call this from the three places that currently implement this themselves. This is implemented with some slight indirection, which allows for per architecture implementations, replacing the define/macro tangle, which messes with variables that are not passed to it. Also remove a duplicate of bn_div_words() for the BN_ULLONG && BN_DIV2W case - this is already handled. ok tb@
* Move {mul,sqr}_add_c{,2} macros from bn_asm.c to bn_local.h.jsing2023-01-201-3/+153
| | | | | | | | | | | These depend on other macros that are in already in bn_local.h and this makes them available to other source files. A lot more clean up will be needed in the future. Of course x86_64-gcc.c makes use of the same macro names - sprinkle some undef in there for the time being. ok tb@
* Remove unused code.jsing2023-01-201-9/+3
| | | | ok tb@
* Rewrite bn_correct_top().jsing2022-11-301-13/+2
| | | | | | | bn_correct_top() is currently a macro and far more complex than it needs to be - rewrite it as a function. ok tb@
* Make header guards of internal headers consistenttb2022-11-261-4/+4
| | | | | Not all of them, only those that didn't leak into a public header... Yes.
* Make internal header file names consistenttb2022-11-261-0/+567
Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-04-01 18:50:41 +0000