summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/cryptlib.c (unfollow)
Commit message (Collapse)AuthorFilesLines
2023-02-07libcrypto/ec: another missing point-on-curve checktb1-3/+9
Unlike in the affine/compressed/... cases, when setting projective coordinates of an elliptic curve point, there is no check whether the point is actually on the curve. Pointed out by Guido Vranken ok beck miod
2023-02-04Remove bn_sqr_words() on amd64.jsing2-11/+2
s2n-bignum's bignum_sqr() is not the same as bn_sqr_words() (which only computes a partial result, unlike the former). This went unnoticed since bn_sqr() is called directly on amd64, hence bn_sqr_words() is currently unused.
2023-02-04Fix output constraints for bn_umul_hilo().jsing4-8/+8
When bn_umul_hilo() is implemented using an instruction pair, mark the first output with a constraint that prevents the output from overlapping with the inputs ("&"). Otherwise the first instruction can overwrite the inputs, which then results in the second instruction producing incorrect value.
2023-02-03Move BN_mod_exp2_mont() to bn_exp.c.jsing2-188/+186
2023-02-03Reorder functions in bn_exp.c to be slightly sensible...jsing1-282/+279
No functional change intended.
2023-02-03Clean up and simplify BN_mod_lshift{,_quick}().jsing1-38/+34
BN_mod_lshift() already has a BN_CTX available, make use of it rather than calling BN_dup() and BN_free(). In BN_mod_lshift_quick(), BN_copy() already handles dst == src, so avoid checking this before the call. The max_shift == 0 case can also be handled without code duplication. And as with other *_quick() functions, use BN_ucmp() and BN_usub() directly given the 0 <= a < m constraint. ok tb@
2023-02-03Clean up BN_mod_mul() and simplify BN_mod_sqr().jsing1-14/+16
Use the same naming/code pattern in BN_mod_mul() as is used in BN_mul(). Note that the 'rr' allocation is unnecessary, since both BN_mul() and BN_sqr() handle the case where r == a || r == b. However, it avoids a potential copy on the exit from BN_mul()/BN_sqr(), so leave it in place for now. Turn BN_mod_sqr() into a wrapper that calls BN_mod_mul(), since it already calls BN_sqr() in the a == b. The supposed gain of calling BN_mod_ct() instead of BN_nnmod() does not really exist. ok tb@
2023-02-03Simplify BN_mod_{lshift1,sub}_quick().jsing1-13/+19
The BN_mod_.*_quick() functions require that their inputs are non-negative and are already reduced. As such, they can and should use BN_ucmp() and BN_usub() instead of BN_cmp() and BN_add()/BN_sub() (which internally call BN_uadd()/BN_usub() and potentially BN_cmp()). ok tb@
2023-02-03Simplify BN_nnmod().jsing1-13/+12
In the case that the result is negative (i.e. one of a or m is negative), the positive result can be achieved via a single BN_usub(). This simplifies BN_nnmod() and avoids indirection via BN_add()/BN_sub(), which do BN_cmp() and then call into BN_uadd()/BN_usub(). ok tb@
2023-02-03Turn BN_mod_{ct,nonct}() into symbols.jsing2-6/+19
Also use accurate/useful variables names. ok tb@
2023-02-02Remove AIX toc data after every function. NFCmiod5-71/+2
2023-02-02Refactor BN_uadd() and BN_usub().jsing3-39/+99
Unlike bn_add_words()/bn_sub_words(), the s2n-bignum bignum_add() and bignum_sub() functions correctly handle inputs with differing word lengths. This means that they can be called directly, without needing to fix up any remaining words manually. Split BN_uadd() in two - the default bn_add() implementation calls bn_add_words(), before handling the carry for any remaining words. Likewise split BN_usub() in two - the default bn_sub() implementation calls bn_sub_words(), before handling the borrow for any remaining words. On amd64, provide an implementation of bn_add() that calls s2n-bignum's bignum_add() directly, similarly with an implementation of bn_sub() that calls s2n-bignum's bignum_sub() directly. ok tb@
2023-02-02Unbreak vpaes-x86 implementation.jsing1-2/+0
Remove remnants of previous PIC handling. ok miod@
2023-02-02Move all data blocks from .text to .rodata and cleanup up and homogeneize codemiod3-18/+5
responsible from getting the proper address of those blocks.
2023-02-02Sync function prototypes and declarations to satisfy clang 15.anton1-3/+3
ok jsing@
2023-02-01Move all data blocks from .text to .rodata and cleanup up and homogeneize codemiod16-236/+248
responsible from getting the proper address of those blocks. ok tb@ jsing@
2023-02-01For xonly, move sha512-ppc.pl's table from text to rodatagkoehler1-18/+7
OpenBSD/macppc will enforce xonly on PowerPC G5, then libcrypto's sha256 would crash by SIGSEGV, because it can't read text. Use ELF relocations "@ha" and "@l" to find the table in rodata. This might break the PowerPC asm on a not-ELF platform (like AIX or Mac OS) if someone would try it there. ok kettenis@ deraadt@
2023-02-01Don't run session tests with openssl 3.0 - these tests aren't TLSv1.3 readytb1-2/+2
2023-02-01Hopefully the last one.tb1-4/+4
2023-02-01One more openssl 1.0.2 thing missed.tb1-4/+4
2023-02-01Switch from eopenssl to eopenssl30. Missed in both previous commitstb1-4/+4
for some reason.
2023-02-01Retire OpenSSL 1.0.2 interoptb7-93/+13
Now that the OpenSSL 1.0.2 port is gone, there's no need to keep the interop tests anymore. anton's and bluhm's regress tests will switch to testing interoperability with OpenSSL 3.0.
2023-02-01Pull the MONT_WORD define to the top.jsing1-3/+3
Reordering functions with defines hiding in the middle leads to fun outcomes... and apparently the non-MONT_WORD code is broken, at least on aarch64.
2023-02-01Move BN_MONT_CTX_* functions to the top of the file.jsing1-221/+221
No functional change.
2023-01-31Remove the now empty bn_asm.c.jsing8-78/+6
This rather misnamed file (bn_asm.c) previously contained the C code that was needed to build libcrypto bignum on platforms that did not have assembly implementations of the functions it contained.
2023-01-31Simplify bn_div_3_words().jsing1-49/+15
Make use of bn_umul_hilo() and remove the tangle of preprocessor directives that implement different code paths depending on what defines exist. ok tb@
2023-01-31Provide inline assembly bn_umul_hilo() for alpha/powerpc64/riscv64.jsing3-3/+67
These should work, but are currently untested and disabled. ok tb@
2023-01-31Provide inline assembly versions of bn_umul_hilo() for aarch64/amd64/i386.jsing3-3/+67
ok tb@