From 8f75165f8b3cfa98846030026b66a253fdcaa299 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Olivier=20Ch=C3=A9ron?= Date: Sun, 26 Nov 2017 10:06:04 +0100 Subject: [PATCH] Time-constant P256 scalar inversion --- Crypto/PubKey/ECC/P256.hs | 11 ++++ cbits/p256/p256.c | 111 ++++++++++++++++++++++++++++++++++++++ tests/KAT_PubKey/P256.hs | 16 +++++- 3 files changed, 137 insertions(+), 1 deletion(-) diff --git a/Crypto/PubKey/ECC/P256.hs b/Crypto/PubKey/ECC/P256.hs index aa5b18e..77a5ff0 100644 --- a/Crypto/PubKey/ECC/P256.hs +++ b/Crypto/PubKey/ECC/P256.hs @@ -38,6 +38,7 @@ module Crypto.PubKey.ECC.P256 , scalarSub , scalarMul , scalarInv + , scalarInvSafe , scalarCmp , scalarFromBinary , scalarToBinary @@ -278,6 +279,14 @@ scalarInv a = withNewScalarFreeze $ \b -> withScalar a $ \pa -> ccryptonite_p256_modinv_vartime ccryptonite_SECP256r1_n pa b +-- | Give the inverse of the scalar using safe exponentiation +-- +-- > 1 / a +scalarInvSafe :: Scalar -> Scalar +scalarInvSafe a = + withNewScalarFreeze $ \b -> withScalar a $ \pa -> + ccryptonite_p256e_scalar_invert pa b + -- | Compare 2 Scalar scalarCmp :: Scalar -> Scalar -> Ordering scalarCmp a b = unsafeDoIO $ @@ -381,6 +390,8 @@ foreign import ccall "cryptonite_p256_mod" ccryptonite_p256_mod :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO () foreign import ccall "cryptonite_p256_modmul" ccryptonite_p256_modmul :: Ptr P256Scalar -> Ptr P256Scalar -> P256Digit -> Ptr P256Scalar -> Ptr P256Scalar -> IO () +foreign import ccall "cryptonite_p256e_scalar_invert" + ccryptonite_p256e_scalar_invert :: Ptr P256Scalar -> Ptr P256Scalar -> IO () --foreign import ccall "cryptonite_p256_modinv" -- ccryptonite_p256_modinv :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO () foreign import ccall "cryptonite_p256_modinv_vartime" diff --git a/cbits/p256/p256.c b/cbits/p256/p256.c index bd94f6a..8dad6ef 100644 --- a/cbits/p256/p256.c +++ b/cbits/p256/p256.c @@ -408,3 +408,114 @@ void cryptonite_p256e_modsub(const cryptonite_p256_int* MOD, const cryptonite_p2 top = subM(MOD, top, P256_DIGITS(c), MSB_COMPLEMENT(top)); addM(MOD, 0, P256_DIGITS(c), top); } + +// n' such as n * n' = -1 mod (2^32) +#define MONTGOMERY_FACTOR 0xEE00BC4F + +#define NTH_DOUBLE_THEN_ADD(i, a, nth, b, out) \ + cryptonite_p256e_montmul(a, a, out); \ + for (i = 1; i < nth; i++) \ + cryptonite_p256e_montmul(out, out, out); \ + cryptonite_p256e_montmul(out, b, out); + +const cryptonite_p256_int cryptonite_SECP256r1_r2 = // r^2 mod n + {{0xBE79EEA2, 0x83244C95, 0x49BD6FA6, 0x4699799C, + 0x2B6BEC59, 0x2845B239, 0xF3D95620, 0x66E12D94}}; + +const cryptonite_p256_int cryptonite_SECP256r1_one = {{1}}; + +// Montgomery multiplication, i.e. c = ab/r mod n with r = 2^256. +// Implementation is adapted from 'sc_montmul' in libdecaf. +static void cryptonite_p256e_montmul(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) { + int i, j, borrow; + cryptonite_p256_digit accum[P256_NDIGITS+1] = {0}; + cryptonite_p256_digit hi_carry = 0; + + for (i=0; i>= P256_BITSPERDIGIT; + } + accum[j] = chain; + + mand = accum[0] * MONTGOMERY_FACTOR; + chain = 0; + mier = P256_DIGITS(&cryptonite_SECP256r1_n); + for (j=0; j>= P256_BITSPERDIGIT; + } + chain += accum[j]; + chain += hi_carry; + accum[j-1] = chain; + hi_carry = chain >> P256_BITSPERDIGIT; + } + + memcpy(P256_DIGITS(c), accum, sizeof(*c)); + borrow = cryptonite_p256_sub(c, &cryptonite_SECP256r1_n, c); + addM(&cryptonite_SECP256r1_n, 0, P256_DIGITS(c), borrow + hi_carry); +} + +// b = 1/a mod n, using Fermat's little theorem. +void cryptonite_p256e_scalar_invert(const cryptonite_p256_int* a, cryptonite_p256_int* b) { + cryptonite_p256_int _1, _10, _11, _101, _111, _1010, _1111; + cryptonite_p256_int _10101, _101010, _101111, x6, x8, x16, x32; + int i; + + // Montgomerize + cryptonite_p256e_montmul(a, &cryptonite_SECP256r1_r2, &_1); + + // P-256 (secp256r1) Scalar Inversion + // + cryptonite_p256e_montmul(&_1 , &_1 , &_10); + cryptonite_p256e_montmul(&_10 , &_1 , &_11); + cryptonite_p256e_montmul(&_10 , &_11 , &_101); + cryptonite_p256e_montmul(&_10 , &_101 , &_111); + cryptonite_p256e_montmul(&_101 , &_101 , &_1010); + cryptonite_p256e_montmul(&_101 , &_1010 , &_1111); + NTH_DOUBLE_THEN_ADD(i, &_1010, 1 , &_1 , &_10101); + cryptonite_p256e_montmul(&_10101 , &_10101 , &_101010); + cryptonite_p256e_montmul(&_101 , &_101010, &_101111); + cryptonite_p256e_montmul(&_10101 , &_101010, &x6); + NTH_DOUBLE_THEN_ADD(i, &x6 , 2 , &_11 , &x8); + NTH_DOUBLE_THEN_ADD(i, &x8 , 8 , &x8 , &x16); + NTH_DOUBLE_THEN_ADD(i, &x16 , 16 , &x16 , &x32); + + NTH_DOUBLE_THEN_ADD(i, &x32 , 32+32, &x32 , b); + NTH_DOUBLE_THEN_ADD(i, b , 32, &x32 , b); + NTH_DOUBLE_THEN_ADD(i, b , 6, &_101111, b); + NTH_DOUBLE_THEN_ADD(i, b , 2 + 3, &_111 , b); + NTH_DOUBLE_THEN_ADD(i, b , 2 + 2, &_11 , b); + NTH_DOUBLE_THEN_ADD(i, b , 1 + 4, &_1111 , b); + NTH_DOUBLE_THEN_ADD(i, b , 5, &_10101 , b); + NTH_DOUBLE_THEN_ADD(i, b , 1 + 3, &_101 , b); + NTH_DOUBLE_THEN_ADD(i, b , 3, &_101 , b); + NTH_DOUBLE_THEN_ADD(i, b , 3, &_101 , b); + NTH_DOUBLE_THEN_ADD(i, b , 2 + 3, &_111 , b); + NTH_DOUBLE_THEN_ADD(i, b , 3 + 6, &_101111, b); + NTH_DOUBLE_THEN_ADD(i, b , 2 + 4, &_1111 , b); + NTH_DOUBLE_THEN_ADD(i, b , 1 + 1, &_1 , b); + NTH_DOUBLE_THEN_ADD(i, b , 4 + 1, &_1 , b); + NTH_DOUBLE_THEN_ADD(i, b , 2 + 4, &_1111 , b); + NTH_DOUBLE_THEN_ADD(i, b , 2 + 3, &_111 , b); + NTH_DOUBLE_THEN_ADD(i, b , 1 + 3, &_111 , b); + NTH_DOUBLE_THEN_ADD(i, b , 2 + 3, &_111 , b); + NTH_DOUBLE_THEN_ADD(i, b , 2 + 3, &_101 , b); + NTH_DOUBLE_THEN_ADD(i, b , 1 + 2, &_11 , b); + NTH_DOUBLE_THEN_ADD(i, b , 4 + 6, &_101111, b); + NTH_DOUBLE_THEN_ADD(i, b , 2, &_11 , b); + NTH_DOUBLE_THEN_ADD(i, b , 3 + 2, &_11 , b); + NTH_DOUBLE_THEN_ADD(i, b , 3 + 2, &_11 , b); + NTH_DOUBLE_THEN_ADD(i, b , 2 + 1, &_1 , b); + NTH_DOUBLE_THEN_ADD(i, b , 2 + 5, &_10101 , b); + NTH_DOUBLE_THEN_ADD(i, b , 2 + 4, &_1111 , b); + + // Demontgomerize + cryptonite_p256e_montmul(b, &cryptonite_SECP256r1_one, b); +} diff --git a/tests/KAT_PubKey/P256.hs b/tests/KAT_PubKey/P256.hs index f04603f..63831ce 100644 --- a/tests/KAT_PubKey/P256.hs +++ b/tests/KAT_PubKey/P256.hs @@ -102,7 +102,21 @@ tests = testGroup "P256" , testProperty "inv" $ \r' -> let inv = inverseCoprimes (unP256 r') curveN inv' = P256.scalarInv (unP256Scalar r') - in if unP256 r' == 0 then True else inv `propertyEq` p256ScalarToInteger inv' + in unP256 r' /= 0 ==> inv `propertyEq` p256ScalarToInteger inv' + , testProperty "inv-safe" $ \r' -> + let inv = P256.scalarInv (unP256Scalar r') + inv' = P256.scalarInvSafe (unP256Scalar r') + in unP256 r' /= 0 ==> inv `propertyEq` inv' + , testProperty "inv-safe-mul" $ \r' -> + let inv = P256.scalarInvSafe (unP256Scalar r') + res = P256.scalarMul (unP256Scalar r') inv + in unP256 r' /= 0 ==> 1 `propertyEq` p256ScalarToInteger res + , testProperty "inv-safe-zero" $ + let inv0 = P256.scalarInvSafe P256.scalarZero + invN = P256.scalarInvSafe P256.scalarN + in propertyHold [ eqTest "scalarZero" P256.scalarZero inv0 + , eqTest "scalarN" P256.scalarZero invN + ] ] , testGroup "point" [ testProperty "marshalling" $ \rx ry ->