New implementation of Curve25519 (using multiplications of words of 15 bits or so...
[BearSSL] / src / inner.h
1 /*
2 * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining
5 * a copy of this software and associated documentation files (the
6 * "Software"), to deal in the Software without restriction, including
7 * without limitation the rights to use, copy, modify, merge, publish,
8 * distribute, sublicense, and/or sell copies of the Software, and to
9 * permit persons to whom the Software is furnished to do so, subject to
10 * the following conditions:
11 *
12 * The above copyright notice and this permission notice shall be
13 * included in all copies or substantial portions of the Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22 * SOFTWARE.
23 */
24
25 #ifndef INNER_H__
26 #define INNER_H__
27
28 #include <string.h>
29 #include <limits.h>
30
31 #include "config.h"
32 #include "bearssl.h"
33
34 /*
35 * Maximum size for a RSA modulus (in bits). Allocated stack buffers
36 * depend on that size, so this value should be kept small. Currently,
37 * 2048-bit RSA keys offer adequate security, and should still do so for
38 * the next few decades; however, a number of widespread PKI have
39 * already set their root keys to RSA-4096, so we should be able to
40 * process such keys.
41 *
42 * This value MUST be a multiple of 64.
43 */
44 #define BR_MAX_RSA_SIZE 4096
45
46 /*
47 * Maximum size for a RSA factor (in bits). This is for RSA private-key
48 * operations. Default is to support factors up to a bit more than half
49 * the maximum modulus size.
50 *
51 * This value MUST be a multiple of 32.
52 */
53 #define BR_MAX_RSA_FACTOR ((BR_MAX_RSA_SIZE + 64) >> 1)
54
55 /*
56 * Maximum size for an EC curve (modulus or order), in bits. Size of
57 * stack buffers depends on that parameter. This size MUST be a multiple
58 * of 8 (so that decoding an integer with that many bytes does not
59 * overflow).
60 */
61 #define BR_MAX_EC_SIZE 528
62
63 /*
64 * Some macros to recognize the current architecture. Right now, we are
65 * interested into automatically recognizing architecture with efficient
66 * 64-bit types so that we may automatically use implementations that
67 * use 64-bit registers in that case. Future versions may detect, e.g.,
68 * availability of SSE2 intrinsics.
69 *
70 * If 'unsigned long' is a 64-bit type, then we assume that 64-bit types
71 * are efficient. Otherwise, we rely on macros that depend on compiler,
72 * OS and architecture. In any case, failure to detect the architecture
73 * as 64-bit means that the 32-bit code will be used, and that code
74 * works also on 64-bit architectures (the 64-bit code may simply be
75 * more efficient).
76 *
77 * The test on 'unsigned long' should already catch most cases, the one
78 * notable exception being Windows code where 'unsigned long' is kept to
79 * 32-bit for compatbility with all the legacy code that liberally uses
80 * the 'DWORD' type for 32-bit values.
81 *
82 * Macro names are taken from: http://nadeausoftware.com/articles/2012/02/c_c_tip_how_detect_processor_type_using_compiler_predefined_macros
83 */
84 #ifndef BR_64
85 #if ((ULONG_MAX >> 31) >> 31) == 3
86 #define BR_64 1
87 #elif defined(__ia64) || defined(__itanium__) || defined(_M_IA64)
88 #define BR_64 1
89 #elif defined(__powerpc64__) || defined(__ppc64__) || defined(__PPC64__) \
90 || defined(__64BIT__) || defined(_LP64) || defined(__LP64__)
91 #define BR_64 1
92 #elif defined(__sparc64__)
93 #define BR_64 1
94 #elif defined(__x86_64__) || defined(_M_X64)
95 #define BR_64 1
96 #endif
97 #endif
98
99 /* ==================================================================== */
100 /*
101 * Encoding/decoding functions.
102 *
103 * 32-bit and 64-bit decoding, both little-endian and big-endian, is
104 * implemented with the inline functions below. These functions are
105 * generic: they don't depend on the architecture natural endianness,
106 * and they can handle unaligned accesses. Optimized versions for some
107 * specific architectures may be implemented at a later time.
108 */
109
110 static inline void
111 br_enc16le(void *dst, unsigned x)
112 {
113 unsigned char *buf;
114
115 buf = dst;
116 buf[0] = (unsigned char)x;
117 buf[1] = (unsigned char)(x >> 8);
118 }
119
120 static inline void
121 br_enc16be(void *dst, unsigned x)
122 {
123 unsigned char *buf;
124
125 buf = dst;
126 buf[0] = (unsigned char)(x >> 8);
127 buf[1] = (unsigned char)x;
128 }
129
130 static inline unsigned
131 br_dec16le(const void *src)
132 {
133 const unsigned char *buf;
134
135 buf = src;
136 return (unsigned)buf[0] | ((unsigned)buf[1] << 8);
137 }
138
139 static inline unsigned
140 br_dec16be(const void *src)
141 {
142 const unsigned char *buf;
143
144 buf = src;
145 return ((unsigned)buf[0] << 8) | (unsigned)buf[1];
146 }
147
148 static inline void
149 br_enc32le(void *dst, uint32_t x)
150 {
151 unsigned char *buf;
152
153 buf = dst;
154 buf[0] = (unsigned char)x;
155 buf[1] = (unsigned char)(x >> 8);
156 buf[2] = (unsigned char)(x >> 16);
157 buf[3] = (unsigned char)(x >> 24);
158 }
159
160 static inline void
161 br_enc32be(void *dst, uint32_t x)
162 {
163 unsigned char *buf;
164
165 buf = dst;
166 buf[0] = (unsigned char)(x >> 24);
167 buf[1] = (unsigned char)(x >> 16);
168 buf[2] = (unsigned char)(x >> 8);
169 buf[3] = (unsigned char)x;
170 }
171
172 static inline uint32_t
173 br_dec32le(const void *src)
174 {
175 const unsigned char *buf;
176
177 buf = src;
178 return (uint32_t)buf[0]
179 | ((uint32_t)buf[1] << 8)
180 | ((uint32_t)buf[2] << 16)
181 | ((uint32_t)buf[3] << 24);
182 }
183
184 static inline uint32_t
185 br_dec32be(const void *src)
186 {
187 const unsigned char *buf;
188
189 buf = src;
190 return ((uint32_t)buf[0] << 24)
191 | ((uint32_t)buf[1] << 16)
192 | ((uint32_t)buf[2] << 8)
193 | (uint32_t)buf[3];
194 }
195
196 static inline void
197 br_enc64le(void *dst, uint64_t x)
198 {
199 unsigned char *buf;
200
201 buf = dst;
202 br_enc32le(buf, (uint32_t)x);
203 br_enc32le(buf + 4, (uint32_t)(x >> 32));
204 }
205
206 static inline void
207 br_enc64be(void *dst, uint64_t x)
208 {
209 unsigned char *buf;
210
211 buf = dst;
212 br_enc32be(buf, (uint32_t)(x >> 32));
213 br_enc32be(buf + 4, (uint32_t)x);
214 }
215
216 static inline uint64_t
217 br_dec64le(const void *src)
218 {
219 const unsigned char *buf;
220
221 buf = src;
222 return (uint64_t)br_dec32le(buf)
223 | ((uint64_t)br_dec32le(buf + 4) << 32);
224 }
225
226 static inline uint64_t
227 br_dec64be(const void *src)
228 {
229 const unsigned char *buf;
230
231 buf = src;
232 return ((uint64_t)br_dec32be(buf) << 32)
233 | (uint64_t)br_dec32be(buf + 4);
234 }
235
236 /*
237 * Range decoding and encoding (for several successive values).
238 */
239 void br_range_dec16le(uint16_t *v, size_t num, const void *src);
240 void br_range_dec16be(uint16_t *v, size_t num, const void *src);
241 void br_range_enc16le(void *dst, const uint16_t *v, size_t num);
242 void br_range_enc16be(void *dst, const uint16_t *v, size_t num);
243
244 void br_range_dec32le(uint32_t *v, size_t num, const void *src);
245 void br_range_dec32be(uint32_t *v, size_t num, const void *src);
246 void br_range_enc32le(void *dst, const uint32_t *v, size_t num);
247 void br_range_enc32be(void *dst, const uint32_t *v, size_t num);
248
249 void br_range_dec64le(uint64_t *v, size_t num, const void *src);
250 void br_range_dec64be(uint64_t *v, size_t num, const void *src);
251 void br_range_enc64le(void *dst, const uint64_t *v, size_t num);
252 void br_range_enc64be(void *dst, const uint64_t *v, size_t num);
253
254 /*
255 * Byte-swap a 32-bit integer.
256 */
257 static inline uint32_t
258 br_swap32(uint32_t x)
259 {
260 x = ((x & (uint32_t)0x00FF00FF) << 8)
261 | ((x >> 8) & (uint32_t)0x00FF00FF);
262 return (x << 16) | (x >> 16);
263 }
264
265 /* ==================================================================== */
266 /*
267 * Support code for hash functions.
268 */
269
270 /*
271 * IV for MD5, SHA-1, SHA-224 and SHA-256.
272 */
273 extern const uint32_t br_md5_IV[];
274 extern const uint32_t br_sha1_IV[];
275 extern const uint32_t br_sha224_IV[];
276 extern const uint32_t br_sha256_IV[];
277
278 /*
279 * Round functions for MD5, SHA-1, SHA-224 and SHA-256 (SHA-224 and
280 * SHA-256 use the same round function).
281 */
282 void br_md5_round(const unsigned char *buf, uint32_t *val);
283 void br_sha1_round(const unsigned char *buf, uint32_t *val);
284 void br_sha2small_round(const unsigned char *buf, uint32_t *val);
285
286 /*
287 * The core function for the TLS PRF. It computes
288 * P_hash(secret, label + seed), and XORs the result into the dst buffer.
289 */
290 void br_tls_phash(void *dst, size_t len,
291 const br_hash_class *dig,
292 const void *secret, size_t secret_len,
293 const char *label, const void *seed, size_t seed_len);
294
295 /*
296 * Copy all configured hash implementations from a multihash context
297 * to another.
298 */
299 static inline void
300 br_multihash_copyimpl(br_multihash_context *dst,
301 const br_multihash_context *src)
302 {
303 memcpy(dst->impl, src->impl, sizeof src->impl);
304 }
305
306 /* ==================================================================== */
307 /*
308 * Constant-time primitives. These functions manipulate 32-bit values in
309 * order to provide constant-time comparisons and multiplexers.
310 *
311 * Boolean values (the "ctl" bits) MUST have value 0 or 1.
312 *
313 * Implementation notes:
314 * =====================
315 *
316 * The uintN_t types are unsigned and with width exactly N bits; the C
317 * standard guarantees that computations are performed modulo 2^N, and
318 * there can be no overflow. Negation (unary '-') works on unsigned types
319 * as well.
320 *
321 * The intN_t types are guaranteed to have width exactly N bits, with no
322 * padding bit, and using two's complement representation. Casting
323 * intN_t to uintN_t really is conversion modulo 2^N. Beware that intN_t
324 * types, being signed, trigger implementation-defined behaviour on
325 * overflow (including raising some signal): with GCC, while modular
326 * arithmetics are usually applied, the optimizer may assume that
327 * overflows don't occur (unless the -fwrapv command-line option is
328 * added); Clang has the additional -ftrapv option to explicitly trap on
329 * integer overflow or underflow.
330 */
331
332 /*
333 * Negate a boolean.
334 */
335 static inline uint32_t
336 NOT(uint32_t ctl)
337 {
338 return ctl ^ 1;
339 }
340
341 /*
342 * Multiplexer: returns x if ctl == 1, y if ctl == 0.
343 */
344 static inline uint32_t
345 MUX(uint32_t ctl, uint32_t x, uint32_t y)
346 {
347 return y ^ (-ctl & (x ^ y));
348 }
349
350 /*
351 * Equality check: returns 1 if x == y, 0 otherwise.
352 */
353 static inline uint32_t
354 EQ(uint32_t x, uint32_t y)
355 {
356 uint32_t q;
357
358 q = x ^ y;
359 return NOT((q | -q) >> 31);
360 }
361
362 /*
363 * Inequality check: returns 1 if x != y, 0 otherwise.
364 */
365 static inline uint32_t
366 NEQ(uint32_t x, uint32_t y)
367 {
368 uint32_t q;
369
370 q = x ^ y;
371 return (q | -q) >> 31;
372 }
373
374 /*
375 * Comparison: returns 1 if x > y, 0 otherwise.
376 */
377 static inline uint32_t
378 GT(uint32_t x, uint32_t y)
379 {
380 /*
381 * If both x < 2^31 and x < 2^31, then y-x will have its high
382 * bit set if x > y, cleared otherwise.
383 *
384 * If either x >= 2^31 or y >= 2^31 (but not both), then the
385 * result is the high bit of x.
386 *
387 * If both x >= 2^31 and y >= 2^31, then we can virtually
388 * subtract 2^31 from both, and we are back to the first case.
389 * Since (y-2^31)-(x-2^31) = y-x, the subtraction is already
390 * fine.
391 */
392 uint32_t z;
393
394 z = y - x;
395 return (z ^ ((x ^ y) & (x ^ z))) >> 31;
396 }
397
398 /*
399 * Other comparisons (greater-or-equal, lower-than, lower-or-equal).
400 */
401 #define GE(x, y) NOT(GT(y, x))
402 #define LT(x, y) GT(y, x)
403 #define LE(x, y) NOT(GT(x, y))
404
405 /*
406 * General comparison: returned value is -1, 0 or 1, depending on
407 * whether x is lower than, equal to, or greater than y.
408 */
409 static inline int32_t
410 CMP(uint32_t x, uint32_t y)
411 {
412 return (int32_t)GT(x, y) | -(int32_t)GT(y, x);
413 }
414
415 /*
416 * Returns 1 if x == 0, 0 otherwise. Take care that the operand is signed.
417 */
418 static inline uint32_t
419 EQ0(int32_t x)
420 {
421 uint32_t q;
422
423 q = (uint32_t)x;
424 return ~(q | -q) >> 31;
425 }
426
427 /*
428 * Returns 1 if x > 0, 0 otherwise. Take care that the operand is signed.
429 */
430 static inline uint32_t
431 GT0(int32_t x)
432 {
433 /*
434 * High bit of -x is 0 if x == 0, but 1 if x > 0.
435 */
436 uint32_t q;
437
438 q = (uint32_t)x;
439 return (~q & -q) >> 31;
440 }
441
442 /*
443 * Returns 1 if x >= 0, 0 otherwise. Take care that the operand is signed.
444 */
445 static inline uint32_t
446 GE0(int32_t x)
447 {
448 return ~(uint32_t)x >> 31;
449 }
450
451 /*
452 * Returns 1 if x < 0, 0 otherwise. Take care that the operand is signed.
453 */
454 static inline uint32_t
455 LT0(int32_t x)
456 {
457 return (uint32_t)x >> 31;
458 }
459
460 /*
461 * Returns 1 if x <= 0, 0 otherwise. Take care that the operand is signed.
462 */
463 static inline uint32_t
464 LE0(int32_t x)
465 {
466 uint32_t q;
467
468 /*
469 * ~-x has its high bit set if and only if -x is nonnegative (as
470 * a signed int), i.e. x is in the -(2^31-1) to 0 range. We must
471 * do an OR with x itself to account for x = -2^31.
472 */
473 q = (uint32_t)x;
474 return (q | ~-q) >> 31;
475 }
476
477 /*
478 * Conditional copy: src[] is copied into dst[] if and only if ctl is 1.
479 * dst[] and src[] may overlap completely (but not partially).
480 */
481 void br_ccopy(uint32_t ctl, void *dst, const void *src, size_t len);
482
483 #define CCOPY br_ccopy
484
485 /*
486 * Compute the bit length of a 32-bit integer. Returned value is between 0
487 * and 32 (inclusive).
488 */
489 static inline uint32_t
490 BIT_LENGTH(uint32_t x)
491 {
492 uint32_t k, c;
493
494 k = NEQ(x, 0);
495 c = GT(x, 0xFFFF); x = MUX(c, x >> 16, x); k += c << 4;
496 c = GT(x, 0x00FF); x = MUX(c, x >> 8, x); k += c << 3;
497 c = GT(x, 0x000F); x = MUX(c, x >> 4, x); k += c << 2;
498 c = GT(x, 0x0003); x = MUX(c, x >> 2, x); k += c << 1;
499 k += GT(x, 0x0001);
500 return k;
501 }
502
503 /*
504 * Compute the minimum of x and y.
505 */
506 static inline uint32_t
507 MIN(uint32_t x, uint32_t y)
508 {
509 return MUX(GT(x, y), y, x);
510 }
511
512 /*
513 * Compute the maximum of x and y.
514 */
515 static inline uint32_t
516 MAX(uint32_t x, uint32_t y)
517 {
518 return MUX(GT(x, y), x, y);
519 }
520
521 /*
522 * Multiply two 32-bit integers, with a 64-bit result. This default
523 * implementation assumes that the basic multiplication operator
524 * yields constant-time code.
525 */
526 #define MUL(x, y) ((uint64_t)(x) * (uint64_t)(y))
527
528 #if BR_CT_MUL31
529
530 /*
531 * Alternate implementation of MUL31, that will be constant-time on some
532 * (old) platforms where the default MUL31 is not. Unfortunately, it is
533 * also substantially slower, and yields larger code, on more modern
534 * platforms, which is why it is deactivated by default.
535 *
536 * MUL31_lo() must do some extra work because on some platforms, the
537 * _signed_ multiplication may return early if the top bits are 1.
538 * Simply truncating (casting) the output of MUL31() would not be
539 * sufficient, because the compiler may notice that we keep only the low
540 * word, and then replace automatically the unsigned multiplication with
541 * a signed multiplication opcode.
542 */
543 #define MUL31(x, y) ((uint64_t)((x) | (uint32_t)0x80000000) \
544 * (uint64_t)((y) | (uint32_t)0x80000000) \
545 - ((uint64_t)(x) << 31) - ((uint64_t)(y) << 31) \
546 - ((uint64_t)1 << 62))
547 static inline uint32_t
548 MUL31_lo(uint32_t x, uint32_t y)
549 {
550 uint32_t xl, xh;
551 uint32_t yl, yh;
552
553 xl = (x & 0xFFFF) | (uint32_t)0x80000000;
554 xh = (x >> 16) | (uint32_t)0x80000000;
555 yl = (y & 0xFFFF) | (uint32_t)0x80000000;
556 yh = (y >> 16) | (uint32_t)0x80000000;
557 return (xl * yl + ((xl * yh + xh * yl) << 16)) & (uint32_t)0x7FFFFFFF;
558 }
559
560 #else
561
562 /*
563 * Multiply two 31-bit integers, with a 62-bit result. This default
564 * implementation assumes that the basic multiplication operator
565 * yields constant-time code.
566 * The MUL31_lo() macro returns only the low 31 bits of the product.
567 */
568 #define MUL31(x, y) ((uint64_t)(x) * (uint64_t)(y))
569 #define MUL31_lo(x, y) (((uint32_t)(x) * (uint32_t)(y)) & (uint32_t)0x7FFFFFFF)
570
571 #endif
572
573 /*
574 * Multiply two words together; the sum of the lengths of the two
575 * operands must not exceed 31 (for instance, one operand may use 16
576 * bits if the other fits on 15). If BR_CT_MUL15 is non-zero, then the
577 * macro will contain some extra operations that help in making the
578 * operation constant-time on some platforms, where the basic 32-bit
579 * multiplication is not constant-time.
580 */
581 #if BR_CT_MUL15
582 #define MUL15(x, y) (((uint32_t)(x) | (uint32_t)0x80000000) \
583 * ((uint32_t)(y) | (uint32_t)0x80000000) \
584 & (uint32_t)0x7FFFFFFF)
585 #else
586 #define MUL15(x, y) ((uint32_t)(x) * (uint32_t)(y))
587 #endif
588
589 /*
590 * Arithmetic right shift (sign bit is copied). What happens when
591 * right-shifting a negative value is _implementation-defined_, so it
592 * does not trigger undefined behaviour, but it is still up to each
593 * compiler to define (and document) what it does. Most/all compilers
594 * will do an arithmetic shift, the sign bit being used to fill the
595 * holes; this is a native operation on the underlying CPU, and it would
596 * make little sense for the compiler to do otherwise. GCC explicitly
597 * documents that it follows that convention.
598 *
599 * Still, if BR_NO_ARITH_SHIFT is defined (and non-zero), then an
600 * alternate version will be used, that does not rely on such
601 * implementation-defined behaviour. Unfortunately, it is also slower
602 * and yields bigger code, which is why it is deactivated by default.
603 */
604 #if BR_NO_ARITH_SHIFT
605 #define ARSH(x, n) (((uint32_t)(x) >> (n)) \
606 | ((-((uint32_t)(x) >> 31)) << (32 - (n))))
607 #else
608 #define ARSH(x, n) ((*(int32_t *)&(x)) >> (n))
609 #endif
610
611 /*
612 * Constant-time division. The dividend hi:lo is divided by the
613 * divisor d; the quotient is returned and the remainder is written
614 * in *r. If hi == d, then the quotient does not fit on 32 bits;
615 * returned value is thus truncated. If hi > d, returned values are
616 * indeterminate.
617 */
618 uint32_t br_divrem(uint32_t hi, uint32_t lo, uint32_t d, uint32_t *r);
619
620 /*
621 * Wrapper for br_divrem(); the remainder is returned, and the quotient
622 * is discarded.
623 */
624 static inline uint32_t
625 br_rem(uint32_t hi, uint32_t lo, uint32_t d)
626 {
627 uint32_t r;
628
629 br_divrem(hi, lo, d, &r);
630 return r;
631 }
632
633 /*
634 * Wrapper for br_divrem(); the quotient is returned, and the remainder
635 * is discarded.
636 */
637 static inline uint32_t
638 br_div(uint32_t hi, uint32_t lo, uint32_t d)
639 {
640 uint32_t r;
641
642 return br_divrem(hi, lo, d, &r);
643 }
644
645 /* ==================================================================== */
646
647 /*
648 * Integers 'i32'
649 * --------------
650 *
651 * The 'i32' functions implement computations on big integers using
652 * an internal representation as an array of 32-bit integers. For
653 * an array x[]:
654 * -- x[0] contains the "announced bit length" of the integer
655 * -- x[1], x[2]... contain the value in little-endian order (x[1]
656 * contains the least significant 32 bits)
657 *
658 * Multiplications rely on the elementary 32x32->64 multiplication.
659 *
660 * The announced bit length specifies the number of bits that are
661 * significant in the subsequent 32-bit words. Unused bits in the
662 * last (most significant) word are set to 0; subsequent words are
663 * uninitialized and need not exist at all.
664 *
665 * The execution time and memory access patterns of all computations
666 * depend on the announced bit length, but not on the actual word
667 * values. For modular integers, the announced bit length of any integer
668 * modulo n is equal to the actual bit length of n; thus, computations
669 * on modular integers are "constant-time" (only the modulus length may
670 * leak).
671 */
672
673 /*
674 * Compute the actual bit length of an integer. The argument x should
675 * point to the first (least significant) value word of the integer.
676 * The len 'xlen' contains the number of 32-bit words to access.
677 *
678 * CT: value or length of x does not leak.
679 */
680 uint32_t br_i32_bit_length(uint32_t *x, size_t xlen);
681
682 /*
683 * Decode an integer from its big-endian unsigned representation. The
684 * "true" bit length of the integer is computed, but all words of x[]
685 * corresponding to the full 'len' bytes of the source are set.
686 *
687 * CT: value or length of x does not leak.
688 */
689 void br_i32_decode(uint32_t *x, const void *src, size_t len);
690
691 /*
692 * Decode an integer from its big-endian unsigned representation. The
693 * integer MUST be lower than m[]; the announced bit length written in
694 * x[] will be equal to that of m[]. All 'len' bytes from the source are
695 * read.
696 *
697 * Returned value is 1 if the decode value fits within the modulus, 0
698 * otherwise. In the latter case, the x[] buffer will be set to 0 (but
699 * still with the announced bit length of m[]).
700 *
701 * CT: value or length of x does not leak. Memory access pattern depends
702 * only of 'len' and the announced bit length of m. Whether x fits or
703 * not does not leak either.
704 */
705 uint32_t br_i32_decode_mod(uint32_t *x,
706 const void *src, size_t len, const uint32_t *m);
707
708 /*
709 * Reduce an integer (a[]) modulo another (m[]). The result is written
710 * in x[] and its announced bit length is set to be equal to that of m[].
711 *
712 * x[] MUST be distinct from a[] and m[].
713 *
714 * CT: only announced bit lengths leak, not values of x, a or m.
715 */
716 void br_i32_reduce(uint32_t *x, const uint32_t *a, const uint32_t *m);
717
718 /*
719 * Decode an integer from its big-endian unsigned representation, and
720 * reduce it modulo the provided modulus m[]. The announced bit length
721 * of the result is set to be equal to that of the modulus.
722 *
723 * x[] MUST be distinct from m[].
724 */
725 void br_i32_decode_reduce(uint32_t *x,
726 const void *src, size_t len, const uint32_t *m);
727
728 /*
729 * Encode an integer into its big-endian unsigned representation. The
730 * output length in bytes is provided (parameter 'len'); if the length
731 * is too short then the integer is appropriately truncated; if it is
732 * too long then the extra bytes are set to 0.
733 */
734 void br_i32_encode(void *dst, size_t len, const uint32_t *x);
735
736 /*
737 * Multiply x[] by 2^32 and then add integer z, modulo m[]. This
738 * function assumes that x[] and m[] have the same announced bit
739 * length, and the announced bit length of m[] matches its true
740 * bit length.
741 *
742 * x[] and m[] MUST be distinct arrays.
743 *
744 * CT: only the common announced bit length of x and m leaks, not
745 * the values of x, z or m.
746 */
747 void br_i32_muladd_small(uint32_t *x, uint32_t z, const uint32_t *m);
748
749 /*
750 * Extract one word from an integer. The offset is counted in bits.
751 * The word MUST entirely fit within the word elements corresponding
752 * to the announced bit length of a[].
753 */
754 static inline uint32_t
755 br_i32_word(const uint32_t *a, uint32_t off)
756 {
757 size_t u;
758 unsigned j;
759
760 u = (size_t)(off >> 5) + 1;
761 j = (unsigned)off & 31;
762 if (j == 0) {
763 return a[u];
764 } else {
765 return (a[u] >> j) | (a[u + 1] << (32 - j));
766 }
767 }
768
769 /*
770 * Test whether an integer is zero.
771 */
772 uint32_t br_i32_iszero(const uint32_t *x);
773
774 /*
775 * Add b[] to a[] and return the carry (0 or 1). If ctl is 0, then a[]
776 * is unmodified, but the carry is still computed and returned. The
777 * arrays a[] and b[] MUST have the same announced bit length.
778 *
779 * a[] and b[] MAY be the same array, but partial overlap is not allowed.
780 */
781 uint32_t br_i32_add(uint32_t *a, const uint32_t *b, uint32_t ctl);
782
783 /*
784 * Subtract b[] from a[] and return the carry (0 or 1). If ctl is 0,
785 * then a[] is unmodified, but the carry is still computed and returned.
786 * The arrays a[] and b[] MUST have the same announced bit length.
787 *
788 * a[] and b[] MAY be the same array, but partial overlap is not allowed.
789 */
790 uint32_t br_i32_sub(uint32_t *a, const uint32_t *b, uint32_t ctl);
791
792 /*
793 * Compute d+a*b, result in d. The initial announced bit length of d[]
794 * MUST match that of a[]. The d[] array MUST be large enough to
795 * accommodate the full result, plus (possibly) an extra word. The
796 * resulting announced bit length of d[] will be the sum of the announced
797 * bit lengths of a[] and b[] (therefore, it may be larger than the actual
798 * bit length of the numerical result).
799 *
800 * a[] and b[] may be the same array. d[] must be disjoint from both a[]
801 * and b[].
802 */
803 void br_i32_mulacc(uint32_t *d, const uint32_t *a, const uint32_t *b);
804
805 /*
806 * Zeroize an integer. The announced bit length is set to the provided
807 * value, and the corresponding words are set to 0.
808 */
809 static inline void
810 br_i32_zero(uint32_t *x, uint32_t bit_len)
811 {
812 *x ++ = bit_len;
813 memset(x, 0, ((bit_len + 31) >> 5) * sizeof *x);
814 }
815
816 /*
817 * Compute -(1/x) mod 2^32. If x is even, then this function returns 0.
818 */
819 uint32_t br_i32_ninv32(uint32_t x);
820
821 /*
822 * Convert a modular integer to Montgomery representation. The integer x[]
823 * MUST be lower than m[], but with the same announced bit length.
824 */
825 void br_i32_to_monty(uint32_t *x, const uint32_t *m);
826
827 /*
828 * Convert a modular integer back from Montgomery representation. The
829 * integer x[] MUST be lower than m[], but with the same announced bit
830 * length. The "m0i" parameter is equal to -(1/m0) mod 2^32, where m0 is
831 * the least significant value word of m[] (this works only if m[] is
832 * an odd integer).
833 */
834 void br_i32_from_monty(uint32_t *x, const uint32_t *m, uint32_t m0i);
835
836 /*
837 * Compute a modular Montgomery multiplication. d[] is filled with the
838 * value of x*y/R modulo m[] (where R is the Montgomery factor). The
839 * array d[] MUST be distinct from x[], y[] and m[]. x[] and y[] MUST be
840 * numerically lower than m[]. x[] and y[] MAY be the same array. The
841 * "m0i" parameter is equal to -(1/m0) mod 2^32, where m0 is the least
842 * significant value word of m[] (this works only if m[] is an odd
843 * integer).
844 */
845 void br_i32_montymul(uint32_t *d, const uint32_t *x, const uint32_t *y,
846 const uint32_t *m, uint32_t m0i);
847
848 /*
849 * Compute a modular exponentiation. x[] MUST be an integer modulo m[]
850 * (same announced bit length, lower value). m[] MUST be odd. The
851 * exponent is in big-endian unsigned notation, over 'elen' bytes. The
852 * "m0i" parameter is equal to -(1/m0) mod 2^32, where m0 is the least
853 * significant value word of m[] (this works only if m[] is an odd
854 * integer). The t1[] and t2[] parameters must be temporary arrays,
855 * each large enough to accommodate an integer with the same size as m[].
856 */
857 void br_i32_modpow(uint32_t *x, const unsigned char *e, size_t elen,
858 const uint32_t *m, uint32_t m0i, uint32_t *t1, uint32_t *t2);
859
860 /* ==================================================================== */
861
862 /*
863 * Integers 'i31'
864 * --------------
865 *
866 * The 'i31' functions implement computations on big integers using
867 * an internal representation as an array of 32-bit integers. For
868 * an array x[]:
869 * -- x[0] encodes the array length and the "announced bit length"
870 * of the integer: namely, if the announced bit length is k,
871 * then x[0] = ((k / 31) << 5) + (k % 31).
872 * -- x[1], x[2]... contain the value in little-endian order, 31
873 * bits per word (x[1] contains the least significant 31 bits).
874 * The upper bit of each word is 0.
875 *
876 * Multiplications rely on the elementary 32x32->64 multiplication.
877 *
878 * The announced bit length specifies the number of bits that are
879 * significant in the subsequent 32-bit words. Unused bits in the
880 * last (most significant) word are set to 0; subsequent words are
881 * uninitialized and need not exist at all.
882 *
883 * The execution time and memory access patterns of all computations
884 * depend on the announced bit length, but not on the actual word
885 * values. For modular integers, the announced bit length of any integer
886 * modulo n is equal to the actual bit length of n; thus, computations
887 * on modular integers are "constant-time" (only the modulus length may
888 * leak).
889 */
890
891 /*
892 * Test whether an integer is zero.
893 */
894 uint32_t br_i31_iszero(const uint32_t *x);
895
896 /*
897 * Add b[] to a[] and return the carry (0 or 1). If ctl is 0, then a[]
898 * is unmodified, but the carry is still computed and returned. The
899 * arrays a[] and b[] MUST have the same announced bit length.
900 *
901 * a[] and b[] MAY be the same array, but partial overlap is not allowed.
902 */
903 uint32_t br_i31_add(uint32_t *a, const uint32_t *b, uint32_t ctl);
904
905 /*
906 * Subtract b[] from a[] and return the carry (0 or 1). If ctl is 0,
907 * then a[] is unmodified, but the carry is still computed and returned.
908 * The arrays a[] and b[] MUST have the same announced bit length.
909 *
910 * a[] and b[] MAY be the same array, but partial overlap is not allowed.
911 */
912 uint32_t br_i31_sub(uint32_t *a, const uint32_t *b, uint32_t ctl);
913
914 /*
915 * Compute the ENCODED actual bit length of an integer. The argument x
916 * should point to the first (least significant) value word of the
917 * integer. The len 'xlen' contains the number of 32-bit words to
918 * access. The upper bit of each value word MUST be 0.
919 * Returned value is ((k / 31) << 5) + (k % 31) if the bit length is k.
920 *
921 * CT: value or length of x does not leak.
922 */
923 uint32_t br_i31_bit_length(uint32_t *x, size_t xlen);
924
925 /*
926 * Decode an integer from its big-endian unsigned representation. The
927 * "true" bit length of the integer is computed and set in the encoded
928 * announced bit length (x[0]), but all words of x[] corresponding to
929 * the full 'len' bytes of the source are set.
930 *
931 * CT: value or length of x does not leak.
932 */
933 void br_i31_decode(uint32_t *x, const void *src, size_t len);
934
935 /*
936 * Decode an integer from its big-endian unsigned representation. The
937 * integer MUST be lower than m[]; the (encoded) announced bit length
938 * written in x[] will be equal to that of m[]. All 'len' bytes from the
939 * source are read.
940 *
941 * Returned value is 1 if the decode value fits within the modulus, 0
942 * otherwise. In the latter case, the x[] buffer will be set to 0 (but
943 * still with the announced bit length of m[]).
944 *
945 * CT: value or length of x does not leak. Memory access pattern depends
946 * only of 'len' and the announced bit length of m. Whether x fits or
947 * not does not leak either.
948 */
949 uint32_t br_i31_decode_mod(uint32_t *x,
950 const void *src, size_t len, const uint32_t *m);
951
952 /*
953 * Zeroize an integer. The announced bit length is set to the provided
954 * value, and the corresponding words are set to 0. The ENCODED bit length
955 * is expected here.
956 */
957 static inline void
958 br_i31_zero(uint32_t *x, uint32_t bit_len)
959 {
960 *x ++ = bit_len;
961 memset(x, 0, ((bit_len + 31) >> 5) * sizeof *x);
962 }
963
964 /*
965 * Right-shift an integer. The shift amount must be lower than 31
966 * bits.
967 */
968 void br_i31_rshift(uint32_t *x, int count);
969
970 /*
971 * Reduce an integer (a[]) modulo another (m[]). The result is written
972 * in x[] and its announced bit length is set to be equal to that of m[].
973 *
974 * x[] MUST be distinct from a[] and m[].
975 *
976 * CT: only announced bit lengths leak, not values of x, a or m.
977 */
978 void br_i31_reduce(uint32_t *x, const uint32_t *a, const uint32_t *m);
979
980 /*
981 * Decode an integer from its big-endian unsigned representation, and
982 * reduce it modulo the provided modulus m[]. The announced bit length
983 * of the result is set to be equal to that of the modulus.
984 *
985 * x[] MUST be distinct from m[].
986 */
987 void br_i31_decode_reduce(uint32_t *x,
988 const void *src, size_t len, const uint32_t *m);
989
990 /*
991 * Multiply x[] by 2^31 and then add integer z, modulo m[]. This
992 * function assumes that x[] and m[] have the same announced bit
993 * length, the announced bit length of m[] matches its true
994 * bit length.
995 *
996 * x[] and m[] MUST be distinct arrays. z MUST fit in 31 bits (upper
997 * bit set to 0).
998 *
999 * CT: only the common announced bit length of x and m leaks, not
1000 * the values of x, z or m.
1001 */
1002 void br_i31_muladd_small(uint32_t *x, uint32_t z, const uint32_t *m);
1003
1004 /*
1005 * Encode an integer into its big-endian unsigned representation. The
1006 * output length in bytes is provided (parameter 'len'); if the length
1007 * is too short then the integer is appropriately truncated; if it is
1008 * too long then the extra bytes are set to 0.
1009 */
1010 void br_i31_encode(void *dst, size_t len, const uint32_t *x);
1011
1012 /*
1013 * Compute -(1/x) mod 2^31. If x is even, then this function returns 0.
1014 */
1015 uint32_t br_i31_ninv31(uint32_t x);
1016
1017 /*
1018 * Compute a modular Montgomery multiplication. d[] is filled with the
1019 * value of x*y/R modulo m[] (where R is the Montgomery factor). The
1020 * array d[] MUST be distinct from x[], y[] and m[]. x[] and y[] MUST be
1021 * numerically lower than m[]. x[] and y[] MAY be the same array. The
1022 * "m0i" parameter is equal to -(1/m0) mod 2^31, where m0 is the least
1023 * significant value word of m[] (this works only if m[] is an odd
1024 * integer).
1025 */
1026 void br_i31_montymul(uint32_t *d, const uint32_t *x, const uint32_t *y,
1027 const uint32_t *m, uint32_t m0i);
1028
1029 /*
1030 * Convert a modular integer to Montgomery representation. The integer x[]
1031 * MUST be lower than m[], but with the same announced bit length.
1032 */
1033 void br_i31_to_monty(uint32_t *x, const uint32_t *m);
1034
1035 /*
1036 * Convert a modular integer back from Montgomery representation. The
1037 * integer x[] MUST be lower than m[], but with the same announced bit
1038 * length. The "m0i" parameter is equal to -(1/m0) mod 2^32, where m0 is
1039 * the least significant value word of m[] (this works only if m[] is
1040 * an odd integer).
1041 */
1042 void br_i31_from_monty(uint32_t *x, const uint32_t *m, uint32_t m0i);
1043
1044 /*
1045 * Compute a modular exponentiation. x[] MUST be an integer modulo m[]
1046 * (same announced bit length, lower value). m[] MUST be odd. The
1047 * exponent is in big-endian unsigned notation, over 'elen' bytes. The
1048 * "m0i" parameter is equal to -(1/m0) mod 2^31, where m0 is the least
1049 * significant value word of m[] (this works only if m[] is an odd
1050 * integer). The t1[] and t2[] parameters must be temporary arrays,
1051 * each large enough to accommodate an integer with the same size as m[].
1052 */
1053 void br_i31_modpow(uint32_t *x, const unsigned char *e, size_t elen,
1054 const uint32_t *m, uint32_t m0i, uint32_t *t1, uint32_t *t2);
1055
1056 /*
1057 * Compute d+a*b, result in d. The initial announced bit length of d[]
1058 * MUST match that of a[]. The d[] array MUST be large enough to
1059 * accommodate the full result, plus (possibly) an extra word. The
1060 * resulting announced bit length of d[] will be the sum of the announced
1061 * bit lengths of a[] and b[] (therefore, it may be larger than the actual
1062 * bit length of the numerical result).
1063 *
1064 * a[] and b[] may be the same array. d[] must be disjoint from both a[]
1065 * and b[].
1066 */
1067 void br_i31_mulacc(uint32_t *d, const uint32_t *a, const uint32_t *b);
1068
1069 /* ==================================================================== */
1070
1071 static inline void
1072 br_i15_zero(uint16_t *x, uint16_t bit_len)
1073 {
1074 *x ++ = bit_len;
1075 memset(x, 0, ((bit_len + 15) >> 4) * sizeof *x);
1076 }
1077
1078 uint32_t br_i15_iszero(const uint16_t *x);
1079
1080 uint16_t br_i15_ninv15(uint16_t x);
1081
1082 uint32_t br_i15_add(uint16_t *a, const uint16_t *b, uint32_t ctl);
1083
1084 uint32_t br_i15_sub(uint16_t *a, const uint16_t *b, uint32_t ctl);
1085
1086 void br_i15_muladd_small(uint16_t *x, uint16_t z, const uint16_t *m);
1087
1088 void br_i15_montymul(uint16_t *d, const uint16_t *x, const uint16_t *y,
1089 const uint16_t *m, uint16_t m0i);
1090
1091 void br_i15_to_monty(uint16_t *x, const uint16_t *m);
1092
1093 void br_i15_modpow(uint16_t *x, const unsigned char *e, size_t elen,
1094 const uint16_t *m, uint16_t m0i, uint16_t *t1, uint16_t *t2);
1095
1096 void br_i15_encode(void *dst, size_t len, const uint16_t *x);
1097
1098 uint32_t br_i15_decode_mod(uint16_t *x,
1099 const void *src, size_t len, const uint16_t *m);
1100
1101 void br_i15_rshift(uint16_t *x, int count);
1102
1103 uint32_t br_i15_bit_length(uint16_t *x, size_t xlen);
1104
1105 void br_i15_decode(uint16_t *x, const void *src, size_t len);
1106
1107 void br_i15_from_monty(uint16_t *x, const uint16_t *m, uint16_t m0i);
1108
1109 void br_i15_decode_reduce(uint16_t *x,
1110 const void *src, size_t len, const uint16_t *m);
1111
1112 void br_i15_reduce(uint16_t *x, const uint16_t *a, const uint16_t *m);
1113
1114 void br_i15_mulacc(uint16_t *d, const uint16_t *a, const uint16_t *b);
1115
1116 /* ==================================================================== */
1117
1118 static inline size_t
1119 br_digest_size(const br_hash_class *digest_class)
1120 {
1121 return (size_t)(digest_class->desc >> BR_HASHDESC_OUT_OFF)
1122 & BR_HASHDESC_OUT_MASK;
1123 }
1124
1125 /*
1126 * Get the output size (in bytes) of a hash function.
1127 */
1128 size_t br_digest_size_by_ID(int digest_id);
1129
1130 /*
1131 * Get the OID (encoded OBJECT IDENTIFIER value, without tag and length)
1132 * for a hash function. If digest_id is not a supported digest identifier
1133 * (in particular if it is equal to 0, i.e. br_md5sha1_ID), then NULL is
1134 * returned and *len is set to 0.
1135 */
1136 const unsigned char *br_digest_OID(int digest_id, size_t *len);
1137
1138 /* ==================================================================== */
1139 /*
1140 * DES support functions.
1141 */
1142
1143 /*
1144 * Apply DES Initial Permutation.
1145 */
1146 void br_des_do_IP(uint32_t *xl, uint32_t *xr);
1147
1148 /*
1149 * Apply DES Final Permutation (inverse of IP).
1150 */
1151 void br_des_do_invIP(uint32_t *xl, uint32_t *xr);
1152
1153 /*
1154 * Key schedule unit: for a DES key (8 bytes), compute 16 subkeys. Each
1155 * subkey is two 28-bit words represented as two 32-bit words; the PC-2
1156 * bit extration is NOT applied.
1157 */
1158 void br_des_keysched_unit(uint32_t *skey, const void *key);
1159
1160 /*
1161 * Reversal of 16 DES sub-keys (for decryption).
1162 */
1163 void br_des_rev_skey(uint32_t *skey);
1164
1165 /*
1166 * DES/3DES key schedule for 'des_tab' (encryption direction). Returned
1167 * value is the number of rounds.
1168 */
1169 unsigned br_des_tab_keysched(uint32_t *skey, const void *key, size_t key_len);
1170
1171 /*
1172 * DES/3DES key schedule for 'des_ct' (encryption direction). Returned
1173 * value is the number of rounds.
1174 */
1175 unsigned br_des_ct_keysched(uint32_t *skey, const void *key, size_t key_len);
1176
1177 /*
1178 * DES/3DES subkey decompression (from the compressed bitsliced subkeys).
1179 */
1180 void br_des_ct_skey_expand(uint32_t *sk_exp,
1181 unsigned num_rounds, const uint32_t *skey);
1182
1183 /*
1184 * DES/3DES block encryption/decryption ('des_tab').
1185 */
1186 void br_des_tab_process_block(unsigned num_rounds,
1187 const uint32_t *skey, void *block);
1188
1189 /*
1190 * DES/3DES block encryption/decryption ('des_ct').
1191 */
1192 void br_des_ct_process_block(unsigned num_rounds,
1193 const uint32_t *skey, void *block);
1194
1195 /* ==================================================================== */
1196 /*
1197 * AES support functions.
1198 */
1199
1200 /*
1201 * The AES S-box (256-byte table).
1202 */
1203 extern const unsigned char br_aes_S[];
1204
1205 /*
1206 * AES key schedule. skey[] is filled with n+1 128-bit subkeys, where n
1207 * is the number of rounds (10 to 14, depending on key size). The number
1208 * of rounds is returned. If the key size is invalid (not 16, 24 or 32),
1209 * then 0 is returned.
1210 *
1211 * This implementation uses a 256-byte table and is NOT constant-time.
1212 */
1213 unsigned br_aes_keysched(uint32_t *skey, const void *key, size_t key_len);
1214
1215 /*
1216 * AES key schedule for decryption ('aes_big' implementation).
1217 */
1218 unsigned br_aes_big_keysched_inv(uint32_t *skey,
1219 const void *key, size_t key_len);
1220
1221 /*
1222 * AES block encryption with the 'aes_big' implementation (fast, but
1223 * not constant-time). This function encrypts a single block "in place".
1224 */
1225 void br_aes_big_encrypt(unsigned num_rounds, const uint32_t *skey, void *data);
1226
1227 /*
1228 * AES block decryption with the 'aes_big' implementation (fast, but
1229 * not constant-time). This function decrypts a single block "in place".
1230 */
1231 void br_aes_big_decrypt(unsigned num_rounds, const uint32_t *skey, void *data);
1232
1233 /*
1234 * AES block encryption with the 'aes_small' implementation (small, but
1235 * slow and not constant-time). This function encrypts a single block
1236 * "in place".
1237 */
1238 void br_aes_small_encrypt(unsigned num_rounds,
1239 const uint32_t *skey, void *data);
1240
1241 /*
1242 * AES block decryption with the 'aes_small' implementation (small, but
1243 * slow and not constant-time). This function decrypts a single block
1244 * "in place".
1245 */
1246 void br_aes_small_decrypt(unsigned num_rounds,
1247 const uint32_t *skey, void *data);
1248
1249 /*
1250 * The constant-time implementation is "bitsliced": the 128-bit state is
1251 * split over eight 32-bit words q* in the following way:
1252 *
1253 * -- Input block consists in 16 bytes:
1254 * a00 a10 a20 a30 a01 a11 a21 a31 a02 a12 a22 a32 a03 a13 a23 a33
1255 * In the terminology of FIPS 197, this is a 4x4 matrix which is read
1256 * column by column.
1257 *
1258 * -- Each byte is split into eight bits which are distributed over the
1259 * eight words, at the same rank. Thus, for a byte x at rank k, bit 0
1260 * (least significant) of x will be at rank k in q0 (if that bit is b,
1261 * then it contributes "b << k" to the value of q0), bit 1 of x will be
1262 * at rank k in q1, and so on.
1263 *
1264 * -- Ranks given to bits are in "row order" and are either all even, or
1265 * all odd. Two independent AES states are thus interleaved, one using
1266 * the even ranks, the other the odd ranks. Row order means:
1267 * a00 a01 a02 a03 a10 a11 a12 a13 a20 a21 a22 a23 a30 a31 a32 a33
1268 *
1269 * Converting input bytes from two AES blocks to bitslice representation
1270 * is done in the following way:
1271 * -- Decode first block into the four words q0 q2 q4 q6, in that order,
1272 * using little-endian convention.
1273 * -- Decode second block into the four words q1 q3 q5 q7, in that order,
1274 * using little-endian convention.
1275 * -- Call br_aes_ct_ortho().
1276 *
1277 * Converting back to bytes is done by using the reverse operations. Note
1278 * that br_aes_ct_ortho() is its own inverse.
1279 */
1280
1281 /*
1282 * Perform bytewise orthogonalization of eight 32-bit words. Bytes
1283 * of q0..q7 are spread over all words: for a byte x that occurs
1284 * at rank i in q[j] (byte x uses bits 8*i to 8*i+7 in q[j]), the bit
1285 * of rank k in x (0 <= k <= 7) goes to q[k] at rank 8*i+j.
1286 *
1287 * This operation is an involution.
1288 */
1289 void br_aes_ct_ortho(uint32_t *q);
1290
1291 /*
1292 * The AES S-box, as a bitsliced constant-time version. The input array
1293 * consists in eight 32-bit words; 32 S-box instances are computed in
1294 * parallel. Bits 0 to 7 of each S-box input (bit 0 is least significant)
1295 * are spread over the words 0 to 7, at the same rank.
1296 */
1297 void br_aes_ct_bitslice_Sbox(uint32_t *q);
1298
1299 /*
1300 * Like br_aes_bitslice_Sbox(), but for the inverse S-box.
1301 */
1302 void br_aes_ct_bitslice_invSbox(uint32_t *q);
1303
1304 /*
1305 * Compute AES encryption on bitsliced data. Since input is stored on
1306 * eight 32-bit words, two block encryptions are actually performed
1307 * in parallel.
1308 */
1309 void br_aes_ct_bitslice_encrypt(unsigned num_rounds,
1310 const uint32_t *skey, uint32_t *q);
1311
1312 /*
1313 * Compute AES decryption on bitsliced data. Since input is stored on
1314 * eight 32-bit words, two block decryptions are actually performed
1315 * in parallel.
1316 */
1317 void br_aes_ct_bitslice_decrypt(unsigned num_rounds,
1318 const uint32_t *skey, uint32_t *q);
1319
1320 /*
1321 * AES key schedule, constant-time version. skey[] is filled with n+1
1322 * 128-bit subkeys, where n is the number of rounds (10 to 14, depending
1323 * on key size). The number of rounds is returned. If the key size is
1324 * invalid (not 16, 24 or 32), then 0 is returned.
1325 */
1326 unsigned br_aes_ct_keysched(uint32_t *comp_skey,
1327 const void *key, size_t key_len);
1328
1329 /*
1330 * Expand AES subkeys as produced by br_aes_ct_keysched(), into
1331 * a larger array suitable for br_aes_ct_bitslice_encrypt() and
1332 * br_aes_ct_bitslice_decrypt().
1333 */
1334 void br_aes_ct_skey_expand(uint32_t *skey,
1335 unsigned num_rounds, const uint32_t *comp_skey);
1336
1337 /*
1338 * For the ct64 implementation, the same bitslicing technique is used,
1339 * but four instances are interleaved. First instance uses bits 0, 4,
1340 * 8, 12,... of each word; second instance uses bits 1, 5, 9, 13,...
1341 * and so on.
1342 */
1343
1344 /*
1345 * Perform bytewise orthogonalization of eight 64-bit words. Bytes
1346 * of q0..q7 are spread over all words: for a byte x that occurs
1347 * at rank i in q[j] (byte x uses bits 8*i to 8*i+7 in q[j]), the bit
1348 * of rank k in x (0 <= k <= 7) goes to q[k] at rank 8*i+j.
1349 *
1350 * This operation is an involution.
1351 */
1352 void br_aes_ct64_ortho(uint64_t *q);
1353
1354 /*
1355 * Interleave bytes for an AES input block. If input bytes are
1356 * denoted 0123456789ABCDEF, and have been decoded with little-endian
1357 * convention (w[0] contains 0123, with '3' being most significant;
1358 * w[1] contains 4567, and so on), then output word q0 will be
1359 * set to 08192A3B (again little-endian convention) and q1 will
1360 * be set to 4C5D6E7F.
1361 */
1362 void br_aes_ct64_interleave_in(uint64_t *q0, uint64_t *q1, const uint32_t *w);
1363
1364 /*
1365 * Perform the opposite of br_aes_ct64_interleave_in().
1366 */
1367 void br_aes_ct64_interleave_out(uint32_t *w, uint64_t q0, uint64_t q1);
1368
1369 /*
1370 * The AES S-box, as a bitsliced constant-time version. The input array
1371 * consists in eight 64-bit words; 64 S-box instances are computed in
1372 * parallel. Bits 0 to 7 of each S-box input (bit 0 is least significant)
1373 * are spread over the words 0 to 7, at the same rank.
1374 */
1375 void br_aes_ct64_bitslice_Sbox(uint64_t *q);
1376
1377 /*
1378 * Like br_aes_bitslice_Sbox(), but for the inverse S-box.
1379 */
1380 void br_aes_ct64_bitslice_invSbox(uint64_t *q);
1381
1382 /*
1383 * Compute AES encryption on bitsliced data. Since input is stored on
1384 * eight 64-bit words, four block encryptions are actually performed
1385 * in parallel.
1386 */
1387 void br_aes_ct64_bitslice_encrypt(unsigned num_rounds,
1388 const uint64_t *skey, uint64_t *q);
1389
1390 /*
1391 * Compute AES decryption on bitsliced data. Since input is stored on
1392 * eight 64-bit words, four block decryptions are actually performed
1393 * in parallel.
1394 */
1395 void br_aes_ct64_bitslice_decrypt(unsigned num_rounds,
1396 const uint64_t *skey, uint64_t *q);
1397
1398 /*
1399 * AES key schedule, constant-time version. skey[] is filled with n+1
1400 * 128-bit subkeys, where n is the number of rounds (10 to 14, depending
1401 * on key size). The number of rounds is returned. If the key size is
1402 * invalid (not 16, 24 or 32), then 0 is returned.
1403 */
1404 unsigned br_aes_ct64_keysched(uint64_t *comp_skey,
1405 const void *key, size_t key_len);
1406
1407 /*
1408 * Expand AES subkeys as produced by br_aes_ct64_keysched(), into
1409 * a larger array suitable for br_aes_ct64_bitslice_encrypt() and
1410 * br_aes_ct64_bitslice_decrypt().
1411 */
1412 void br_aes_ct64_skey_expand(uint64_t *skey,
1413 unsigned num_rounds, const uint64_t *comp_skey);
1414
1415 /* ==================================================================== */
1416 /*
1417 * RSA.
1418 */
1419
1420 /*
1421 * Apply proper PKCS#1 v1.5 padding (for signatures). 'hash_oid' is
1422 * the encoded hash function OID, or NULL.
1423 */
1424 uint32_t br_rsa_pkcs1_sig_pad(const unsigned char *hash_oid,
1425 const unsigned char *hash, size_t hash_len,
1426 uint32_t n_bitlen, unsigned char *x);
1427
1428 /*
1429 * Check PKCS#1 v1.5 padding (for signatures). 'hash_oid' is the encoded
1430 * hash function OID, or NULL. The provided 'sig' value is _after_ the
1431 * modular exponentiation, i.e. it should be the padded hash. On
1432 * success, the hashed message is extracted.
1433 */
1434 uint32_t br_rsa_pkcs1_sig_unpad(const unsigned char *sig, size_t sig_len,
1435 const unsigned char *hash_oid, size_t hash_len,
1436 unsigned char *hash_out);
1437
1438 /* ==================================================================== */
1439 /*
1440 * Elliptic curves.
1441 */
1442
1443 /*
1444 * Type for generic EC parameters: curve order (unsigned big-endian
1445 * encoding) and encoded conventional generator.
1446 */
1447 typedef struct {
1448 int curve;
1449 const unsigned char *order;
1450 size_t order_len;
1451 const unsigned char *generator;
1452 size_t generator_len;
1453 } br_ec_curve_def;
1454
1455 extern const br_ec_curve_def br_secp256r1;
1456 extern const br_ec_curve_def br_secp384r1;
1457 extern const br_ec_curve_def br_secp521r1;
1458
1459 extern const br_ec_curve_def br_curve25519;
1460
1461 #if 0
1462 /* obsolete */
1463 /*
1464 * Type for the parameters for a "prime curve":
1465 * coordinates are in GF(p), with p prime
1466 * curve equation is Y^2 = X^3 - 3*X + b
1467 * b is in Montgomery representation
1468 * curve order is n and is prime
1469 * base point is G (encoded) and has order n
1470 */
1471 typedef struct {
1472 const uint32_t *p;
1473 const uint32_t *b;
1474 const uint32_t p0i;
1475 } br_ec_prime_i31_curve;
1476
1477 extern const br_ec_prime_i31_curve br_ec_prime_i31_secp256r1;
1478 extern const br_ec_prime_i31_curve br_ec_prime_i31_secp384r1;
1479 extern const br_ec_prime_i31_curve br_ec_prime_i31_secp521r1;
1480
1481 #define BR_EC_I31_LEN ((BR_MAX_EC_SIZE + 61) / 31)
1482 #endif
1483
1484 /*
1485 * Decode some bytes as an i31 integer, with truncation (corresponding
1486 * to the 'bits2int' operation in RFC 6979). The target ENCODED bit
1487 * length is provided as last parameter. The resulting value will have
1488 * this declared bit length, and consists the big-endian unsigned decoding
1489 * of exactly that many bits in the source (capped at the source length).
1490 */
1491 void br_ecdsa_i31_bits2int(uint32_t *x,
1492 const void *src, size_t len, uint32_t ebitlen);
1493
1494 /*
1495 * Decode some bytes as an i15 integer, with truncation (corresponding
1496 * to the 'bits2int' operation in RFC 6979). The target ENCODED bit
1497 * length is provided as last parameter. The resulting value will have
1498 * this declared bit length, and consists the big-endian unsigned decoding
1499 * of exactly that many bits in the source (capped at the source length).
1500 */
1501 void br_ecdsa_i15_bits2int(uint16_t *x,
1502 const void *src, size_t len, uint32_t ebitlen);
1503
1504 /* ==================================================================== */
1505 /*
1506 * SSL/TLS support functions.
1507 */
1508
1509 /*
1510 * Record types.
1511 */
1512 #define BR_SSL_CHANGE_CIPHER_SPEC 20
1513 #define BR_SSL_ALERT 21
1514 #define BR_SSL_HANDSHAKE 22
1515 #define BR_SSL_APPLICATION_DATA 23
1516
1517 /*
1518 * Handshake message types.
1519 */
1520 #define BR_SSL_HELLO_REQUEST 0
1521 #define BR_SSL_CLIENT_HELLO 1
1522 #define BR_SSL_SERVER_HELLO 2
1523 #define BR_SSL_CERTIFICATE 11
1524 #define BR_SSL_SERVER_KEY_EXCHANGE 12
1525 #define BR_SSL_CERTIFICATE_REQUEST 13
1526 #define BR_SSL_SERVER_HELLO_DONE 14
1527 #define BR_SSL_CERTIFICATE_VERIFY 15
1528 #define BR_SSL_CLIENT_KEY_EXCHANGE 16
1529 #define BR_SSL_FINISHED 20
1530
1531 /*
1532 * Alert levels.
1533 */
1534 #define BR_LEVEL_WARNING 1
1535 #define BR_LEVEL_FATAL 2
1536
1537 /*
1538 * Low-level I/O state.
1539 */
1540 #define BR_IO_FAILED 0
1541 #define BR_IO_IN 1
1542 #define BR_IO_OUT 2
1543 #define BR_IO_INOUT 3
1544
1545 /*
1546 * Mark a SSL engine as failed. The provided error code is recorded if
1547 * the engine was not already marked as failed. If 'err' is 0, then the
1548 * engine is marked as closed (without error).
1549 */
1550 void br_ssl_engine_fail(br_ssl_engine_context *cc, int err);
1551
1552 /*
1553 * Test whether the engine is closed (normally or as a failure).
1554 */
1555 static inline int
1556 br_ssl_engine_closed(const br_ssl_engine_context *cc)
1557 {
1558 return cc->iomode == BR_IO_FAILED;
1559 }
1560
1561 /*
1562 * Configure a new maximum fragment length. If possible, the maximum
1563 * length for outgoing records is immediately adjusted (if there are
1564 * not already too many buffered bytes for that).
1565 */
1566 void br_ssl_engine_new_max_frag_len(
1567 br_ssl_engine_context *rc, unsigned max_frag_len);
1568
1569 /*
1570 * Test whether the current incoming record has been fully received
1571 * or not. This functions returns 0 only if a complete record header
1572 * has been received, but some of the (possibly encrypted) payload
1573 * has not yet been obtained.
1574 */
1575 int br_ssl_engine_recvrec_finished(const br_ssl_engine_context *rc);
1576
1577 /*
1578 * Flush the current record (if not empty). This is meant to be called
1579 * from the handshake processor only.
1580 */
1581 void br_ssl_engine_flush_record(br_ssl_engine_context *cc);
1582
1583 /*
1584 * Test whether there is some accumulated payload to send.
1585 */
1586 static inline int
1587 br_ssl_engine_has_pld_to_send(const br_ssl_engine_context *rc)
1588 {
1589 return rc->oxa != rc->oxb && rc->oxa != rc->oxc;
1590 }
1591
1592 /*
1593 * Initialize RNG in engine. Returned value is 1 on success, 0 on error.
1594 * This function will try to use the OS-provided RNG, if available. If
1595 * there is no OS-provided RNG, or if it failed, and no entropy was
1596 * injected by the caller, then a failure will be reported. On error,
1597 * the context error code is set.
1598 */
1599 int br_ssl_engine_init_rand(br_ssl_engine_context *cc);
1600
1601 /*
1602 * Reset the handshake-related parts of the engine.
1603 */
1604 void br_ssl_engine_hs_reset(br_ssl_engine_context *cc,
1605 void (*hsinit)(void *), void (*hsrun)(void *));
1606
1607 /*
1608 * Get the PRF to use for this context, for the provided PRF hash
1609 * function ID.
1610 */
1611 br_tls_prf_impl br_ssl_engine_get_PRF(br_ssl_engine_context *cc, int prf_id);
1612
1613 /*
1614 * Consume the provided pre-master secret and compute the corresponding
1615 * master secret. The 'prf_id' is the ID of the hash function to use
1616 * with the TLS 1.2 PRF (ignored if the version is TLS 1.0 or 1.1).
1617 */
1618 void br_ssl_engine_compute_master(br_ssl_engine_context *cc,
1619 int prf_id, const void *pms, size_t len);
1620
1621 /*
1622 * Switch to CBC decryption for incoming records.
1623 * cc the engine context
1624 * is_client non-zero for a client, zero for a server
1625 * prf_id id of hash function for PRF (ignored if not TLS 1.2+)
1626 * mac_id id of hash function for HMAC
1627 * bc_impl block cipher implementation (CBC decryption)
1628 * cipher_key_len block cipher key length (in bytes)
1629 */
1630 void br_ssl_engine_switch_cbc_in(br_ssl_engine_context *cc,
1631 int is_client, int prf_id, int mac_id,
1632 const br_block_cbcdec_class *bc_impl, size_t cipher_key_len);
1633
1634 /*
1635 * Switch to CBC encryption for outgoing records.
1636 * cc the engine context
1637 * is_client non-zero for a client, zero for a server
1638 * prf_id id of hash function for PRF (ignored if not TLS 1.2+)
1639 * mac_id id of hash function for HMAC
1640 * bc_impl block cipher implementation (CBC encryption)
1641 * cipher_key_len block cipher key length (in bytes)
1642 */
1643 void br_ssl_engine_switch_cbc_out(br_ssl_engine_context *cc,
1644 int is_client, int prf_id, int mac_id,
1645 const br_block_cbcenc_class *bc_impl, size_t cipher_key_len);
1646
1647 /*
1648 * Switch to GCM decryption for incoming records.
1649 * cc the engine context
1650 * is_client non-zero for a client, zero for a server
1651 * prf_id id of hash function for PRF
1652 * bc_impl block cipher implementation (CTR)
1653 * cipher_key_len block cipher key length (in bytes)
1654 */
1655 void br_ssl_engine_switch_gcm_in(br_ssl_engine_context *cc,
1656 int is_client, int prf_id,
1657 const br_block_ctr_class *bc_impl, size_t cipher_key_len);
1658
1659 /*
1660 * Switch to GCM encryption for outgoing records.
1661 * cc the engine context
1662 * is_client non-zero for a client, zero for a server
1663 * prf_id id of hash function for PRF
1664 * bc_impl block cipher implementation (CTR)
1665 * cipher_key_len block cipher key length (in bytes)
1666 */
1667 void br_ssl_engine_switch_gcm_out(br_ssl_engine_context *cc,
1668 int is_client, int prf_id,
1669 const br_block_ctr_class *bc_impl, size_t cipher_key_len);
1670
1671 /*
1672 * Switch to ChaCha20+Poly1305 decryption for incoming records.
1673 * cc the engine context
1674 * is_client non-zero for a client, zero for a server
1675 * prf_id id of hash function for PRF
1676 */
1677 void br_ssl_engine_switch_chapol_in(br_ssl_engine_context *cc,
1678 int is_client, int prf_id);
1679
1680 /*
1681 * Switch to ChaCha20+Poly1305 encryption for outgoing records.
1682 * cc the engine context
1683 * is_client non-zero for a client, zero for a server
1684 * prf_id id of hash function for PRF
1685 */
1686 void br_ssl_engine_switch_chapol_out(br_ssl_engine_context *cc,
1687 int is_client, int prf_id);
1688
1689 /*
1690 * Calls to T0-generated code.
1691 */
1692 void br_ssl_hs_client_init_main(void *ctx);
1693 void br_ssl_hs_client_run(void *ctx);
1694 void br_ssl_hs_server_init_main(void *ctx);
1695 void br_ssl_hs_server_run(void *ctx);
1696
1697 /*
1698 * Get the hash function to use for signatures, given a bit mask of
1699 * supported hash functions. This implements a strict choice order
1700 * (namely SHA-256, SHA-384, SHA-512, SHA-224, SHA-1). If the mask
1701 * does not document support of any of these hash functions, then this
1702 * functions returns 0.
1703 */
1704 int br_ssl_choose_hash(unsigned bf);
1705
1706 /* ==================================================================== */
1707
1708 #endif