Improved modular exponentiation (automatic window optimisation if there is enough...

[BearSSL] / src / inner.h

diff --git a/src/inner.h b/src/inner.h
index 8417b24..2bb8192 100644 (file)
--- a/src/inner.h
+++ b/src/inner.h
@@ -31,6 +31,15 @@
 #include "config.h"
 #include "bearssl.h"
 
 #include "config.h"
 #include "bearssl.h"
 

+/*
+ * On MSVC, disable the warning about applying unary minus on an
+ * unsigned type: it is standard, we do it all the time, and for
+ * good reasons.
+ */
+#if _MSC_VER
+#pragma warning( disable : 4146 )
+#endif
+

 /*
  * Maximum size for a RSA modulus (in bits). Allocated stack buffers
  * depend on that size, so this value should be kept small. Currently,
 /*
  * Maximum size for a RSA modulus (in bits). Allocated stack buffers
  * depend on that size, so this value should be kept small. Currently,


@@ -300,7 +309,7 @@ static inline void
 br_multihash_copyimpl(br_multihash_context *dst,
        const br_multihash_context *src)
 {
 br_multihash_copyimpl(br_multihash_context *dst,
        const br_multihash_context *src)
 {

-       memcpy(dst->impl, src->impl, sizeof src->impl);
+       memcpy((void *)dst->impl, src->impl, sizeof src->impl);

 }
 
 /* ==================================================================== */
 }
 
 /* ==================================================================== */


@@ -571,16 +580,17 @@ MUL31_lo(uint32_t x, uint32_t y)
 #endif
 
 /*
 #endif
 
 /*

- * Multiply two words together; each word may contain up to 15 bits of
- * data. If BR_CT_MUL15 is non-zero, then the macro will contain some
- * extra operations that help in making the operation constant-time on
- * some platforms, where the basic 32-bit multiplication is not
- * constant-time.
+ * Multiply two words together; the sum of the lengths of the two
+ * operands must not exceed 31 (for instance, one operand may use 16
+ * bits if the other fits on 15). If BR_CT_MUL15 is non-zero, then the
+ * macro will contain some extra operations that help in making the
+ * operation constant-time on some platforms, where the basic 32-bit
+ * multiplication is not constant-time.

  */
 #if BR_CT_MUL15
 #define MUL15(x, y)   (((uint32_t)(x) | (uint32_t)0x80000000) \
                        * ((uint32_t)(y) | (uint32_t)0x80000000) \
  */
 #if BR_CT_MUL15
 #define MUL15(x, y)   (((uint32_t)(x) | (uint32_t)0x80000000) \
                        * ((uint32_t)(y) | (uint32_t)0x80000000) \

-                      & (uint32_t)0x3FFFFFFF)
+                      & (uint32_t)0x7FFFFFFF)

 #else
 #define MUL15(x, y)   ((uint32_t)(x) * (uint32_t)(y))
 #endif
 #else
 #define MUL15(x, y)   ((uint32_t)(x) * (uint32_t)(y))
 #endif


@@ -1092,6 +1102,9 @@ void br_i15_to_monty(uint16_t *x, const uint16_t *m);
 void br_i15_modpow(uint16_t *x, const unsigned char *e, size_t elen,
        const uint16_t *m, uint16_t m0i, uint16_t *t1, uint16_t *t2);
 
 void br_i15_modpow(uint16_t *x, const unsigned char *e, size_t elen,
        const uint16_t *m, uint16_t m0i, uint16_t *t1, uint16_t *t2);
 

+uint32_t br_i15_modpow_opt(uint16_t *x, const unsigned char *e, size_t elen,
+       const uint16_t *m, uint16_t m0i, uint16_t *tmp, size_t twlen);
+

 void br_i15_encode(void *dst, size_t len, const uint16_t *x);
 
 uint32_t br_i15_decode_mod(uint16_t *x,
 void br_i15_encode(void *dst, size_t len, const uint16_t *x);
 
 uint32_t br_i15_decode_mod(uint16_t *x,


@@ -1455,28 +1468,14 @@ extern const br_ec_curve_def br_secp256r1;
 extern const br_ec_curve_def br_secp384r1;
 extern const br_ec_curve_def br_secp521r1;
 
 extern const br_ec_curve_def br_secp384r1;
 extern const br_ec_curve_def br_secp521r1;
 

-#if 0
-/* obsolete */

 /*
 /*

- * Type for the parameters for a "prime curve":
- *   coordinates are in GF(p), with p prime
- *   curve equation is Y^2 = X^3 - 3*X + b
- *   b is in Montgomery representation
- *   curve order is n and is prime
- *   base point is G (encoded) and has order n
+ * For Curve25519, the advertised "order" really is 2^255-1, since the
+ * point multipliction function really works over arbitrary 255-bit
+ * scalars. This value is only meant as a hint for ECDH key generation;
+ * only ECDSA uses the exact curve order, and ECDSA is not used with
+ * that specific curve.

  */
  */

-typedef struct {
-       const uint32_t *p;
-       const uint32_t *b;
-       const uint32_t p0i;
-} br_ec_prime_i31_curve;
-
-extern const br_ec_prime_i31_curve br_ec_prime_i31_secp256r1;
-extern const br_ec_prime_i31_curve br_ec_prime_i31_secp384r1;
-extern const br_ec_prime_i31_curve br_ec_prime_i31_secp521r1;
-
-#define BR_EC_I31_LEN   ((BR_MAX_EC_SIZE + 61) / 31)
-#endif
+extern const br_ec_curve_def br_curve25519;

 
 /*
  * Decode some bytes as an i31 integer, with truncation (corresponding
 
 /*
  * Decode some bytes as an i31 integer, with truncation (corresponding