cuberite/polarssl
1
0
Fork 0
mirror of https://github.com/cuberite/polarssl.git synced 2025-09-29 00:18:06 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6083 from tom-cosgrove-arm/issue-6015-montgomery-multiplication

Browse Source 
Montgomery multiplication from bignum prototype
This commit is contained in:
Gilles Peskine 2022-09-30 10:35:21 +02:00 committed by GitHub
commit 845de0898e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 14902 additions and 894 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

143
library/bignum.c
View File

@ -38,7 +38,6 @@
#if defined(MBEDTLS_BIGNUM_C)
#include "mbedtls/bignum.h"
#include "bignum_internal.h"
#include "bignum_core.h"
#include "bn_mul.h"
#include "mbedtls/platform_util.h"
@ -962,40 +961,6 @@ cleanup:
return( ret );
}
/**
* Helper for mbedtls_mpi subtraction.
*
* Calculate l - r where l and r have the same size.
* This function operates modulo (2^ciL)^n and returns the carry
* (1 if there was a wraparound, i.e. if `l < r`, and 0 otherwise).
*
* d may be aliased to l or r.
*
* \param n Number of limbs of \p d, \p l and \p r.
* \param[out] d The result of the subtraction.
* \param[in] l The left operand.
* \param[in] r The right operand.
*
* \return 1 if `l < r`.
* 0 if `l >= r`.
*/
static mbedtls_mpi_uint mpi_sub_hlp( size_t n,
mbedtls_mpi_uint *d,
const mbedtls_mpi_uint *l,
const mbedtls_mpi_uint *r )
{
size_t i;
mbedtls_mpi_uint c = 0, t, z;
for( i = 0; i < n; i++ )
{
z = ( l[i] < c ); t = l[i] - c;
c = ( t < r[i] ) + z; d[i] = t - r[i];
}
return( c );
}
/*
* Unsigned subtraction: X = |A| - |B| (HAC 14.9, 14.10)
*/
@ -1028,7 +993,7 @@ int mbedtls_mpi_sub_abs( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi
if( X->n > A->n )
memset( X->p + A->n, 0, ( X->n - A->n ) * ciL );
carry = mpi_sub_hlp( n, X->p, A->p, B->p );
carry = mbedtls_mpi_core_sub( X->p, A->p, B->p, n );
if( carry != 0 )
{
/* Propagate the carry to the first nonzero limb of X. */
@ -1157,38 +1122,6 @@ int mbedtls_mpi_sub_int( mbedtls_mpi *X, const mbedtls_mpi *A, mbedtls_mpi_sint
return( mbedtls_mpi_sub_mpi( X, A, &B ) );
}
mbedtls_mpi_uint mbedtls_mpi_core_mla( mbedtls_mpi_uint *d, size_t d_len,
const mbedtls_mpi_uint *s, size_t s_len,
mbedtls_mpi_uint b )
{
mbedtls_mpi_uint c = 0; /* carry */
size_t excess_len = d_len - s_len;
size_t steps_x8 = s_len / 8;
size_t steps_x1 = s_len & 7;
while( steps_x8-- )
{
MULADDC_X8_INIT
MULADDC_X8_CORE
MULADDC_X8_STOP
}
while( steps_x1-- )
{
MULADDC_X1_INIT
MULADDC_X1_CORE
MULADDC_X1_STOP
}
while( excess_len-- )
{
*d += c; c = ( *d < c ); d++;
}
return( c );
}
/*
* Baseline multiplication: X = A * B (HAC 14.12)
*/
@ -1612,21 +1545,9 @@ int mbedtls_mpi_mod_int( mbedtls_mpi_uint *r, const mbedtls_mpi *A, mbedtls_mpi_
return( 0 );
}
/*
* Fast Montgomery initialization (thanks to Tom St Denis)
*/
static void mpi_montg_init( mbedtls_mpi_uint *mm, const mbedtls_mpi *N )
{
mbedtls_mpi_uint x, m0 = N->p[0];
unsigned int i;
x = m0;
x += ( ( m0 + 2 ) & 4 ) << 1;
for( i = biL; i >= 8; i /= 2 )
x *= ( 2 - ( m0 * x ) );
*mm = ~x + 1;
*mm = mbedtls_mpi_core_montmul_init( N->p );
}
/** Montgomery multiplication: A = A * B * R^-1 mod N (HAC 14.36)
@ -1640,7 +1561,7 @@ static void mpi_montg_init( mbedtls_mpi_uint *mm, const mbedtls_mpi *N )
* \param[in] B One of the numbers to multiply.
* It must be nonzero and must not have more limbs than N
* (B->n <= N->n).
* \param[in] N The modulo. N must be odd.
* \param[in] N The modulus. \p N must be odd.
* \param mm The value calculated by `mpi_montg_init(&mm, N)`.
* This is -N^-1 mod 2^ciL.
* \param[in,out] T A bignum for temporary storage.
@ -1648,59 +1569,13 @@ static void mpi_montg_init( mbedtls_mpi_uint *mm, const mbedtls_mpi *N )
* (T->n >= 2 * N->n + 1).
* Its initial content is unused and
* its final content is indeterminate.
* Note that unlike the usual convention in the library
* for `const mbedtls_mpi*`, the content of T can change.
* It does not get reallocated.
*/
static void mpi_montmul( mbedtls_mpi *A, const mbedtls_mpi *B, const mbedtls_mpi *N, mbedtls_mpi_uint mm,
const mbedtls_mpi *T )
static void mpi_montmul( mbedtls_mpi *A, const mbedtls_mpi *B,
const mbedtls_mpi *N, mbedtls_mpi_uint mm,
mbedtls_mpi *T )
{
size_t n, m;
mbedtls_mpi_uint *d;
memset( T->p, 0, T->n * ciL );
d = T->p;
n = N->n;
m = ( B->n < n ) ? B->n : n;
for( size_t i = 0; i < n; i++ )
{
mbedtls_mpi_uint u0, u1;
/*
* T = (T + u0*B + u1*N) / 2^biL
*/
u0 = A->p[i];
u1 = ( d[0] + u0 * B->p[0] ) * mm;
(void) mbedtls_mpi_core_mla( d, n + 2,
B->p, m,
u0 );
(void) mbedtls_mpi_core_mla( d, n + 2,
N->p, n,
u1 );
d++;
}
/* At this point, d is either the desired result or the desired result
* plus N. We now potentially subtract N, avoiding leaking whether the
* subtraction is performed through side channels. */
/* Copy the n least significant limbs of d to A, so that
* A = d if d < N (recall that N has n limbs). */
memcpy( A->p, d, n * ciL );
/* If d >= N then we want to set A to d - N. To prevent timing attacks,
* do the calculation without using conditional tests. */
/* Set d to d0 + (2^biL)^n - N where d0 is the current value of d. */
d[n] += 1;
d[n] -= mpi_sub_hlp( n, d, d, N->p );
/* If d0 < N then d < (2^biL)^n
* so d[n] == 0 and we want to keep A as it is.
* If d0 >= N then d >= (2^biL)^n, and d <= (2^biL)^n + N < 2 * (2^biL)^n
* so d[n] == 1 and we want to set A to the result of the subtraction
* which is d - (2^biL)^n, i.e. the n least significant limbs of d.
* This exactly corresponds to a conditional assignment. */
mbedtls_ct_mpi_uint_cond_assign( n, A->p, d, (unsigned char) d[n] );
mbedtls_mpi_core_montmul( A->p, A->p, B->p, B->n, N->p, N->n, mm, T->p );
}
/*
@ -1709,7 +1584,7 @@ static void mpi_montmul( mbedtls_mpi *A, const mbedtls_mpi *B, const mbedtls_mpi
* See mpi_montmul() regarding constraints and guarantees on the parameters.
*/
static void mpi_montred( mbedtls_mpi *A, const mbedtls_mpi *N,
mbedtls_mpi_uint mm, const mbedtls_mpi *T )
mbedtls_mpi_uint mm, mbedtls_mpi *T )
{
mbedtls_mpi_uint z = 1;
mbedtls_mpi U;

153
library/bignum_core.c
View File

@ -37,6 +37,8 @@
#endif
#include "bignum_core.h"
#include "bn_mul.h"
#include "constant_time_internal.h"
size_t mbedtls_mpi_core_clz( mbedtls_mpi_uint a )
{
@ -153,7 +155,7 @@ void mbedtls_mpi_core_bigendian_to_host( mbedtls_mpi_uint *A,
mbedtls_mpi_uint tmp;
/* Note that if cur_limb_left == cur_limb_right,
* this code effectively swaps the bytes only once. */
tmp = mpi_bigendian_to_host( *cur_limb_left );
tmp = mpi_bigendian_to_host( *cur_limb_left );
*cur_limb_left = mpi_bigendian_to_host( *cur_limb_right );
*cur_limb_right = tmp;
}
@ -291,4 +293,153 @@ int mbedtls_mpi_core_write_be( const mbedtls_mpi_uint *X,
return( 0 );
}
mbedtls_mpi_uint mbedtls_mpi_core_add_if( mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
size_t limbs,
unsigned cond )
{
mbedtls_mpi_uint c = 0;
/* all-bits 0 if cond is 0, all-bits 1 if cond is non-0 */
const mbedtls_mpi_uint mask = mbedtls_ct_mpi_uint_mask( cond );
for( size_t i = 0; i < limbs; i++ )
{
mbedtls_mpi_uint add = mask & A[i];
mbedtls_mpi_uint t = c + X[i];
c = ( t < X[i] );
t += add;
c += ( t < add );
X[i] = t;
}
return( c );
}
mbedtls_mpi_uint mbedtls_mpi_core_sub( mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
const mbedtls_mpi_uint *B,
size_t limbs )
{
mbedtls_mpi_uint c = 0;
for( size_t i = 0; i < limbs; i++ )
{
mbedtls_mpi_uint z = ( A[i] < c );
mbedtls_mpi_uint t = A[i] - c;
c = ( t < B[i] ) + z;
X[i] = t - B[i];
}
return( c );
}
mbedtls_mpi_uint mbedtls_mpi_core_mla( mbedtls_mpi_uint *d, size_t d_len,
const mbedtls_mpi_uint *s, size_t s_len,
mbedtls_mpi_uint b )
{
mbedtls_mpi_uint c = 0; /* carry */
/*
* It is a documented precondition of this function that d_len >= s_len.
* If that's not the case, we swap these round: this turns what would be
* a buffer overflow into an incorrect result.
*/
if( d_len < s_len )
s_len = d_len;
size_t excess_len = d_len - s_len;
size_t steps_x8 = s_len / 8;
size_t steps_x1 = s_len & 7;
while( steps_x8-- )
{
MULADDC_X8_INIT
MULADDC_X8_CORE
MULADDC_X8_STOP
}
while( steps_x1-- )
{
MULADDC_X1_INIT
MULADDC_X1_CORE
MULADDC_X1_STOP
}
while( excess_len-- )
{
*d += c;
c = ( *d < c );
d++;
}
return( c );
}
/*
* Fast Montgomery initialization (thanks to Tom St Denis).
*/
mbedtls_mpi_uint mbedtls_mpi_core_montmul_init( const mbedtls_mpi_uint *N )
{
mbedtls_mpi_uint x = N[0];
x += ( ( N[0] + 2 ) & 4 ) << 1;
for( unsigned int i = biL; i >= 8; i /= 2 )
x *= ( 2 - ( N[0] * x ) );
return( ~x + 1 );
}
void mbedtls_mpi_core_montmul( mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
const mbedtls_mpi_uint *B,
size_t B_limbs,
const mbedtls_mpi_uint *N,
size_t AN_limbs,
mbedtls_mpi_uint mm,
mbedtls_mpi_uint *T )
{
memset( T, 0, ( 2 * AN_limbs + 1 ) * ciL );
for( size_t i = 0; i < AN_limbs; i++ )
{
/* T = (T + u0*B + u1*N) / 2^biL */
mbedtls_mpi_uint u0 = A[i];
mbedtls_mpi_uint u1 = ( T[0] + u0 * B[0] ) * mm;
(void) mbedtls_mpi_core_mla( T, AN_limbs + 2, B, B_limbs, u0 );
(void) mbedtls_mpi_core_mla( T, AN_limbs + 2, N, AN_limbs, u1 );
T++;
}
/*
* The result we want is (T >= N) ? T - N : T.
*
* For better constant-time properties in this function, we always do the
* subtraction, with the result in X.
*
* We also look to see if there was any carry in the final additions in the
* loop above.
*/
mbedtls_mpi_uint carry = T[AN_limbs];
mbedtls_mpi_uint borrow = mbedtls_mpi_core_sub( X, T, N, AN_limbs );
/*
* Using R as the Montgomery radix (auxiliary modulus) i.e. 2^(biL*AN_limbs):
*
* T can be in one of 3 ranges:
*
* 1) T < N : (carry, borrow) = (0, 1): we want T
* 2) N <= T < R : (carry, borrow) = (0, 0): we want X
* 3) T >= R : (carry, borrow) = (1, 1): we want X
*
* and (carry, borrow) = (1, 0) can't happen.
*
* So the correct return value is already in X if (carry ^ borrow) = 0,
* but is in (the lower AN_limbs limbs of) T if (carry ^ borrow) = 1.
*/
mbedtls_ct_mpi_uint_cond_assign( AN_limbs, X, T, (unsigned char) ( carry ^ borrow ) );
}
#endif /* MBEDTLS_BIGNUM_C */

159
library/bignum_core.h
View File

@ -31,6 +31,20 @@
#include "mbedtls/bignum.h"
#endif
#define ciL ( sizeof(mbedtls_mpi_uint) ) /* chars in limb */
#define biL ( ciL << 3 ) /* bits in limb */
#define biH ( ciL << 2 ) /* half limb size */
/*
* Convert between bits/chars and number of limbs
* Divide first in order to avoid potential overflows
*/
#define BITS_TO_LIMBS(i) ( (i) / biL + ( (i) % biL != 0 ) )
#define CHARS_TO_LIMBS(i) ( (i) / ciL + ( (i) % ciL != 0 ) )
/* Get a specific byte, without range checks. */
#define GET_BYTE( X, i ) \
( ( (X)[(i) / ciL] >> ( ( (i) % ciL ) * 8 ) ) & 0xff )
/** Count leading zero bits in a given integer.
*
* \param a Integer to count leading zero bits.
@ -141,18 +155,139 @@ int mbedtls_mpi_core_write_be( const mbedtls_mpi_uint *A,
unsigned char *output,
size_t output_length );
#define ciL ( sizeof(mbedtls_mpi_uint) ) /* chars in limb */
#define biL ( ciL << 3 ) /* bits in limb */
#define biH ( ciL << 2 ) /* half limb size */
/*
* Convert between bits/chars and number of limbs
* Divide first in order to avoid potential overflows
/**
* \brief Conditional addition of two fixed-size large unsigned integers,
* returning the carry.
*
* Functionally equivalent to
*
* ```
* if( cond )
* X += A;
* return carry;
* ```
*
* This function operates modulo `2^(biL*limbs)`.
*
* \param[in,out] X The pointer to the (little-endian) array
* representing the bignum to accumulate onto.
* \param[in] A The pointer to the (little-endian) array
* representing the bignum to conditionally add
* to \p X. This may be aliased to \p X but may not
* overlap otherwise.
* \param limbs Number of limbs of \p X and \p A.
* \param cond Condition bit dictating whether addition should
* happen or not. This must be \c 0 or \c 1.
*
* \warning If \p cond is neither 0 nor 1, the result of this function
* is unspecified, and the resulting value in \p X might be
* neither its original value nor \p X + \p A.
*
* \return 1 if `X + cond * A >= 2^(biL*limbs)`, 0 otherwise.
*/
#define BITS_TO_LIMBS(i) ( (i) / biL + ( (i) % biL != 0 ) )
#define CHARS_TO_LIMBS(i) ( (i) / ciL + ( (i) % ciL != 0 ) )
/* Get a specific byte, without range checks. */
#define GET_BYTE( X, i ) \
( ( (X)[(i) / ciL] >> ( ( (i) % ciL ) * 8 ) ) & 0xff )
mbedtls_mpi_uint mbedtls_mpi_core_add_if( mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
size_t limbs,
unsigned cond );
/**
* \brief Subtract two fixed-size large unsigned integers, returning the borrow.
*
* Calculate `A - B` where \p A and \p B have the same size.
* This function operates modulo `2^(biL*limbs)` and returns the carry
* (1 if there was a wraparound, i.e. if `A < B`, and 0 otherwise).
*
* \p X may be aliased to \p A or \p B, or even both, but may not overlap
* either otherwise.
*
* \param[out] X The result of the subtraction.
* \param[in] A Little-endian presentation of left operand.
* \param[in] B Little-endian presentation of right operand.
* \param limbs Number of limbs of \p X, \p A and \p B.
*
* \return 1 if `A < B`.
* 0 if `A >= B`.
*/
mbedtls_mpi_uint mbedtls_mpi_core_sub( mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
const mbedtls_mpi_uint *B,
size_t limbs );
/**
* \brief Perform a fixed-size multiply accumulate operation: X += b * A
*
* \p X may be aliased to \p A (when \p X_limbs == \p A_limbs), but may not
* otherwise overlap.
*
* This function operates modulo `2^(biL*X_limbs)`.
*
* \param[in,out] X The pointer to the (little-endian) array
* representing the bignum to accumulate onto.
* \param X_limbs The number of limbs of \p X. This must be
* at least \p A_limbs.
* \param[in] A The pointer to the (little-endian) array
* representing the bignum to multiply with.
* This may be aliased to \p X but may not overlap
* otherwise.
* \param A_limbs The number of limbs of \p A.
* \param b X scalar to multiply with.
*
* \return The carry at the end of the operation.
*/
mbedtls_mpi_uint mbedtls_mpi_core_mla( mbedtls_mpi_uint *X, size_t X_limbs,
const mbedtls_mpi_uint *A, size_t A_limbs,
mbedtls_mpi_uint b );
/**
* \brief Calculate initialisation value for fast Montgomery modular
* multiplication
*
* \param[in] N Little-endian presentation of the modulus. This must have
* at least one limb.
*
* \return The initialisation value for fast Montgomery modular multiplication
*/
mbedtls_mpi_uint mbedtls_mpi_core_montmul_init( const mbedtls_mpi_uint *N );
/**
* \brief Montgomery multiplication: X = A * B * R^-1 mod N (HAC 14.36)
*
* \p A and \p B must be in canonical form. That is, < \p N.
*
* \p X may be aliased to \p A or \p N, or even \p B (if \p AN_limbs ==
* \p B_limbs) but may not overlap any parameters otherwise.
*
* \p A and \p B may alias each other, if \p AN_limbs == \p B_limbs. They may
* not alias \p N (since they must be in canonical form, they cannot == \p N).
*
* \param[out] X The destination MPI, as a little-endian array of
* length \p AN_limbs.
* On successful completion, X contains the result of
* the multiplication `A * B * R^-1` mod N where
* `R = 2^(biL*AN_limbs)`.
* \param[in] A Little-endian presentation of first operand.
* Must have the same number of limbs as \p N.
* \param[in] B Little-endian presentation of second operand.
* \param[in] B_limbs The number of limbs in \p B.
* Must be <= \p AN_limbs.
* \param[in] N Little-endian presentation of the modulus.
* This must be odd, and have exactly the same number
* of limbs as \p A.
* It may alias \p X, but must not alias or otherwise
* overlap any of the other parameters.
* \param[in] AN_limbs The number of limbs in \p X, \p A and \p N.
* \param mm The Montgomery constant for \p N: -N^-1 mod 2^biL.
* This can be calculated by `mbedtls_mpi_core_montmul_init()`.
* \param[in,out] T Temporary storage of size at least 2*AN_limbs+1 limbs.
* Its initial content is unused and
* its final content is indeterminate.
* It must not alias or otherwise overlap any of the
* other parameters.
*/
void mbedtls_mpi_core_montmul( mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
const mbedtls_mpi_uint *B, size_t B_limbs,
const mbedtls_mpi_uint *N, size_t AN_limbs,
mbedtls_mpi_uint mm, mbedtls_mpi_uint *T );
#endif /* MBEDTLS_BIGNUM_CORE_H */

50
library/bignum_internal.h
View File

@ -1,50 +0,0 @@
/**
* Internal bignum functions
*
* Copyright The Mbed TLS Contributors
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#ifndef MBEDTLS_BIGNUM_INTERNAL_H
#define MBEDTLS_BIGNUM_INTERNAL_H
#include "common.h"
#if defined(MBEDTLS_BIGNUM_C)
#include "mbedtls/bignum.h"
#endif
/** Perform a known-size multiply accumulate operation
*
* Add \p b * \p s to \p d.
*
* \param[in,out] d The pointer to the (little-endian) array
* representing the bignum to accumulate onto.
* \param d_len The number of limbs of \p d. This must be
* at least \p s_len.
* \param[in] s The pointer to the (little-endian) array
* representing the bignum to multiply with.
* This may be the same as \p d. Otherwise,
* it must be disjoint from \p d.
* \param s_len The number of limbs of \p s.
* \param b A scalar to multiply with.
*
* \return c The carry at the end of the operation.
*/
mbedtls_mpi_uint mbedtls_mpi_core_mla( mbedtls_mpi_uint *d, size_t d_len ,
const mbedtls_mpi_uint *s, size_t s_len,
mbedtls_mpi_uint b );
#endif /* MBEDTLS_BIGNUM_INTERNAL_H */

5
library/ecp_curves.c
View File

@ -26,7 +26,7 @@
#include "mbedtls/error.h"
#include "bn_mul.h"
#include "bignum_internal.h"
#include "bignum_core.h"
#include "ecp_invasive.h"
#include <string.h>
@ -4969,9 +4969,6 @@ static inline void sub32( uint32_t *dst, uint32_t src, signed char *carry )
#define ADD( j ) add32( &cur, A( j ), &c );
#define SUB( j ) sub32( &cur, A( j ), &c );
#define ciL (sizeof(mbedtls_mpi_uint)) /* chars in limb */
#define biL (ciL << 3) /* bits in limb */
/*
* Helpers for the main 'loop'
*/

6
tests/scripts/generate_bignum_tests.py
View File

@ -189,7 +189,7 @@ class BignumOperation(BignumTarget, metaclass=ABCMeta):
class BignumCmp(BignumOperation):
"""Test cases for bignum value comparison."""
count = 0
test_function = "mbedtls_mpi_cmp_mpi"
test_function = "mpi_cmp_mpi"
test_name = "MPI compare"
input_cases = [
("-2", "-3"),
@ -210,7 +210,7 @@ class BignumCmp(BignumOperation):
class BignumCmpAbs(BignumCmp):
"""Test cases for absolute bignum value comparison."""
count = 0
test_function = "mbedtls_mpi_cmp_abs"
test_function = "mpi_cmp_abs"
test_name = "MPI compare (abs)"
def __init__(self, val_a, val_b) -> None:
@ -221,7 +221,7 @@ class BignumAdd(BignumOperation):
"""Test cases for bignum value addition."""
count = 0
symbol = "+"
test_function = "mbedtls_mpi_add_mpi"
test_function = "mpi_add_mpi"
test_name = "MPI add"
input_cases = combination_pairs(
[

14637
tests/suites/test_suite_mpi.data
View File

File diff suppressed because it is too large Load Diff

643
tests/suites/test_suite_mpi.function
View File

@ -182,7 +182,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_read_binary( data_t * buf, char * input_A )
void mpi_read_binary( data_t * buf, char * input_A )
{
mbedtls_mpi X;
char str[1000];
@ -202,7 +202,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_core_io_null()
void mpi_core_io_null()
{
mbedtls_mpi_uint X = 0;
int ret;
@ -233,29 +233,29 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_core_io_be( data_t *input, int nb_int, int nx_32_int, int iret,
int oret )
void mpi_core_io_be( data_t *input, int nb_int, int nx_32_int, int iret,
int oret )
{
if( iret != 0 )
TEST_ASSERT( oret == 0 );
TEST_ASSERT( 0 <= nb_int );
TEST_LE_S( 0, nb_int );
size_t nb = nb_int;
unsigned char buf[1024];
TEST_ASSERT( nb <= sizeof( buf ) );
TEST_LE_U( nb, sizeof( buf ) );
/* nx_32_int is the number of 32 bit limbs, if we have 64 bit limbs we need
* to halve the number of limbs to have the same size. */
size_t nx;
TEST_ASSERT( 0 <= nx_32_int );
TEST_LE_S( 0, nx_32_int );
if( sizeof( mbedtls_mpi_uint ) == 8 )
nx = nx_32_int / 2 + nx_32_int % 2;
else
nx = nx_32_int;
mbedtls_mpi_uint X[sizeof( buf ) / sizeof( mbedtls_mpi_uint )];
TEST_ASSERT( nx <= sizeof( X ) / sizeof( X[0] ) );
TEST_LE_U( nx, sizeof( X ) / sizeof( X[0] ) );
int ret = mbedtls_mpi_core_read_be( X, nx, input->x, input->len );
TEST_EQUAL( ret, iret );
@ -290,29 +290,29 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_core_io_le( data_t *input, int nb_int, int nx_32_int, int iret,
int oret )
void mpi_core_io_le( data_t *input, int nb_int, int nx_32_int, int iret,
int oret )
{
if( iret != 0 )
TEST_ASSERT( oret == 0 );
TEST_ASSERT( 0 <= nb_int );
TEST_LE_S( 0, nb_int );
size_t nb = nb_int;
unsigned char buf[1024];
TEST_ASSERT( nb <= sizeof( buf ) );
TEST_LE_U( nb, sizeof( buf ) );
/* nx_32_int is the number of 32 bit limbs, if we have 64 bit limbs we need
* to halve the number of limbs to have the same size. */
size_t nx;
TEST_ASSERT( 0 <= nx_32_int );
TEST_LE_S( 0, nx_32_int );
if( sizeof( mbedtls_mpi_uint ) == 8 )
nx = nx_32_int / 2 + nx_32_int % 2;
else
nx = nx_32_int;
mbedtls_mpi_uint X[sizeof( buf ) / sizeof( mbedtls_mpi_uint )];
TEST_ASSERT( nx <= sizeof( X ) / sizeof( X[0] ) );
TEST_LE_U( nx, sizeof( X ) / sizeof( X[0] ) );
int ret = mbedtls_mpi_core_read_le( X, nx, input->x, input->len );
TEST_EQUAL( ret, iret );
@ -345,7 +345,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_mod_setup( int ext_rep, int int_rep, int iret )
void mpi_mod_setup( int ext_rep, int int_rep, int iret )
{
#define MLIMBS 8
mbedtls_mpi_uint mp[MLIMBS];
@ -374,29 +374,29 @@ exit:
/* BEGIN_CASE */
void mbedtls_mpi_mod_raw_io( data_t *input, int nb_int, int nx_32_int,
int iendian, int iret, int oret )
void mpi_mod_raw_io( data_t *input, int nb_int, int nx_32_int,
int iendian, int iret, int oret )
{
if( iret != 0 )
TEST_ASSERT( oret == 0 );
TEST_ASSERT( 0 <= nb_int );
TEST_LE_S( 0, nb_int );
size_t nb = nb_int;
unsigned char buf[1024];
TEST_ASSERT( nb <= sizeof( buf ) );
TEST_LE_U( nb, sizeof( buf ) );
/* nx_32_int is the number of 32 bit limbs, if we have 64 bit limbs we need
* to halve the number of limbs to have the same size. */
size_t nx;
TEST_ASSERT( 0 <= nx_32_int );
TEST_LE_S( 0, nx_32_int );
if( sizeof( mbedtls_mpi_uint ) == 8 )
nx = nx_32_int / 2 + nx_32_int % 2;
else
nx = nx_32_int;
mbedtls_mpi_uint X[sizeof( buf ) / sizeof( mbedtls_mpi_uint )];
TEST_ASSERT( nx <= sizeof( X ) / sizeof( X[0] ) );
TEST_LE_U( nx, sizeof( X ) / sizeof( X[0] ) );
int endian;
if( iendian == MBEDTLS_MPI_MOD_EXT_REP_INVALID )
@ -469,7 +469,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_read_binary_le( data_t * buf, char * input_A )
void mpi_read_binary_le( data_t * buf, char * input_A )
{
mbedtls_mpi X;
char str[1000];
@ -489,8 +489,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_write_binary( char * input_X, data_t * input_A,
int output_size, int result )
void mpi_write_binary( char * input_X, data_t * input_A,
int output_size, int result )
{
mbedtls_mpi X;
unsigned char buf[1000];
@ -520,8 +520,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_write_binary_le( char * input_X, data_t * input_A,
int output_size, int result )
void mpi_write_binary_le( char * input_X, data_t * input_A,
int output_size, int result )
{
mbedtls_mpi X;
unsigned char buf[1000];
@ -551,7 +551,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_FS_IO */
void mbedtls_mpi_read_file( char * input_file, data_t * input_A, int result )
void mpi_read_file( char * input_file, data_t * input_A, int result )
{
mbedtls_mpi X;
unsigned char buf[1000];
@ -586,7 +586,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_FS_IO */
void mbedtls_mpi_write_file( char * input_X, char * output_file )
void mpi_write_file( char * input_X, char * output_file )
{
mbedtls_mpi X, Y;
FILE *file_out, *file_in;
@ -616,7 +616,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_get_bit( char * input_X, int pos, int val )
void mpi_get_bit( char * input_X, int pos, int val )
{
mbedtls_mpi X;
mbedtls_mpi_init( &X );
@ -629,8 +629,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_set_bit( char * input_X, int pos, int val,
char * output_Y, int result )
void mpi_set_bit( char * input_X, int pos, int val,
char * output_Y, int result )
{
mbedtls_mpi X, Y;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y );
@ -651,7 +651,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_lsb( char * input_X, int nr_bits )
void mpi_lsb( char * input_X, int nr_bits )
{
mbedtls_mpi X;
mbedtls_mpi_init( &X );
@ -665,7 +665,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_bitlen( char * input_X, int nr_bits )
void mpi_bitlen( char * input_X, int nr_bits )
{
mbedtls_mpi X;
mbedtls_mpi_init( &X );
@ -679,8 +679,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_gcd( char * input_X, char * input_Y,
char * input_A )
void mpi_gcd( char * input_X, char * input_Y,
char * input_A )
{
mbedtls_mpi A, X, Y, Z;
mbedtls_mpi_init( &A ); mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z );
@ -698,7 +698,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_cmp_int( int input_X, int input_A, int result_CMP )
void mpi_cmp_int( int input_X, int input_A, int result_CMP )
{
mbedtls_mpi X;
mbedtls_mpi_init( &X );
@ -712,8 +712,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_cmp_mpi( char * input_X, char * input_Y,
int input_A )
void mpi_cmp_mpi( char * input_X, char * input_Y,
int input_A )
{
mbedtls_mpi X, Y;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y );
@ -738,7 +738,7 @@ void mpi_core_lt_ct( data_t * input_X, data_t * input_Y, int input_ret )
size_t len = CHARS_TO_LIMBS(
input_X->len > input_Y->len ? input_X->len : input_Y->len );
TEST_ASSERT( len <= MAX_LEN );
TEST_LE_U( len, MAX_LEN );
TEST_ASSERT( mbedtls_mpi_core_read_be( X, len, input_X->x, input_X->len )
== 0 );
@ -764,9 +764,9 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_lt_mpi_ct( int size_X, char * input_X,
int size_Y, char * input_Y,
int input_ret, int input_err )
void mpi_lt_mpi_ct( int size_X, char * input_X,
int size_Y, char * input_Y,
int input_ret, int input_err )
{
unsigned ret = -1;
unsigned input_uret = input_ret;
@ -789,8 +789,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_cmp_abs( char * input_X, char * input_Y,
int input_A )
void mpi_cmp_abs( char * input_X, char * input_Y,
int input_A )
{
mbedtls_mpi X, Y;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y );
@ -805,7 +805,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_copy( char *src_hex, char *dst_hex )
void mpi_copy( char *src_hex, char *dst_hex )
{
mbedtls_mpi src, dst, ref;
mbedtls_mpi_init( &src );
@ -863,7 +863,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_swap( char *X_hex, char *Y_hex )
void mpi_swap( char *X_hex, char *Y_hex )
{
mbedtls_mpi X, Y, X0, Y0;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y );
@ -873,8 +873,8 @@ void mbedtls_mpi_swap( char *X_hex, char *Y_hex )
TEST_ASSERT( mbedtls_test_read_mpi( &Y0, Y_hex ) == 0 );
/* mbedtls_mpi_swap() */
TEST_ASSERT( mbedtls_test_read_mpi( &X, X_hex ) == 0 );
TEST_ASSERT( mbedtls_test_read_mpi( &Y, Y_hex ) == 0 );
TEST_ASSERT( mbedtls_test_read_mpi( &X, X_hex ) == 0 );
TEST_ASSERT( mbedtls_test_read_mpi( &Y, Y_hex ) == 0 );
mbedtls_mpi_swap( &X, &Y );
TEST_ASSERT( sign_is_valid( &X ) );
TEST_ASSERT( sign_is_valid( &Y ) );
@ -884,8 +884,8 @@ void mbedtls_mpi_swap( char *X_hex, char *Y_hex )
/* mbedtls_mpi_safe_cond_swap(), swap done */
mbedtls_mpi_free( &X );
mbedtls_mpi_free( &Y );
TEST_ASSERT( mbedtls_test_read_mpi( &X, X_hex ) == 0 );
TEST_ASSERT( mbedtls_test_read_mpi( &Y, Y_hex ) == 0 );
TEST_ASSERT( mbedtls_test_read_mpi( &X, X_hex ) == 0 );
TEST_ASSERT( mbedtls_test_read_mpi( &Y, Y_hex ) == 0 );
TEST_ASSERT( mbedtls_mpi_safe_cond_swap( &X, &Y, 1 ) == 0 );
TEST_ASSERT( sign_is_valid( &X ) );
TEST_ASSERT( sign_is_valid( &Y ) );
@ -895,8 +895,8 @@ void mbedtls_mpi_swap( char *X_hex, char *Y_hex )
/* mbedtls_mpi_safe_cond_swap(), swap not done */
mbedtls_mpi_free( &X );
mbedtls_mpi_free( &Y );
TEST_ASSERT( mbedtls_test_read_mpi( &X, X_hex ) == 0 );
TEST_ASSERT( mbedtls_test_read_mpi( &Y, Y_hex ) == 0 );
TEST_ASSERT( mbedtls_test_read_mpi( &X, X_hex ) == 0 );
TEST_ASSERT( mbedtls_test_read_mpi( &Y, Y_hex ) == 0 );
TEST_ASSERT( mbedtls_mpi_safe_cond_swap( &X, &Y, 0 ) == 0 );
TEST_ASSERT( sign_is_valid( &X ) );
TEST_ASSERT( sign_is_valid( &Y ) );
@ -915,7 +915,7 @@ void mpi_swap_self( char *X_hex )
mbedtls_mpi X, X0;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &X0 );
TEST_ASSERT( mbedtls_test_read_mpi( &X, X_hex ) == 0 );
TEST_ASSERT( mbedtls_test_read_mpi( &X, X_hex ) == 0 );
TEST_ASSERT( mbedtls_test_read_mpi( &X0, X_hex ) == 0 );
mbedtls_mpi_swap( &X, &X );
@ -928,7 +928,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_shrink( int before, int used, int min, int after )
void mpi_shrink( int before, int used, int min, int after )
{
mbedtls_mpi X;
mbedtls_mpi_init( &X );
@ -949,8 +949,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_add_mpi( char * input_X, char * input_Y,
char * input_A )
void mpi_add_mpi( char * input_X, char * input_Y,
char * input_A )
{
mbedtls_mpi X, Y, Z, A;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z ); mbedtls_mpi_init( &A );
@ -979,7 +979,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_add_mpi_inplace( char * input_X, char * input_A )
void mpi_add_mpi_inplace( char * input_X, char * input_A )
{
mbedtls_mpi X, A;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &A );
@ -1008,8 +1008,8 @@ exit:
/* BEGIN_CASE */
void mbedtls_mpi_add_abs( char * input_X, char * input_Y,
char * input_A )
void mpi_add_abs( char * input_X, char * input_Y,
char * input_A )
{
mbedtls_mpi X, Y, Z, A;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z ); mbedtls_mpi_init( &A );
@ -1038,8 +1038,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_add_int( char * input_X, int input_Y,
char * input_A )
void mpi_add_int( char * input_X, int input_Y,
char * input_A )
{
mbedtls_mpi X, Z, A;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Z ); mbedtls_mpi_init( &A );
@ -1056,8 +1056,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_sub_mpi( char * input_X, char * input_Y,
char * input_A )
void mpi_sub_mpi( char * input_X, char * input_Y,
char * input_A )
{
mbedtls_mpi X, Y, Z, A;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z ); mbedtls_mpi_init( &A );
@ -1086,8 +1086,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_sub_abs( char * input_X, char * input_Y,
char * input_A, int sub_result )
void mpi_sub_abs( char * input_X, char * input_Y,
char * input_A, int sub_result )
{
mbedtls_mpi X, Y, Z, A;
int res;
@ -1122,8 +1122,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_sub_int( char * input_X, int input_Y,
char * input_A )
void mpi_sub_int( char * input_X, int input_Y,
char * input_A )
{
mbedtls_mpi X, Z, A;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Z ); mbedtls_mpi_init( &A );
@ -1140,8 +1140,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_mul_mpi( char * input_X, char * input_Y,
char * input_A )
void mpi_mul_mpi( char * input_X, char * input_Y,
char * input_A )
{
mbedtls_mpi X, Y, Z, A;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Y ); mbedtls_mpi_init( &Z ); mbedtls_mpi_init( &A );
@ -1159,8 +1159,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_mul_int( char * input_X, int input_Y,
char * input_A, char * result_comparison )
void mpi_mul_int( char * input_X, int input_Y,
char * input_A, char * result_comparison )
{
mbedtls_mpi X, Z, A;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &Z ); mbedtls_mpi_init( &A );
@ -1182,9 +1182,9 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_div_mpi( char * input_X, char * input_Y,
char * input_A, char * input_B,
int div_result )
void mpi_div_mpi( char * input_X, char * input_Y,
char * input_A, char * input_B,
int div_result )
{
mbedtls_mpi X, Y, Q, R, A, B;
int res;
@ -1212,9 +1212,9 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_div_int( char * input_X, int input_Y,
char * input_A, char * input_B,
int div_result )
void mpi_div_int( char * input_X, int input_Y,
char * input_A, char * input_B,
int div_result )
{
mbedtls_mpi X, Q, R, A, B;
int res;
@ -1241,8 +1241,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_mod_mpi( char * input_X, char * input_Y,
char * input_A, int div_result )
void mpi_mod_mpi( char * input_X, char * input_Y,
char * input_A, int div_result )
{
mbedtls_mpi X, Y, A;
int res;
@ -1265,8 +1265,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_mod_int( char * input_X, int input_Y,
int input_A, int div_result )
void mpi_mod_int( char * input_X, int input_Y,
int input_A, int div_result )
{
mbedtls_mpi X;
int res;
@ -1287,9 +1287,9 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_exp_mod( char * input_A, char * input_E,
char * input_N, char * input_X,
int exp_result )
void mpi_exp_mod( char * input_A, char * input_E,
char * input_N, char * input_X,
int exp_result )
{
mbedtls_mpi A, E, N, RR, Z, X;
int res;
@ -1334,8 +1334,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_exp_mod_size( int A_bytes, int E_bytes, int N_bytes,
char * input_RR, int exp_result )
void mpi_exp_mod_size( int A_bytes, int E_bytes, int N_bytes,
char * input_RR, int exp_result )
{
mbedtls_mpi A, E, N, RR, Z;
mbedtls_mpi_init( &A ); mbedtls_mpi_init( &E ); mbedtls_mpi_init( &N );
@ -1368,8 +1368,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_inv_mod( char * input_X, char * input_Y,
char * input_A, int div_result )
void mpi_inv_mod( char * input_X, char * input_Y,
char * input_A, int div_result )
{
mbedtls_mpi X, Y, Z, A;
int res;
@ -1392,7 +1392,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_GENPRIME */
void mbedtls_mpi_is_prime( char * input_X, int div_result )
void mpi_is_prime( char * input_X, int div_result )
{
mbedtls_mpi X;
int res;
@ -1408,8 +1408,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_GENPRIME */
void mbedtls_mpi_is_prime_det( data_t * input_X, data_t * witnesses,
int chunk_len, int rounds )
void mpi_is_prime_det( data_t * input_X, data_t * witnesses,
int chunk_len, int rounds )
{
mbedtls_mpi X;
int res;
@ -1441,7 +1441,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_GENPRIME */
void mbedtls_mpi_gen_prime( int bits, int flags, int ref_ret )
void mpi_gen_prime( int bits, int flags, int ref_ret )
{
mbedtls_mpi X;
int my_ret;
@ -1479,8 +1479,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_shift_l( char * input_X, int shift_X,
char * input_A )
void mpi_shift_l( char * input_X, int shift_X,
char * input_A )
{
mbedtls_mpi X, A;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &A );
@ -1497,8 +1497,8 @@ exit:
/* END_CASE */
/* BEGIN_CASE */
void mbedtls_mpi_shift_r( char * input_X, int shift_X,
char * input_A )
void mpi_shift_r( char * input_X, int shift_X,
char * input_A )
{
mbedtls_mpi X, A;
mbedtls_mpi_init( &X ); mbedtls_mpi_init( &A );
@ -1720,6 +1720,457 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE */
void mpi_core_add_if( char * input_A, char * input_B,
char * input_S4, int carry4,
char * input_S8, int carry8 )
{
mbedtls_mpi S4, S8, A, B;
mbedtls_mpi_uint *a = NULL; /* first value to add */
mbedtls_mpi_uint *b = NULL; /* second value to add */
mbedtls_mpi_uint *sum = NULL;
mbedtls_mpi_uint *d = NULL; /* destination - the in/out first operand */
mbedtls_mpi_init( &A );
mbedtls_mpi_init( &B );
mbedtls_mpi_init( &S4 );
mbedtls_mpi_init( &S8 );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &A, input_A ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &B, input_B ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &S4, input_S4 ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &S8, input_S8 ) );
/* We only need to work with one of (S4, carry4) or (S8, carry8) depending
* on sizeof(mbedtls_mpi_uint)
*/
mbedtls_mpi *X = ( sizeof(mbedtls_mpi_uint) == 4 ) ? &S4 : &S8;
mbedtls_mpi_uint carry = ( sizeof(mbedtls_mpi_uint) == 4 ) ? carry4 : carry8;
/* All of the inputs are +ve (or zero) */
TEST_EQUAL( 1, A.s );
TEST_EQUAL( 1, B.s );
TEST_EQUAL( 1, X->s );
/* Test cases are such that A <= B, so #limbs should be <= */
TEST_LE_U( A.n, B.n );
TEST_LE_U( X->n, B.n );
/* Now let's get arrays of mbedtls_mpi_uints, rather than MPI structures */
/* mbedtls_mpi_core_add_if() uses input arrays of mbedtls_mpi_uints which
* must be the same size. The MPIs we've read in will only have arrays
* large enough for the number they represent. Therefore we create new
* raw arrays of mbedtls_mpi_uints and populate them from the MPIs we've
* just read in.
*
* We generated test data such that B was always >= A, so that's how many
* limbs each of these need.
*/
size_t limbs = B.n;
size_t bytes = limbs * sizeof(mbedtls_mpi_uint);
/* ASSERT_ALLOC() uses calloc() under the hood, so these do get zeroed */
ASSERT_ALLOC( a, bytes );
ASSERT_ALLOC( b, bytes );
ASSERT_ALLOC( sum, bytes );
ASSERT_ALLOC( d, bytes );
/* Populate the arrays. As the mbedtls_mpi_uint[]s in mbedtls_mpis (and as
* processed by mbedtls_mpi_core_add_if()) are little endian, we can just
* copy what we have as long as MSBs are 0 (which they are from ASSERT_ALLOC())
*/
memcpy( a, A.p, A.n * sizeof(mbedtls_mpi_uint) );
memcpy( b, B.p, B.n * sizeof(mbedtls_mpi_uint) );
memcpy( sum, X->p, X->n * sizeof(mbedtls_mpi_uint) );
/* The test cases have a <= b to avoid repetition, so we test a + b then,
* if a != b, b + a. If a == b, we can test when a and b are aliased */
/* a + b */
/* cond = 0 => d unchanged, no carry */
memcpy( d, a, bytes );
TEST_EQUAL( 0, mbedtls_mpi_core_add_if( d, b, limbs, 0 ) );
ASSERT_COMPARE( d, bytes, a, bytes );
/* cond = 1 => correct result and carry */
TEST_EQUAL( carry, mbedtls_mpi_core_add_if( d, b, limbs, 1 ) );
ASSERT_COMPARE( d, bytes, sum, bytes );
if ( A.n == B.n && memcmp( A.p, B.p, bytes ) == 0 )
{
/* a == b, so test where a and b are aliased */
/* cond = 0 => d unchanged, no carry */
TEST_EQUAL( 0, mbedtls_mpi_core_add_if( b, b, limbs, 0 ) );
ASSERT_COMPARE( b, bytes, B.p, bytes );
/* cond = 1 => correct result and carry */
TEST_EQUAL( carry, mbedtls_mpi_core_add_if( b, b, limbs, 1 ) );
ASSERT_COMPARE( b, bytes, sum, bytes );
}
else
{
/* a != b, so test b + a */
/* cond = 0 => d unchanged, no carry */
memcpy( d, b, bytes );
TEST_EQUAL( 0, mbedtls_mpi_core_add_if( d, a, limbs, 0 ) );
ASSERT_COMPARE( d, bytes, b, bytes );
/* cond = 1 => correct result and carry */
TEST_EQUAL( carry, mbedtls_mpi_core_add_if( d, a, limbs, 1 ) );
ASSERT_COMPARE( d, bytes, sum, bytes );
}
exit:
mbedtls_free( a );
mbedtls_free( b );
mbedtls_free( sum );
mbedtls_free( d );
mbedtls_mpi_free( &S4 );
mbedtls_mpi_free( &S8 );
mbedtls_mpi_free( &A );
mbedtls_mpi_free( &B );
}
/* END_CASE */
/* BEGIN_CASE */
void mpi_core_sub( char * input_A, char * input_B,
char * input_X4, char * input_X8,
int carry )
{
mbedtls_mpi A, B, X4, X8;
mbedtls_mpi_uint *a = NULL;
mbedtls_mpi_uint *b = NULL;
mbedtls_mpi_uint *x = NULL; /* expected */
mbedtls_mpi_uint *r = NULL; /* result */
mbedtls_mpi_init( &A );
mbedtls_mpi_init( &B );
mbedtls_mpi_init( &X4 );
mbedtls_mpi_init( &X8 );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &A, input_A ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &B, input_B ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &X4, input_X4 ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &X8, input_X8 ) );
/* All of the inputs are +ve (or zero) */
TEST_EQUAL( 1, A.s );
TEST_EQUAL( 1, B.s );
TEST_EQUAL( 1, X4.s );
TEST_EQUAL( 1, X8.s );
/* Get the number of limbs we will need */
size_t limbs = MAX( A.n, B.n );
size_t bytes = limbs * sizeof(mbedtls_mpi_uint);
/* We only need to work with X4 or X8, depending on sizeof(mbedtls_mpi_uint) */
mbedtls_mpi *X = ( sizeof(mbedtls_mpi_uint) == 4 ) ? &X4 : &X8;
/* The result shouldn't have more limbs than the longest input */
TEST_LE_U( X->n, limbs );
/* Now let's get arrays of mbedtls_mpi_uints, rather than MPI structures */
/* ASSERT_ALLOC() uses calloc() under the hood, so these do get zeroed */
ASSERT_ALLOC( a, bytes );
ASSERT_ALLOC( b, bytes );
ASSERT_ALLOC( x, bytes );
ASSERT_ALLOC( r, bytes );
/* Populate the arrays. As the mbedtls_mpi_uint[]s in mbedtls_mpis (and as
* processed by mbedtls_mpi_core_sub()) are little endian, we can just
* copy what we have as long as MSBs are 0 (which they are from ASSERT_ALLOC())
*/
memcpy( a, A.p, A.n * sizeof(mbedtls_mpi_uint) );
memcpy( b, B.p, B.n * sizeof(mbedtls_mpi_uint) );
memcpy( x, X->p, X->n * sizeof(mbedtls_mpi_uint) );
/* 1a) r = a - b => we should get the correct carry */
TEST_EQUAL( carry, mbedtls_mpi_core_sub( r, a, b, limbs ) );
/* 1b) r = a - b => we should get the correct result */
ASSERT_COMPARE( r, bytes, x, bytes );
/* 2 and 3 test "r may be aliased to a or b" */
/* 2a) r = a; r -= b => we should get the correct carry (use r to avoid clobbering a) */
memcpy( r, a, bytes );
TEST_EQUAL( carry, mbedtls_mpi_core_sub( r, r, b, limbs ) );
/* 2b) r -= b => we should get the correct result */
ASSERT_COMPARE( r, bytes, x, bytes );
/* 3a) r = b; r = a - r => we should get the correct carry (use r to avoid clobbering b) */
memcpy( r, b, bytes );
TEST_EQUAL( carry, mbedtls_mpi_core_sub( r, a, r, limbs ) );
/* 3b) r = a - b => we should get the correct result */
ASSERT_COMPARE( r, bytes, x, bytes );
/* 4 tests "r may be aliased to [...] both" */
if ( A.n == B.n && memcmp( A.p, B.p, bytes ) == 0 )
{
memcpy( r, b, bytes );
TEST_EQUAL( carry, mbedtls_mpi_core_sub( r, r, r, limbs ) );
ASSERT_COMPARE( r, bytes, x, bytes );
}
exit:
mbedtls_free( a );
mbedtls_free( b );
mbedtls_free( x );
mbedtls_free( r );
mbedtls_mpi_free( &A );
mbedtls_mpi_free( &B );
mbedtls_mpi_free( &X4 );
mbedtls_mpi_free( &X8 );
}
/* END_CASE */
/* BEGIN_CASE */
void mpi_core_mla( char * input_A, char * input_B, char * input_S,
char * input_X4, char * input_cy4,
char * input_X8, char * input_cy8 )
{
/* We are testing A += B * s; A, B are MPIs, s is a scalar.
*
* However, we encode s as an MPI in the .data file as the test framework
* currently only supports `int`-typed scalars, and that doesn't cover the
* full range of `mbedtls_mpi_uint`.
*
* We also have the different results for sizeof(mbedtls_mpi_uint) == 4 or 8.
*/
mbedtls_mpi A, B, S, X4, X8, cy4, cy8;
mbedtls_mpi_uint *a = NULL;
mbedtls_mpi_uint *x = NULL;
mbedtls_mpi_init( &A );
mbedtls_mpi_init( &B );
mbedtls_mpi_init( &S );
mbedtls_mpi_init( &X4 );
mbedtls_mpi_init( &X8 );
mbedtls_mpi_init( &cy4 );
mbedtls_mpi_init( &cy8 );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &A, input_A ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &B, input_B ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &S, input_S ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &X4, input_X4 ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &cy4, input_cy4 ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &X8, input_X8 ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &cy8, input_cy8 ) );
/* The MPI encoding of scalar s must be only 1 limb */
TEST_EQUAL( 1, S.n );
/* We only need to work with X4 or X8, and cy4 or cy8, depending on sizeof(mbedtls_mpi_uint) */
mbedtls_mpi *X = ( sizeof(mbedtls_mpi_uint) == 4 ) ? &X4 : &X8;
mbedtls_mpi *cy = ( sizeof(mbedtls_mpi_uint) == 4 ) ? &cy4 : &cy8;
/* The carry should only have one limb */
TEST_EQUAL( 1, cy->n );
/* All of the inputs are +ve (or zero) */
TEST_EQUAL( 1, A.s );
TEST_EQUAL( 1, B.s );
TEST_EQUAL( 1, S.s );
TEST_EQUAL( 1, X->s );
TEST_EQUAL( 1, cy->s );
/* Get the (max) number of limbs we will need */
size_t limbs = MAX( A.n, B.n );
size_t bytes = limbs * sizeof(mbedtls_mpi_uint);
/* The result shouldn't have more limbs than the longest input */
TEST_LE_U( X->n, limbs );
/* Now let's get arrays of mbedtls_mpi_uints, rather than MPI structures */
/* ASSERT_ALLOC() uses calloc() under the hood, so these do get zeroed */
ASSERT_ALLOC( a, bytes );
ASSERT_ALLOC( x, bytes );
/* Populate the arrays. As the mbedtls_mpi_uint[]s in mbedtls_mpis (and as
* processed by mbedtls_mpi_core_mla()) are little endian, we can just
* copy what we have as long as MSBs are 0 (which they are from ASSERT_ALLOC()).
*/
memcpy( a, A.p, A.n * sizeof(mbedtls_mpi_uint) );
memcpy( x, X->p, X->n * sizeof(mbedtls_mpi_uint) );
/* 1a) A += B * s => we should get the correct carry */
TEST_EQUAL( mbedtls_mpi_core_mla( a, limbs, B.p, B.n, *S.p ), *cy->p );
/* 1b) A += B * s => we should get the correct result */
ASSERT_COMPARE( a, bytes, x, bytes );
if ( A.n == B.n && memcmp( A.p, B.p, bytes ) == 0 )
{
/* Check when A and B are aliased */
memcpy( a, A.p, A.n * sizeof(mbedtls_mpi_uint) );
TEST_EQUAL( mbedtls_mpi_core_mla( a, limbs, a, limbs, *S.p ), *cy->p );
ASSERT_COMPARE( a, bytes, x, bytes );
}
exit:
mbedtls_free( a );
mbedtls_free( x );
mbedtls_mpi_free( &A );
mbedtls_mpi_free( &B );
mbedtls_mpi_free( &S );
mbedtls_mpi_free( &X4 );
mbedtls_mpi_free( &X8 );
mbedtls_mpi_free( &cy4 );
mbedtls_mpi_free( &cy8 );
}
/* END_CASE */
/* BEGIN_CASE */
void mpi_montg_init( char * input_N, char * input_mm )
{
mbedtls_mpi N, mm;
mbedtls_mpi_init( &N );
mbedtls_mpi_init( &mm );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &N, input_N ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &mm, input_mm ) );
/* The MPI encoding of mm should be 1 limb (sizeof(mbedtls_mpi_uint) == 8) or
* 2 limbs (sizeof(mbedtls_mpi_uint) == 4).
*
* The data file contains the expected result for sizeof(mbedtls_mpi_uint) == 8;
* for sizeof(mbedtls_mpi_uint) == 4 it's just the LSW of this.
*/
TEST_ASSERT( mm.n == 1 || mm.n == 2 );
/* All of the inputs are +ve (or zero) */
TEST_EQUAL( 1, N.s );
TEST_EQUAL( 1, mm.s );
/* mbedtls_mpi_core_montmul_init() only returns a result, no error possible */
mbedtls_mpi_uint result = mbedtls_mpi_core_montmul_init( N.p );
/* Check we got the correct result */
TEST_EQUAL( result, mm.p[0] );
exit:
mbedtls_mpi_free( &N );
mbedtls_mpi_free( &mm );
}
/* END_CASE */
/* BEGIN_CASE */
void mpi_core_montmul( int limbs_AN4, int limbs_B4,
int limbs_AN8, int limbs_B8,
char * input_A,
char * input_B,
char * input_N,
char * input_X4,
char * input_X8 )
{
mbedtls_mpi A, B, N, X4, X8, T, R;
mbedtls_mpi_init( &A );
mbedtls_mpi_init( &B );
mbedtls_mpi_init( &N );
mbedtls_mpi_init( &X4 ); /* expected result, sizeof(mbedtls_mpi_uint) == 4 */
mbedtls_mpi_init( &X8 ); /* expected result, sizeof(mbedtls_mpi_uint) == 8 */
mbedtls_mpi_init( &T );
mbedtls_mpi_init( &R ); /* for the result */
TEST_EQUAL( 0, mbedtls_test_read_mpi( &A, input_A ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &B, input_B ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &N, input_N ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &X4, input_X4 ) );
TEST_EQUAL( 0, mbedtls_test_read_mpi( &X8, input_X8 ) );
mbedtls_mpi *X = ( sizeof(mbedtls_mpi_uint) == 4 ) ? &X4 : &X8;
int limbs_AN = ( sizeof(mbedtls_mpi_uint) == 4 ) ? limbs_AN4 : limbs_AN8;
int limbs_B = ( sizeof(mbedtls_mpi_uint) == 4 ) ? limbs_B4 : limbs_B8;
TEST_LE_U( A.n, (size_t)limbs_AN );
TEST_LE_U( X->n, (size_t)limbs_AN );
TEST_LE_U( B.n, (size_t)limbs_B );
TEST_LE_U( limbs_B, limbs_AN );
/* All of the inputs are +ve (or zero) */
TEST_EQUAL( 1, A.s );
TEST_EQUAL( 1, B.s );
TEST_EQUAL( 1, N.s );
TEST_EQUAL( 1, X->s );
TEST_EQUAL( 0, mbedtls_mpi_grow( &A, limbs_AN ) );
TEST_EQUAL( 0, mbedtls_mpi_grow( &N, limbs_AN ) );
TEST_EQUAL( 0, mbedtls_mpi_grow( X, limbs_AN ) );
TEST_EQUAL( 0, mbedtls_mpi_grow( &B, limbs_B ) );
TEST_EQUAL( 0, mbedtls_mpi_grow( &T, limbs_AN * 2 + 1 ) );
/* Calculate the Montgomery constant (this is unit tested separately) */
mbedtls_mpi_uint mm = mbedtls_mpi_core_montmul_init( N.p );
TEST_EQUAL( 0, mbedtls_mpi_grow( &R, limbs_AN ) ); /* ensure it's got the right number of limbs */
mbedtls_mpi_core_montmul( R.p, A.p, B.p, B.n, N.p, N.n, mm, T.p );
size_t bytes = N.n * sizeof(mbedtls_mpi_uint);
ASSERT_COMPARE( R.p, bytes, X->p, bytes );
/* The output (R, above) may be aliased to A - use R to save the value of A */
memcpy( R.p, A.p, bytes );
mbedtls_mpi_core_montmul( A.p, A.p, B.p, B.n, N.p, N.n, mm, T.p );
ASSERT_COMPARE( A.p, bytes, X->p, bytes );
memcpy( A.p, R.p, bytes ); /* restore A */
/* The output may be aliased to N - use R to save the value of N */
memcpy( R.p, N.p, bytes );
mbedtls_mpi_core_montmul( N.p, A.p, B.p, B.n, N.p, N.n, mm, T.p );
ASSERT_COMPARE( N.p, bytes, X->p, bytes );
memcpy( N.p, R.p, bytes );
if (limbs_AN == limbs_B)
{
/* Test when A aliased to B (requires A == B on input values) */
if ( memcmp( A.p, B.p, bytes ) == 0 )
{
/* Test with A aliased to B and output, since this is permitted -
* don't bother with yet another test with only A and B aliased */
mbedtls_mpi_core_montmul( B.p, B.p, B.p, B.n, N.p, N.n, mm, T.p );
ASSERT_COMPARE( B.p, bytes, X->p, bytes );
memcpy( B.p, A.p, bytes ); /* restore B from equal value A */
}
/* The output may be aliased to B - last test, so we don't save B */
mbedtls_mpi_core_montmul( B.p, A.p, B.p, B.n, N.p, N.n, mm, T.p );
ASSERT_COMPARE( B.p, bytes, X->p, bytes );
}
exit:
mbedtls_mpi_free( &A );
mbedtls_mpi_free( &B );
mbedtls_mpi_free( &N );
mbedtls_mpi_free( &X4 );
mbedtls_mpi_free( &X8 );
mbedtls_mpi_free( &T );
mbedtls_mpi_free( &R );
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SELF_TEST */
void mpi_selftest( )
{