cuberite/polarssl
1
0
Fork 0
mirror of https://github.com/cuberite/polarssl.git synced 2025-11-04 04:32:24 -05:00
Code Issues Packages Projects Releases Wiki Activity

Make memory access pattern constant

Browse Source
This commit is contained in:
Manuel Pégourié-Gonnard 2013-11-21 20:00:38 +01:00
parent aade42fd88
commit d728350cee
3 changed files with 28 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/polarssl/bignum.h
View File

@ -246,7 +246,8 @@ void mpi_swap( mpi *X, mpi *Y );
* if( assign ) mpi_copy( X, Y ); * if( assign ) mpi_copy( X, Y );
* except that it avoids leaking any information about whether * except that it avoids leaking any information about whether
* the assignment was done or not (the above code may leak * the assignment was done or not (the above code may leak
* information through branch prediction analysis). * information through branch prediction and/or memory access
* patterns analysis).
*/ */
int mpi_safe_cond_assign( mpi *X, mpi *Y, unsigned char assign ); int mpi_safe_cond_assign( mpi *X, mpi *Y, unsigned char assign );

14
include/polarssl/ecp.h
View File

@ -463,15 +463,15 @@ int ecp_sub( const ecp_group *grp, ecp_point *R,
* or P is not a valid pubkey, * or P is not a valid pubkey,
* POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed * POLARSSL_ERR_MPI_MALLOC_FAILED if memory allocation failed
* *
* \note In order to prevent simple timing attacks, this function * \note In order to prevent timing attacks, this function
* executes a constant number of operations (that is, point * executes the exact same sequence of (base field)
* doubling and addition of distinct points) for random m in * operations for any valid m. It avoids any if-branch or
* the allowed range. * array index depending on the value of m.
* *
* \note If f_rng is not NULL, it is used to randomize intermediate * \note If f_rng is not NULL, it is used to randomize intermediate
* results in order to prevent potential attacks targetting * results in order to prevent potential timing attacks
* these results. It is recommended to always provide a * targetting these results. It is recommended to always
* non-NULL f_rng (the overhead is negligible). * provide a non-NULL f_rng (the overhead is negligible).
*/ */
int ecp_mul( ecp_group *grp, ecp_point *R, int ecp_mul( ecp_group *grp, ecp_point *R,
const mpi *m, const ecp_point *P, const mpi *m, const ecp_point *P,

29
library/ecp.c
View File

@ -1385,14 +1385,23 @@ cleanup:
* Select precomputed point: R = sign(i) * T[ abs(i) / 2 ] * Select precomputed point: R = sign(i) * T[ abs(i) / 2 ]
*/ */
static int ecp_select_comb( const ecp_group *grp, ecp_point *R, static int ecp_select_comb( const ecp_group *grp, ecp_point *R,
const ecp_point T[], unsigned char i ) ecp_point T[], unsigned char t_len,
unsigned char i )
{ {
int ret; int ret;
unsigned char ii, j;
/* Ignore the "sign" bit */ /* Ignore the "sign" bit and scale down */
MPI_CHK( ecp_copy( R, &T[ ( i & 0x7Fu ) >> 1 ] ) ); ii = ( i & 0x7Fu ) >> 1;
/* Restore the Z coordinate */ /* Read the whole table to thwart cache-based timing attacks */
for( j = 0; j < t_len; j++ )
{
MPI_CHK( mpi_safe_cond_assign( &R->X, &T[j].X, j == ii ) );
MPI_CHK( mpi_safe_cond_assign( &R->Y, &T[j].Y, j == ii ) );
}
/* The Z coordinate is always 1 */
MPI_CHK( mpi_lset( &R->Z, 1 ) ); MPI_CHK( mpi_lset( &R->Z, 1 ) );
/* Safely invert result if i is "negative" */ /* Safely invert result if i is "negative" */
@ -1409,7 +1418,7 @@ cleanup:
* Cost: d A + d D + 1 R * Cost: d A + d D + 1 R
*/ */
static int ecp_mul_comb_core( const ecp_group *grp, ecp_point *R, static int ecp_mul_comb_core( const ecp_group *grp, ecp_point *R,
const ecp_point T[], ecp_point T[], unsigned char t_len,
const unsigned char x[], size_t d, const unsigned char x[], size_t d,
int (*f_rng)(void *, unsigned char *, size_t), int (*f_rng)(void *, unsigned char *, size_t),
void *p_rng ) void *p_rng )
@ -1422,14 +1431,14 @@ static int ecp_mul_comb_core( const ecp_group *grp, ecp_point *R,
/* Start with a non-zero point and randomize its coordinates */ /* Start with a non-zero point and randomize its coordinates */
i = d; i = d;
MPI_CHK( ecp_select_comb( grp, R, T, x[i] ) ); MPI_CHK( ecp_select_comb( grp, R, T, t_len, x[i] ) );
if( f_rng != 0 ) if( f_rng != 0 )
MPI_CHK( ecp_randomize_coordinates( grp, R, f_rng, p_rng ) ); MPI_CHK( ecp_randomize_coordinates( grp, R, f_rng, p_rng ) );
while( i-- != 0 ) while( i-- != 0 )
{ {
MPI_CHK( ecp_double_jac( grp, R, R ) ); MPI_CHK( ecp_double_jac( grp, R, R ) );
MPI_CHK( ecp_select_comb( grp, &Txi, T, x[i] ) ); MPI_CHK( ecp_select_comb( grp, &Txi, T, t_len, x[i] ) );
MPI_CHK( ecp_add_mixed( grp, R, R, &Txi ) ); MPI_CHK( ecp_add_mixed( grp, R, R, &Txi ) );
} }
@ -1447,8 +1456,8 @@ int ecp_mul( ecp_group *grp, ecp_point *R,
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
{ {
int ret; int ret;
unsigned char w, m_is_odd, p_eq_g; unsigned char w, m_is_odd, p_eq_g, pre_len, i;
size_t pre_len, d, i; size_t d;
unsigned char k[COMB_MAX_D + 1]; unsigned char k[COMB_MAX_D + 1];
ecp_point *T; ecp_point *T;
mpi M, mm; mpi M, mm;
@ -1542,7 +1551,7 @@ int ecp_mul( ecp_group *grp, ecp_point *R,
* Go for comb multiplication, R = M * P * Go for comb multiplication, R = M * P
*/ */
ecp_comb_fixed( k, d, w, &M ); ecp_comb_fixed( k, d, w, &M );
ecp_mul_comb_core( grp, R, T, k, d, f_rng, p_rng ); MPI_CHK( ecp_mul_comb_core( grp, R, T, pre_len, k, d, f_rng, p_rng ) );
/* /*
* Now get m * P from M * P and normalize it * Now get m * P from M * P and normalize it