Ashley Mills / axTLS

Rough and ready port of axTLS

crypto/bigint.c@0:5a29fd060ac8, 2013-05-13 (annotated)

Committer:
ashleymills
Date:
Mon May 13 18:15:18 2013 +0000
Revision:
0:5a29fd060ac8
initial commit

Who changed what in which revision?

UserRevisionLine numberNew contents of line
ashleymills 0:5a29fd060ac8 1 /*
ashleymills 0:5a29fd060ac8 2 * Copyright (c) 2007, Cameron Rich
ashleymills 0:5a29fd060ac8 3 *
ashleymills 0:5a29fd060ac8 4 * All rights reserved.
ashleymills 0:5a29fd060ac8 5 *
ashleymills 0:5a29fd060ac8 6 * Redistribution and use in source and binary forms, with or without
ashleymills 0:5a29fd060ac8 7 * modification, are permitted provided that the following conditions are met:
ashleymills 0:5a29fd060ac8 8 *
ashleymills 0:5a29fd060ac8 9 * * Redistributions of source code must retain the above copyright notice,
ashleymills 0:5a29fd060ac8 10 * this list of conditions and the following disclaimer.
ashleymills 0:5a29fd060ac8 11 * * Redistributions in binary form must reproduce the above copyright notice,
ashleymills 0:5a29fd060ac8 12 * this list of conditions and the following disclaimer in the documentation
ashleymills 0:5a29fd060ac8 13 * and/or other materials provided with the distribution.
ashleymills 0:5a29fd060ac8 14 * * Neither the name of the axTLS project nor the names of its contributors
ashleymills 0:5a29fd060ac8 15 * may be used to endorse or promote products derived from this software
ashleymills 0:5a29fd060ac8 16 * without specific prior written permission.
ashleymills 0:5a29fd060ac8 17 *
ashleymills 0:5a29fd060ac8 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
ashleymills 0:5a29fd060ac8 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
ashleymills 0:5a29fd060ac8 20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
ashleymills 0:5a29fd060ac8 21 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
ashleymills 0:5a29fd060ac8 22 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
ashleymills 0:5a29fd060ac8 23 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
ashleymills 0:5a29fd060ac8 24 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
ashleymills 0:5a29fd060ac8 25 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
ashleymills 0:5a29fd060ac8 26 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
ashleymills 0:5a29fd060ac8 27 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
ashleymills 0:5a29fd060ac8 28 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
ashleymills 0:5a29fd060ac8 29 */
ashleymills 0:5a29fd060ac8 30
ashleymills 0:5a29fd060ac8 31 /**
ashleymills 0:5a29fd060ac8 32 * @defgroup bigint_api Big Integer API
ashleymills 0:5a29fd060ac8 33 * @brief The bigint implementation as used by the axTLS project.
ashleymills 0:5a29fd060ac8 34 *
ashleymills 0:5a29fd060ac8 35 * The bigint library is for RSA encryption/decryption as well as signing.
ashleymills 0:5a29fd060ac8 36 * This code tries to minimise use of malloc/free by maintaining a small
ashleymills 0:5a29fd060ac8 37 * cache. A bigint context may maintain state by being made "permanent".
ashleymills 0:5a29fd060ac8 38 * It be be later released with a bi_depermanent() and bi_free() call.
ashleymills 0:5a29fd060ac8 39 *
ashleymills 0:5a29fd060ac8 40 * It supports the following reduction techniques:
ashleymills 0:5a29fd060ac8 41 * - Classical
ashleymills 0:5a29fd060ac8 42 * - Barrett
ashleymills 0:5a29fd060ac8 43 * - Montgomery
ashleymills 0:5a29fd060ac8 44 *
ashleymills 0:5a29fd060ac8 45 * It also implements the following:
ashleymills 0:5a29fd060ac8 46 * - Karatsuba multiplication
ashleymills 0:5a29fd060ac8 47 * - Squaring
ashleymills 0:5a29fd060ac8 48 * - Sliding window exponentiation
ashleymills 0:5a29fd060ac8 49 * - Chinese Remainder Theorem (implemented in rsa.c).
ashleymills 0:5a29fd060ac8 50 *
ashleymills 0:5a29fd060ac8 51 * All the algorithms used are pretty standard, and designed for different
ashleymills 0:5a29fd060ac8 52 * data bus sizes. Negative numbers are not dealt with at all, so a subtraction
ashleymills 0:5a29fd060ac8 53 * may need to be tested for negativity.
ashleymills 0:5a29fd060ac8 54 *
ashleymills 0:5a29fd060ac8 55 * This library steals some ideas from Jef Poskanzer
ashleymills 0:5a29fd060ac8 56 * <http://cs.marlboro.edu/term/cs-fall02/algorithms/crypto/RSA/bigint>
ashleymills 0:5a29fd060ac8 57 * and GMP <http://www.swox.com/gmp>. It gets most of its implementation
ashleymills 0:5a29fd060ac8 58 * detail from "The Handbook of Applied Cryptography"
ashleymills 0:5a29fd060ac8 59 * <http://www.cacr.math.uwaterloo.ca/hac/about/chap14.pdf>
ashleymills 0:5a29fd060ac8 60 * @{
ashleymills 0:5a29fd060ac8 61 */
ashleymills 0:5a29fd060ac8 62
ashleymills 0:5a29fd060ac8 63 #include <stdlib.h>
ashleymills 0:5a29fd060ac8 64 #include <limits.h>
ashleymills 0:5a29fd060ac8 65 #include <string.h>
ashleymills 0:5a29fd060ac8 66 #include <stdio.h>
ashleymills 0:5a29fd060ac8 67 #include <time.h>
ashleymills 0:5a29fd060ac8 68 #include "os_port.h"
ashleymills 0:5a29fd060ac8 69 #include "bigint.h"
ashleymills 0:5a29fd060ac8 70
ashleymills 0:5a29fd060ac8 71 #define V1 v->comps[v->size-1] /**< v1 for division */
ashleymills 0:5a29fd060ac8 72 #define V2 v->comps[v->size-2] /**< v2 for division */
ashleymills 0:5a29fd060ac8 73 #define U(j) tmp_u->comps[tmp_u->size-j-1] /**< uj for division */
ashleymills 0:5a29fd060ac8 74 #define Q(j) quotient->comps[quotient->size-j-1] /**< qj for division */
ashleymills 0:5a29fd060ac8 75
ashleymills 0:5a29fd060ac8 76 static bigint *bi_int_multiply(BI_CTX *ctx, bigint *bi, comp i);
ashleymills 0:5a29fd060ac8 77 static bigint *bi_int_divide(BI_CTX *ctx, bigint *biR, comp denom);
ashleymills 0:5a29fd060ac8 78 static bigint *alloc(BI_CTX *ctx, int size);
ashleymills 0:5a29fd060ac8 79 static bigint *trim(bigint *bi);
ashleymills 0:5a29fd060ac8 80 static void more_comps(bigint *bi, int n);
ashleymills 0:5a29fd060ac8 81 #if defined(CONFIG_BIGINT_KARATSUBA) || defined(CONFIG_BIGINT_BARRETT) || \
ashleymills 0:5a29fd060ac8 82 defined(CONFIG_BIGINT_MONTGOMERY)
ashleymills 0:5a29fd060ac8 83 static bigint *comp_right_shift(bigint *biR, int num_shifts);
ashleymills 0:5a29fd060ac8 84 static bigint *comp_left_shift(bigint *biR, int num_shifts);
ashleymills 0:5a29fd060ac8 85 #endif
ashleymills 0:5a29fd060ac8 86
ashleymills 0:5a29fd060ac8 87 #ifdef CONFIG_BIGINT_CHECK_ON
ashleymills 0:5a29fd060ac8 88 static void check(const bigint *bi);
ashleymills 0:5a29fd060ac8 89 #else
ashleymills 0:5a29fd060ac8 90 #define check(A) /**< disappears in normal production mode */
ashleymills 0:5a29fd060ac8 91 #endif
ashleymills 0:5a29fd060ac8 92
ashleymills 0:5a29fd060ac8 93
ashleymills 0:5a29fd060ac8 94 /**
ashleymills 0:5a29fd060ac8 95 * @brief Start a new bigint context.
ashleymills 0:5a29fd060ac8 96 * @return A bigint context.
ashleymills 0:5a29fd060ac8 97 */
ashleymills 0:5a29fd060ac8 98 BI_CTX *bi_initialize(void)
ashleymills 0:5a29fd060ac8 99 {
ashleymills 0:5a29fd060ac8 100 /* calloc() sets everything to zero */
ashleymills 0:5a29fd060ac8 101 BI_CTX *ctx = (BI_CTX *)calloc(1, sizeof(BI_CTX));
ashleymills 0:5a29fd060ac8 102
ashleymills 0:5a29fd060ac8 103 /* the radix */
ashleymills 0:5a29fd060ac8 104 ctx->bi_radix = alloc(ctx, 2);
ashleymills 0:5a29fd060ac8 105 ctx->bi_radix->comps[0] = 0;
ashleymills 0:5a29fd060ac8 106 ctx->bi_radix->comps[1] = 1;
ashleymills 0:5a29fd060ac8 107 bi_permanent(ctx->bi_radix);
ashleymills 0:5a29fd060ac8 108 return ctx;
ashleymills 0:5a29fd060ac8 109 }
ashleymills 0:5a29fd060ac8 110
ashleymills 0:5a29fd060ac8 111 /**
ashleymills 0:5a29fd060ac8 112 * @brief Close the bigint context and free any resources.
ashleymills 0:5a29fd060ac8 113 *
ashleymills 0:5a29fd060ac8 114 * Free up any used memory - a check is done if all objects were not
ashleymills 0:5a29fd060ac8 115 * properly freed.
ashleymills 0:5a29fd060ac8 116 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 117 */
ashleymills 0:5a29fd060ac8 118 void bi_terminate(BI_CTX *ctx)
ashleymills 0:5a29fd060ac8 119 {
ashleymills 0:5a29fd060ac8 120 bi_depermanent(ctx->bi_radix);
ashleymills 0:5a29fd060ac8 121 bi_free(ctx, ctx->bi_radix);
ashleymills 0:5a29fd060ac8 122
ashleymills 0:5a29fd060ac8 123 if (ctx->active_count != 0)
ashleymills 0:5a29fd060ac8 124 {
ashleymills 0:5a29fd060ac8 125 #ifdef CONFIG_SSL_FULL_MODE
ashleymills 0:5a29fd060ac8 126 printf("bi_terminate: there were %d un-freed bigints\n",
ashleymills 0:5a29fd060ac8 127 ctx->active_count);
ashleymills 0:5a29fd060ac8 128 #endif
ashleymills 0:5a29fd060ac8 129 abort();
ashleymills 0:5a29fd060ac8 130 }
ashleymills 0:5a29fd060ac8 131
ashleymills 0:5a29fd060ac8 132 bi_clear_cache(ctx);
ashleymills 0:5a29fd060ac8 133 free(ctx);
ashleymills 0:5a29fd060ac8 134 }
ashleymills 0:5a29fd060ac8 135
ashleymills 0:5a29fd060ac8 136 /**
ashleymills 0:5a29fd060ac8 137 *@brief Clear the memory cache.
ashleymills 0:5a29fd060ac8 138 */
ashleymills 0:5a29fd060ac8 139 void bi_clear_cache(BI_CTX *ctx)
ashleymills 0:5a29fd060ac8 140 {
ashleymills 0:5a29fd060ac8 141 bigint *p, *pn;
ashleymills 0:5a29fd060ac8 142
ashleymills 0:5a29fd060ac8 143 if (ctx->free_list == NULL)
ashleymills 0:5a29fd060ac8 144 return;
ashleymills 0:5a29fd060ac8 145
ashleymills 0:5a29fd060ac8 146 for (p = ctx->free_list; p != NULL; p = pn)
ashleymills 0:5a29fd060ac8 147 {
ashleymills 0:5a29fd060ac8 148 pn = p->next;
ashleymills 0:5a29fd060ac8 149 free(p->comps);
ashleymills 0:5a29fd060ac8 150 free(p);
ashleymills 0:5a29fd060ac8 151 }
ashleymills 0:5a29fd060ac8 152
ashleymills 0:5a29fd060ac8 153 ctx->free_count = 0;
ashleymills 0:5a29fd060ac8 154 ctx->free_list = NULL;
ashleymills 0:5a29fd060ac8 155 }
ashleymills 0:5a29fd060ac8 156
ashleymills 0:5a29fd060ac8 157 /**
ashleymills 0:5a29fd060ac8 158 * @brief Increment the number of references to this object.
ashleymills 0:5a29fd060ac8 159 * It does not do a full copy.
ashleymills 0:5a29fd060ac8 160 * @param bi [in] The bigint to copy.
ashleymills 0:5a29fd060ac8 161 * @return A reference to the same bigint.
ashleymills 0:5a29fd060ac8 162 */
ashleymills 0:5a29fd060ac8 163 bigint *bi_copy(bigint *bi)
ashleymills 0:5a29fd060ac8 164 {
ashleymills 0:5a29fd060ac8 165 check(bi);
ashleymills 0:5a29fd060ac8 166 if (bi->refs != PERMANENT)
ashleymills 0:5a29fd060ac8 167 bi->refs++;
ashleymills 0:5a29fd060ac8 168 return bi;
ashleymills 0:5a29fd060ac8 169 }
ashleymills 0:5a29fd060ac8 170
ashleymills 0:5a29fd060ac8 171 /**
ashleymills 0:5a29fd060ac8 172 * @brief Simply make a bigint object "unfreeable" if bi_free() is called on it.
ashleymills 0:5a29fd060ac8 173 *
ashleymills 0:5a29fd060ac8 174 * For this object to be freed, bi_depermanent() must be called.
ashleymills 0:5a29fd060ac8 175 * @param bi [in] The bigint to be made permanent.
ashleymills 0:5a29fd060ac8 176 */
ashleymills 0:5a29fd060ac8 177 void bi_permanent(bigint *bi)
ashleymills 0:5a29fd060ac8 178 {
ashleymills 0:5a29fd060ac8 179 check(bi);
ashleymills 0:5a29fd060ac8 180 if (bi->refs != 1)
ashleymills 0:5a29fd060ac8 181 {
ashleymills 0:5a29fd060ac8 182 #ifdef CONFIG_SSL_FULL_MODE
ashleymills 0:5a29fd060ac8 183 printf("bi_permanent: refs was not 1\n");
ashleymills 0:5a29fd060ac8 184 #endif
ashleymills 0:5a29fd060ac8 185 abort();
ashleymills 0:5a29fd060ac8 186 }
ashleymills 0:5a29fd060ac8 187
ashleymills 0:5a29fd060ac8 188 bi->refs = PERMANENT;
ashleymills 0:5a29fd060ac8 189 }
ashleymills 0:5a29fd060ac8 190
ashleymills 0:5a29fd060ac8 191 /**
ashleymills 0:5a29fd060ac8 192 * @brief Take a permanent object and make it eligible for freedom.
ashleymills 0:5a29fd060ac8 193 * @param bi [in] The bigint to be made back to temporary.
ashleymills 0:5a29fd060ac8 194 */
ashleymills 0:5a29fd060ac8 195 void bi_depermanent(bigint *bi)
ashleymills 0:5a29fd060ac8 196 {
ashleymills 0:5a29fd060ac8 197 check(bi);
ashleymills 0:5a29fd060ac8 198 if (bi->refs != PERMANENT)
ashleymills 0:5a29fd060ac8 199 {
ashleymills 0:5a29fd060ac8 200 #ifdef CONFIG_SSL_FULL_MODE
ashleymills 0:5a29fd060ac8 201 printf("bi_depermanent: bigint was not permanent\n");
ashleymills 0:5a29fd060ac8 202 #endif
ashleymills 0:5a29fd060ac8 203 abort();
ashleymills 0:5a29fd060ac8 204 }
ashleymills 0:5a29fd060ac8 205
ashleymills 0:5a29fd060ac8 206 bi->refs = 1;
ashleymills 0:5a29fd060ac8 207 }
ashleymills 0:5a29fd060ac8 208
ashleymills 0:5a29fd060ac8 209 /**
ashleymills 0:5a29fd060ac8 210 * @brief Free a bigint object so it can be used again.
ashleymills 0:5a29fd060ac8 211 *
ashleymills 0:5a29fd060ac8 212 * The memory itself it not actually freed, just tagged as being available
ashleymills 0:5a29fd060ac8 213 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 214 * @param bi [in] The bigint to be freed.
ashleymills 0:5a29fd060ac8 215 */
ashleymills 0:5a29fd060ac8 216 void bi_free(BI_CTX *ctx, bigint *bi)
ashleymills 0:5a29fd060ac8 217 {
ashleymills 0:5a29fd060ac8 218 check(bi);
ashleymills 0:5a29fd060ac8 219 if (bi->refs == PERMANENT)
ashleymills 0:5a29fd060ac8 220 {
ashleymills 0:5a29fd060ac8 221 return;
ashleymills 0:5a29fd060ac8 222 }
ashleymills 0:5a29fd060ac8 223
ashleymills 0:5a29fd060ac8 224 if (--bi->refs > 0)
ashleymills 0:5a29fd060ac8 225 {
ashleymills 0:5a29fd060ac8 226 return;
ashleymills 0:5a29fd060ac8 227 }
ashleymills 0:5a29fd060ac8 228
ashleymills 0:5a29fd060ac8 229 bi->next = ctx->free_list;
ashleymills 0:5a29fd060ac8 230 ctx->free_list = bi;
ashleymills 0:5a29fd060ac8 231 ctx->free_count++;
ashleymills 0:5a29fd060ac8 232
ashleymills 0:5a29fd060ac8 233 if (--ctx->active_count < 0)
ashleymills 0:5a29fd060ac8 234 {
ashleymills 0:5a29fd060ac8 235 #ifdef CONFIG_SSL_FULL_MODE
ashleymills 0:5a29fd060ac8 236 printf("bi_free: active_count went negative "
ashleymills 0:5a29fd060ac8 237 "- double-freed bigint?\n");
ashleymills 0:5a29fd060ac8 238 #endif
ashleymills 0:5a29fd060ac8 239 abort();
ashleymills 0:5a29fd060ac8 240 }
ashleymills 0:5a29fd060ac8 241 }
ashleymills 0:5a29fd060ac8 242
ashleymills 0:5a29fd060ac8 243 /**
ashleymills 0:5a29fd060ac8 244 * @brief Convert an (unsigned) integer into a bigint.
ashleymills 0:5a29fd060ac8 245 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 246 * @param i [in] The (unsigned) integer to be converted.
ashleymills 0:5a29fd060ac8 247 *
ashleymills 0:5a29fd060ac8 248 */
ashleymills 0:5a29fd060ac8 249 bigint *int_to_bi(BI_CTX *ctx, comp i)
ashleymills 0:5a29fd060ac8 250 {
ashleymills 0:5a29fd060ac8 251 bigint *biR = alloc(ctx, 1);
ashleymills 0:5a29fd060ac8 252 biR->comps[0] = i;
ashleymills 0:5a29fd060ac8 253 return biR;
ashleymills 0:5a29fd060ac8 254 }
ashleymills 0:5a29fd060ac8 255
ashleymills 0:5a29fd060ac8 256 /**
ashleymills 0:5a29fd060ac8 257 * @brief Do a full copy of the bigint object.
ashleymills 0:5a29fd060ac8 258 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 259 * @param bi [in] The bigint object to be copied.
ashleymills 0:5a29fd060ac8 260 */
ashleymills 0:5a29fd060ac8 261 bigint *bi_clone(BI_CTX *ctx, const bigint *bi)
ashleymills 0:5a29fd060ac8 262 {
ashleymills 0:5a29fd060ac8 263 bigint *biR = alloc(ctx, bi->size);
ashleymills 0:5a29fd060ac8 264 check(bi);
ashleymills 0:5a29fd060ac8 265 memcpy(biR->comps, bi->comps, bi->size*COMP_BYTE_SIZE);
ashleymills 0:5a29fd060ac8 266 return biR;
ashleymills 0:5a29fd060ac8 267 }
ashleymills 0:5a29fd060ac8 268
ashleymills 0:5a29fd060ac8 269 /**
ashleymills 0:5a29fd060ac8 270 * @brief Perform an addition operation between two bigints.
ashleymills 0:5a29fd060ac8 271 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 272 * @param bia [in] A bigint.
ashleymills 0:5a29fd060ac8 273 * @param bib [in] Another bigint.
ashleymills 0:5a29fd060ac8 274 * @return The result of the addition.
ashleymills 0:5a29fd060ac8 275 */
ashleymills 0:5a29fd060ac8 276 bigint *bi_add(BI_CTX *ctx, bigint *bia, bigint *bib)
ashleymills 0:5a29fd060ac8 277 {
ashleymills 0:5a29fd060ac8 278 int n;
ashleymills 0:5a29fd060ac8 279 comp carry = 0;
ashleymills 0:5a29fd060ac8 280 comp *pa, *pb;
ashleymills 0:5a29fd060ac8 281
ashleymills 0:5a29fd060ac8 282 check(bia);
ashleymills 0:5a29fd060ac8 283 check(bib);
ashleymills 0:5a29fd060ac8 284
ashleymills 0:5a29fd060ac8 285 n = max(bia->size, bib->size);
ashleymills 0:5a29fd060ac8 286 more_comps(bia, n+1);
ashleymills 0:5a29fd060ac8 287 more_comps(bib, n);
ashleymills 0:5a29fd060ac8 288 pa = bia->comps;
ashleymills 0:5a29fd060ac8 289 pb = bib->comps;
ashleymills 0:5a29fd060ac8 290
ashleymills 0:5a29fd060ac8 291 do
ashleymills 0:5a29fd060ac8 292 {
ashleymills 0:5a29fd060ac8 293 comp sl, rl, cy1;
ashleymills 0:5a29fd060ac8 294 sl = *pa + *pb++;
ashleymills 0:5a29fd060ac8 295 rl = sl + carry;
ashleymills 0:5a29fd060ac8 296 cy1 = sl < *pa;
ashleymills 0:5a29fd060ac8 297 carry = cy1 | (rl < sl);
ashleymills 0:5a29fd060ac8 298 *pa++ = rl;
ashleymills 0:5a29fd060ac8 299 } while (--n != 0);
ashleymills 0:5a29fd060ac8 300
ashleymills 0:5a29fd060ac8 301 *pa = carry; /* do overflow */
ashleymills 0:5a29fd060ac8 302 bi_free(ctx, bib);
ashleymills 0:5a29fd060ac8 303 return trim(bia);
ashleymills 0:5a29fd060ac8 304 }
ashleymills 0:5a29fd060ac8 305
ashleymills 0:5a29fd060ac8 306 /**
ashleymills 0:5a29fd060ac8 307 * @brief Perform a subtraction operation between two bigints.
ashleymills 0:5a29fd060ac8 308 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 309 * @param bia [in] A bigint.
ashleymills 0:5a29fd060ac8 310 * @param bib [in] Another bigint.
ashleymills 0:5a29fd060ac8 311 * @param is_negative [out] If defined, indicates that the result was negative.
ashleymills 0:5a29fd060ac8 312 * is_negative may be null.
ashleymills 0:5a29fd060ac8 313 * @return The result of the subtraction. The result is always positive.
ashleymills 0:5a29fd060ac8 314 */
ashleymills 0:5a29fd060ac8 315 bigint *bi_subtract(BI_CTX *ctx,
ashleymills 0:5a29fd060ac8 316 bigint *bia, bigint *bib, int *is_negative)
ashleymills 0:5a29fd060ac8 317 {
ashleymills 0:5a29fd060ac8 318 int n = bia->size;
ashleymills 0:5a29fd060ac8 319 comp *pa, *pb, carry = 0;
ashleymills 0:5a29fd060ac8 320
ashleymills 0:5a29fd060ac8 321 check(bia);
ashleymills 0:5a29fd060ac8 322 check(bib);
ashleymills 0:5a29fd060ac8 323
ashleymills 0:5a29fd060ac8 324 more_comps(bib, n);
ashleymills 0:5a29fd060ac8 325 pa = bia->comps;
ashleymills 0:5a29fd060ac8 326 pb = bib->comps;
ashleymills 0:5a29fd060ac8 327
ashleymills 0:5a29fd060ac8 328 do
ashleymills 0:5a29fd060ac8 329 {
ashleymills 0:5a29fd060ac8 330 comp sl, rl, cy1;
ashleymills 0:5a29fd060ac8 331 sl = *pa - *pb++;
ashleymills 0:5a29fd060ac8 332 rl = sl - carry;
ashleymills 0:5a29fd060ac8 333 cy1 = sl > *pa;
ashleymills 0:5a29fd060ac8 334 carry = cy1 | (rl > sl);
ashleymills 0:5a29fd060ac8 335 *pa++ = rl;
ashleymills 0:5a29fd060ac8 336 } while (--n != 0);
ashleymills 0:5a29fd060ac8 337
ashleymills 0:5a29fd060ac8 338 if (is_negative) /* indicate a negative result */
ashleymills 0:5a29fd060ac8 339 {
ashleymills 0:5a29fd060ac8 340 *is_negative = carry;
ashleymills 0:5a29fd060ac8 341 }
ashleymills 0:5a29fd060ac8 342
ashleymills 0:5a29fd060ac8 343 bi_free(ctx, trim(bib)); /* put bib back to the way it was */
ashleymills 0:5a29fd060ac8 344 return trim(bia);
ashleymills 0:5a29fd060ac8 345 }
ashleymills 0:5a29fd060ac8 346
ashleymills 0:5a29fd060ac8 347 /**
ashleymills 0:5a29fd060ac8 348 * Perform a multiply between a bigint an an (unsigned) integer
ashleymills 0:5a29fd060ac8 349 */
ashleymills 0:5a29fd060ac8 350 static bigint *bi_int_multiply(BI_CTX *ctx, bigint *bia, comp b)
ashleymills 0:5a29fd060ac8 351 {
ashleymills 0:5a29fd060ac8 352 int j = 0, n = bia->size;
ashleymills 0:5a29fd060ac8 353 bigint *biR = alloc(ctx, n + 1);
ashleymills 0:5a29fd060ac8 354 comp carry = 0;
ashleymills 0:5a29fd060ac8 355 comp *r = biR->comps;
ashleymills 0:5a29fd060ac8 356 comp *a = bia->comps;
ashleymills 0:5a29fd060ac8 357
ashleymills 0:5a29fd060ac8 358 check(bia);
ashleymills 0:5a29fd060ac8 359
ashleymills 0:5a29fd060ac8 360 /* clear things to start with */
ashleymills 0:5a29fd060ac8 361 memset(r, 0, ((n+1)*COMP_BYTE_SIZE));
ashleymills 0:5a29fd060ac8 362
ashleymills 0:5a29fd060ac8 363 do
ashleymills 0:5a29fd060ac8 364 {
ashleymills 0:5a29fd060ac8 365 long_comp tmp = *r + (long_comp)a[j]*b + carry;
ashleymills 0:5a29fd060ac8 366 *r++ = (comp)tmp; /* downsize */
ashleymills 0:5a29fd060ac8 367 carry = (comp)(tmp >> COMP_BIT_SIZE);
ashleymills 0:5a29fd060ac8 368 } while (++j < n);
ashleymills 0:5a29fd060ac8 369
ashleymills 0:5a29fd060ac8 370 *r = carry;
ashleymills 0:5a29fd060ac8 371 bi_free(ctx, bia);
ashleymills 0:5a29fd060ac8 372 return trim(biR);
ashleymills 0:5a29fd060ac8 373 }
ashleymills 0:5a29fd060ac8 374
ashleymills 0:5a29fd060ac8 375 /**
ashleymills 0:5a29fd060ac8 376 * @brief Does both division and modulo calculations.
ashleymills 0:5a29fd060ac8 377 *
ashleymills 0:5a29fd060ac8 378 * Used extensively when doing classical reduction.
ashleymills 0:5a29fd060ac8 379 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 380 * @param u [in] A bigint which is the numerator.
ashleymills 0:5a29fd060ac8 381 * @param v [in] Either the denominator or the modulus depending on the mode.
ashleymills 0:5a29fd060ac8 382 * @param is_mod [n] Determines if this is a normal division (0) or a reduction
ashleymills 0:5a29fd060ac8 383 * (1).
ashleymills 0:5a29fd060ac8 384 * @return The result of the division/reduction.
ashleymills 0:5a29fd060ac8 385 */
ashleymills 0:5a29fd060ac8 386 bigint *bi_divide(BI_CTX *ctx, bigint *u, bigint *v, int is_mod)
ashleymills 0:5a29fd060ac8 387 {
ashleymills 0:5a29fd060ac8 388 int n = v->size, m = u->size-n;
ashleymills 0:5a29fd060ac8 389 int j = 0, orig_u_size = u->size;
ashleymills 0:5a29fd060ac8 390 uint8_t mod_offset = ctx->mod_offset;
ashleymills 0:5a29fd060ac8 391 comp d;
ashleymills 0:5a29fd060ac8 392 bigint *quotient, *tmp_u;
ashleymills 0:5a29fd060ac8 393 comp q_dash;
ashleymills 0:5a29fd060ac8 394
ashleymills 0:5a29fd060ac8 395 check(u);
ashleymills 0:5a29fd060ac8 396 check(v);
ashleymills 0:5a29fd060ac8 397
ashleymills 0:5a29fd060ac8 398 /* if doing reduction and we are < mod, then return mod */
ashleymills 0:5a29fd060ac8 399 if (is_mod && bi_compare(v, u) > 0)
ashleymills 0:5a29fd060ac8 400 {
ashleymills 0:5a29fd060ac8 401 bi_free(ctx, v);
ashleymills 0:5a29fd060ac8 402 return u;
ashleymills 0:5a29fd060ac8 403 }
ashleymills 0:5a29fd060ac8 404
ashleymills 0:5a29fd060ac8 405 quotient = alloc(ctx, m+1);
ashleymills 0:5a29fd060ac8 406 tmp_u = alloc(ctx, n+1);
ashleymills 0:5a29fd060ac8 407 v = trim(v); /* make sure we have no leading 0's */
ashleymills 0:5a29fd060ac8 408 d = (comp)((long_comp)COMP_RADIX/(V1+1));
ashleymills 0:5a29fd060ac8 409
ashleymills 0:5a29fd060ac8 410 /* clear things to start with */
ashleymills 0:5a29fd060ac8 411 memset(quotient->comps, 0, ((quotient->size)*COMP_BYTE_SIZE));
ashleymills 0:5a29fd060ac8 412
ashleymills 0:5a29fd060ac8 413 /* normalise */
ashleymills 0:5a29fd060ac8 414 if (d > 1)
ashleymills 0:5a29fd060ac8 415 {
ashleymills 0:5a29fd060ac8 416 u = bi_int_multiply(ctx, u, d);
ashleymills 0:5a29fd060ac8 417
ashleymills 0:5a29fd060ac8 418 if (is_mod)
ashleymills 0:5a29fd060ac8 419 {
ashleymills 0:5a29fd060ac8 420 v = ctx->bi_normalised_mod[mod_offset];
ashleymills 0:5a29fd060ac8 421 }
ashleymills 0:5a29fd060ac8 422 else
ashleymills 0:5a29fd060ac8 423 {
ashleymills 0:5a29fd060ac8 424 v = bi_int_multiply(ctx, v, d);
ashleymills 0:5a29fd060ac8 425 }
ashleymills 0:5a29fd060ac8 426 }
ashleymills 0:5a29fd060ac8 427
ashleymills 0:5a29fd060ac8 428 if (orig_u_size == u->size) /* new digit position u0 */
ashleymills 0:5a29fd060ac8 429 {
ashleymills 0:5a29fd060ac8 430 more_comps(u, orig_u_size + 1);
ashleymills 0:5a29fd060ac8 431 }
ashleymills 0:5a29fd060ac8 432
ashleymills 0:5a29fd060ac8 433 do
ashleymills 0:5a29fd060ac8 434 {
ashleymills 0:5a29fd060ac8 435 /* get a temporary short version of u */
ashleymills 0:5a29fd060ac8 436 memcpy(tmp_u->comps, &u->comps[u->size-n-1-j], (n+1)*COMP_BYTE_SIZE);
ashleymills 0:5a29fd060ac8 437
ashleymills 0:5a29fd060ac8 438 /* calculate q' */
ashleymills 0:5a29fd060ac8 439 if (U(0) == V1)
ashleymills 0:5a29fd060ac8 440 {
ashleymills 0:5a29fd060ac8 441 q_dash = COMP_RADIX-1;
ashleymills 0:5a29fd060ac8 442 }
ashleymills 0:5a29fd060ac8 443 else
ashleymills 0:5a29fd060ac8 444 {
ashleymills 0:5a29fd060ac8 445 q_dash = (comp)(((long_comp)U(0)*COMP_RADIX + U(1))/V1);
ashleymills 0:5a29fd060ac8 446
ashleymills 0:5a29fd060ac8 447 if (v->size > 1 && V2)
ashleymills 0:5a29fd060ac8 448 {
ashleymills 0:5a29fd060ac8 449 /* we are implementing the following:
ashleymills 0:5a29fd060ac8 450 if (V2*q_dash > (((U(0)*COMP_RADIX + U(1) -
ashleymills 0:5a29fd060ac8 451 q_dash*V1)*COMP_RADIX) + U(2))) ... */
ashleymills 0:5a29fd060ac8 452 comp inner = (comp)((long_comp)COMP_RADIX*U(0) + U(1) -
ashleymills 0:5a29fd060ac8 453 (long_comp)q_dash*V1);
ashleymills 0:5a29fd060ac8 454 if ((long_comp)V2*q_dash > (long_comp)inner*COMP_RADIX + U(2))
ashleymills 0:5a29fd060ac8 455 {
ashleymills 0:5a29fd060ac8 456 q_dash--;
ashleymills 0:5a29fd060ac8 457 }
ashleymills 0:5a29fd060ac8 458 }
ashleymills 0:5a29fd060ac8 459 }
ashleymills 0:5a29fd060ac8 460
ashleymills 0:5a29fd060ac8 461 /* multiply and subtract */
ashleymills 0:5a29fd060ac8 462 if (q_dash)
ashleymills 0:5a29fd060ac8 463 {
ashleymills 0:5a29fd060ac8 464 int is_negative;
ashleymills 0:5a29fd060ac8 465 tmp_u = bi_subtract(ctx, tmp_u,
ashleymills 0:5a29fd060ac8 466 bi_int_multiply(ctx, bi_copy(v), q_dash), &is_negative);
ashleymills 0:5a29fd060ac8 467 more_comps(tmp_u, n+1);
ashleymills 0:5a29fd060ac8 468
ashleymills 0:5a29fd060ac8 469 Q(j) = q_dash;
ashleymills 0:5a29fd060ac8 470
ashleymills 0:5a29fd060ac8 471 /* add back */
ashleymills 0:5a29fd060ac8 472 if (is_negative)
ashleymills 0:5a29fd060ac8 473 {
ashleymills 0:5a29fd060ac8 474 Q(j)--;
ashleymills 0:5a29fd060ac8 475 tmp_u = bi_add(ctx, tmp_u, bi_copy(v));
ashleymills 0:5a29fd060ac8 476
ashleymills 0:5a29fd060ac8 477 /* lop off the carry */
ashleymills 0:5a29fd060ac8 478 tmp_u->size--;
ashleymills 0:5a29fd060ac8 479 v->size--;
ashleymills 0:5a29fd060ac8 480 }
ashleymills 0:5a29fd060ac8 481 }
ashleymills 0:5a29fd060ac8 482 else
ashleymills 0:5a29fd060ac8 483 {
ashleymills 0:5a29fd060ac8 484 Q(j) = 0;
ashleymills 0:5a29fd060ac8 485 }
ashleymills 0:5a29fd060ac8 486
ashleymills 0:5a29fd060ac8 487 /* copy back to u */
ashleymills 0:5a29fd060ac8 488 memcpy(&u->comps[u->size-n-1-j], tmp_u->comps, (n+1)*COMP_BYTE_SIZE);
ashleymills 0:5a29fd060ac8 489 } while (++j <= m);
ashleymills 0:5a29fd060ac8 490
ashleymills 0:5a29fd060ac8 491 bi_free(ctx, tmp_u);
ashleymills 0:5a29fd060ac8 492 bi_free(ctx, v);
ashleymills 0:5a29fd060ac8 493
ashleymills 0:5a29fd060ac8 494 if (is_mod) /* get the remainder */
ashleymills 0:5a29fd060ac8 495 {
ashleymills 0:5a29fd060ac8 496 bi_free(ctx, quotient);
ashleymills 0:5a29fd060ac8 497 return bi_int_divide(ctx, trim(u), d);
ashleymills 0:5a29fd060ac8 498 }
ashleymills 0:5a29fd060ac8 499 else /* get the quotient */
ashleymills 0:5a29fd060ac8 500 {
ashleymills 0:5a29fd060ac8 501 bi_free(ctx, u);
ashleymills 0:5a29fd060ac8 502 return trim(quotient);
ashleymills 0:5a29fd060ac8 503 }
ashleymills 0:5a29fd060ac8 504 }
ashleymills 0:5a29fd060ac8 505
ashleymills 0:5a29fd060ac8 506 /*
ashleymills 0:5a29fd060ac8 507 * Perform an integer divide on a bigint.
ashleymills 0:5a29fd060ac8 508 */
ashleymills 0:5a29fd060ac8 509 static bigint *bi_int_divide(BI_CTX *ctx, bigint *biR, comp denom)
ashleymills 0:5a29fd060ac8 510 {
ashleymills 0:5a29fd060ac8 511 int i = biR->size - 1;
ashleymills 0:5a29fd060ac8 512 long_comp r = 0;
ashleymills 0:5a29fd060ac8 513
ashleymills 0:5a29fd060ac8 514 check(biR);
ashleymills 0:5a29fd060ac8 515
ashleymills 0:5a29fd060ac8 516 do
ashleymills 0:5a29fd060ac8 517 {
ashleymills 0:5a29fd060ac8 518 r = (r<<COMP_BIT_SIZE) + biR->comps[i];
ashleymills 0:5a29fd060ac8 519 biR->comps[i] = (comp)(r / denom);
ashleymills 0:5a29fd060ac8 520 r %= denom;
ashleymills 0:5a29fd060ac8 521 } while (--i >= 0);
ashleymills 0:5a29fd060ac8 522
ashleymills 0:5a29fd060ac8 523 return trim(biR);
ashleymills 0:5a29fd060ac8 524 }
ashleymills 0:5a29fd060ac8 525
ashleymills 0:5a29fd060ac8 526 #ifdef CONFIG_BIGINT_MONTGOMERY
ashleymills 0:5a29fd060ac8 527 /**
ashleymills 0:5a29fd060ac8 528 * There is a need for the value of integer N' such that B^-1(B-1)-N^-1N'=1,
ashleymills 0:5a29fd060ac8 529 * where B^-1(B-1) mod N=1. Actually, only the least significant part of
ashleymills 0:5a29fd060ac8 530 * N' is needed, hence the definition N0'=N' mod b. We reproduce below the
ashleymills 0:5a29fd060ac8 531 * simple algorithm from an article by Dusse and Kaliski to efficiently
ashleymills 0:5a29fd060ac8 532 * find N0' from N0 and b */
ashleymills 0:5a29fd060ac8 533 static comp modular_inverse(bigint *bim)
ashleymills 0:5a29fd060ac8 534 {
ashleymills 0:5a29fd060ac8 535 int i;
ashleymills 0:5a29fd060ac8 536 comp t = 1;
ashleymills 0:5a29fd060ac8 537 comp two_2_i_minus_1 = 2; /* 2^(i-1) */
ashleymills 0:5a29fd060ac8 538 long_comp two_2_i = 4; /* 2^i */
ashleymills 0:5a29fd060ac8 539 comp N = bim->comps[0];
ashleymills 0:5a29fd060ac8 540
ashleymills 0:5a29fd060ac8 541 for (i = 2; i <= COMP_BIT_SIZE; i++)
ashleymills 0:5a29fd060ac8 542 {
ashleymills 0:5a29fd060ac8 543 if ((long_comp)N*t%two_2_i >= two_2_i_minus_1)
ashleymills 0:5a29fd060ac8 544 {
ashleymills 0:5a29fd060ac8 545 t += two_2_i_minus_1;
ashleymills 0:5a29fd060ac8 546 }
ashleymills 0:5a29fd060ac8 547
ashleymills 0:5a29fd060ac8 548 two_2_i_minus_1 <<= 1;
ashleymills 0:5a29fd060ac8 549 two_2_i <<= 1;
ashleymills 0:5a29fd060ac8 550 }
ashleymills 0:5a29fd060ac8 551
ashleymills 0:5a29fd060ac8 552 return (comp)(COMP_RADIX-t);
ashleymills 0:5a29fd060ac8 553 }
ashleymills 0:5a29fd060ac8 554 #endif
ashleymills 0:5a29fd060ac8 555
ashleymills 0:5a29fd060ac8 556 #if defined(CONFIG_BIGINT_KARATSUBA) || defined(CONFIG_BIGINT_BARRETT) || \
ashleymills 0:5a29fd060ac8 557 defined(CONFIG_BIGINT_MONTGOMERY)
ashleymills 0:5a29fd060ac8 558 /**
ashleymills 0:5a29fd060ac8 559 * Take each component and shift down (in terms of components)
ashleymills 0:5a29fd060ac8 560 */
ashleymills 0:5a29fd060ac8 561 static bigint *comp_right_shift(bigint *biR, int num_shifts)
ashleymills 0:5a29fd060ac8 562 {
ashleymills 0:5a29fd060ac8 563 int i = biR->size-num_shifts;
ashleymills 0:5a29fd060ac8 564 comp *x = biR->comps;
ashleymills 0:5a29fd060ac8 565 comp *y = &biR->comps[num_shifts];
ashleymills 0:5a29fd060ac8 566
ashleymills 0:5a29fd060ac8 567 check(biR);
ashleymills 0:5a29fd060ac8 568
ashleymills 0:5a29fd060ac8 569 if (i <= 0) /* have we completely right shifted? */
ashleymills 0:5a29fd060ac8 570 {
ashleymills 0:5a29fd060ac8 571 biR->comps[0] = 0; /* return 0 */
ashleymills 0:5a29fd060ac8 572 biR->size = 1;
ashleymills 0:5a29fd060ac8 573 return biR;
ashleymills 0:5a29fd060ac8 574 }
ashleymills 0:5a29fd060ac8 575
ashleymills 0:5a29fd060ac8 576 do
ashleymills 0:5a29fd060ac8 577 {
ashleymills 0:5a29fd060ac8 578 *x++ = *y++;
ashleymills 0:5a29fd060ac8 579 } while (--i > 0);
ashleymills 0:5a29fd060ac8 580
ashleymills 0:5a29fd060ac8 581 biR->size -= num_shifts;
ashleymills 0:5a29fd060ac8 582 return biR;
ashleymills 0:5a29fd060ac8 583 }
ashleymills 0:5a29fd060ac8 584
ashleymills 0:5a29fd060ac8 585 /**
ashleymills 0:5a29fd060ac8 586 * Take each component and shift it up (in terms of components)
ashleymills 0:5a29fd060ac8 587 */
ashleymills 0:5a29fd060ac8 588 static bigint *comp_left_shift(bigint *biR, int num_shifts)
ashleymills 0:5a29fd060ac8 589 {
ashleymills 0:5a29fd060ac8 590 int i = biR->size-1;
ashleymills 0:5a29fd060ac8 591 comp *x, *y;
ashleymills 0:5a29fd060ac8 592
ashleymills 0:5a29fd060ac8 593 check(biR);
ashleymills 0:5a29fd060ac8 594
ashleymills 0:5a29fd060ac8 595 if (num_shifts <= 0)
ashleymills 0:5a29fd060ac8 596 {
ashleymills 0:5a29fd060ac8 597 return biR;
ashleymills 0:5a29fd060ac8 598 }
ashleymills 0:5a29fd060ac8 599
ashleymills 0:5a29fd060ac8 600 more_comps(biR, biR->size + num_shifts);
ashleymills 0:5a29fd060ac8 601
ashleymills 0:5a29fd060ac8 602 x = &biR->comps[i+num_shifts];
ashleymills 0:5a29fd060ac8 603 y = &biR->comps[i];
ashleymills 0:5a29fd060ac8 604
ashleymills 0:5a29fd060ac8 605 do
ashleymills 0:5a29fd060ac8 606 {
ashleymills 0:5a29fd060ac8 607 *x-- = *y--;
ashleymills 0:5a29fd060ac8 608 } while (i--);
ashleymills 0:5a29fd060ac8 609
ashleymills 0:5a29fd060ac8 610 memset(biR->comps, 0, num_shifts*COMP_BYTE_SIZE); /* zero LS comps */
ashleymills 0:5a29fd060ac8 611 return biR;
ashleymills 0:5a29fd060ac8 612 }
ashleymills 0:5a29fd060ac8 613 #endif
ashleymills 0:5a29fd060ac8 614
ashleymills 0:5a29fd060ac8 615 /**
ashleymills 0:5a29fd060ac8 616 * @brief Allow a binary sequence to be imported as a bigint.
ashleymills 0:5a29fd060ac8 617 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 618 * @param data [in] The data to be converted.
ashleymills 0:5a29fd060ac8 619 * @param size [in] The number of bytes of data.
ashleymills 0:5a29fd060ac8 620 * @return A bigint representing this data.
ashleymills 0:5a29fd060ac8 621 */
ashleymills 0:5a29fd060ac8 622 bigint *bi_import(BI_CTX *ctx, const uint8_t *data, int size)
ashleymills 0:5a29fd060ac8 623 {
ashleymills 0:5a29fd060ac8 624 bigint *biR = alloc(ctx, (size+COMP_BYTE_SIZE-1)/COMP_BYTE_SIZE);
ashleymills 0:5a29fd060ac8 625 int i, j = 0, offset = 0;
ashleymills 0:5a29fd060ac8 626
ashleymills 0:5a29fd060ac8 627 memset(biR->comps, 0, biR->size*COMP_BYTE_SIZE);
ashleymills 0:5a29fd060ac8 628
ashleymills 0:5a29fd060ac8 629 for (i = size-1; i >= 0; i--)
ashleymills 0:5a29fd060ac8 630 {
ashleymills 0:5a29fd060ac8 631 biR->comps[offset] += data[i] << (j*8);
ashleymills 0:5a29fd060ac8 632
ashleymills 0:5a29fd060ac8 633 if (++j == COMP_BYTE_SIZE)
ashleymills 0:5a29fd060ac8 634 {
ashleymills 0:5a29fd060ac8 635 j = 0;
ashleymills 0:5a29fd060ac8 636 offset ++;
ashleymills 0:5a29fd060ac8 637 }
ashleymills 0:5a29fd060ac8 638 }
ashleymills 0:5a29fd060ac8 639
ashleymills 0:5a29fd060ac8 640 return trim(biR);
ashleymills 0:5a29fd060ac8 641 }
ashleymills 0:5a29fd060ac8 642
ashleymills 0:5a29fd060ac8 643 #ifdef CONFIG_SSL_FULL_MODE
ashleymills 0:5a29fd060ac8 644 /**
ashleymills 0:5a29fd060ac8 645 * @brief The testharness uses this code to import text hex-streams and
ashleymills 0:5a29fd060ac8 646 * convert them into bigints.
ashleymills 0:5a29fd060ac8 647 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 648 * @param data [in] A string consisting of hex characters. The characters must
ashleymills 0:5a29fd060ac8 649 * be in upper case.
ashleymills 0:5a29fd060ac8 650 * @return A bigint representing this data.
ashleymills 0:5a29fd060ac8 651 */
ashleymills 0:5a29fd060ac8 652 bigint *bi_str_import(BI_CTX *ctx, const char *data)
ashleymills 0:5a29fd060ac8 653 {
ashleymills 0:5a29fd060ac8 654 int size = strlen(data);
ashleymills 0:5a29fd060ac8 655 bigint *biR = alloc(ctx, (size+COMP_NUM_NIBBLES-1)/COMP_NUM_NIBBLES);
ashleymills 0:5a29fd060ac8 656 int i, j = 0, offset = 0;
ashleymills 0:5a29fd060ac8 657 memset(biR->comps, 0, biR->size*COMP_BYTE_SIZE);
ashleymills 0:5a29fd060ac8 658
ashleymills 0:5a29fd060ac8 659 for (i = size-1; i >= 0; i--)
ashleymills 0:5a29fd060ac8 660 {
ashleymills 0:5a29fd060ac8 661 int num = (data[i] <= '9') ? (data[i] - '0') : (data[i] - 'A' + 10);
ashleymills 0:5a29fd060ac8 662 biR->comps[offset] += num << (j*4);
ashleymills 0:5a29fd060ac8 663
ashleymills 0:5a29fd060ac8 664 if (++j == COMP_NUM_NIBBLES)
ashleymills 0:5a29fd060ac8 665 {
ashleymills 0:5a29fd060ac8 666 j = 0;
ashleymills 0:5a29fd060ac8 667 offset ++;
ashleymills 0:5a29fd060ac8 668 }
ashleymills 0:5a29fd060ac8 669 }
ashleymills 0:5a29fd060ac8 670
ashleymills 0:5a29fd060ac8 671 return biR;
ashleymills 0:5a29fd060ac8 672 }
ashleymills 0:5a29fd060ac8 673
ashleymills 0:5a29fd060ac8 674 void bi_print(const char *label, bigint *x)
ashleymills 0:5a29fd060ac8 675 {
ashleymills 0:5a29fd060ac8 676 int i, j;
ashleymills 0:5a29fd060ac8 677
ashleymills 0:5a29fd060ac8 678 if (x == NULL)
ashleymills 0:5a29fd060ac8 679 {
ashleymills 0:5a29fd060ac8 680 printf("%s: (null)\n", label);
ashleymills 0:5a29fd060ac8 681 return;
ashleymills 0:5a29fd060ac8 682 }
ashleymills 0:5a29fd060ac8 683
ashleymills 0:5a29fd060ac8 684 printf("%s: (size %d)\n", label, x->size);
ashleymills 0:5a29fd060ac8 685 for (i = x->size-1; i >= 0; i--)
ashleymills 0:5a29fd060ac8 686 {
ashleymills 0:5a29fd060ac8 687 for (j = COMP_NUM_NIBBLES-1; j >= 0; j--)
ashleymills 0:5a29fd060ac8 688 {
ashleymills 0:5a29fd060ac8 689 comp mask = 0x0f << (j*4);
ashleymills 0:5a29fd060ac8 690 comp num = (x->comps[i] & mask) >> (j*4);
ashleymills 0:5a29fd060ac8 691 putc((num <= 9) ? (num + '0') : (num + 'A' - 10), stdout);
ashleymills 0:5a29fd060ac8 692 }
ashleymills 0:5a29fd060ac8 693 }
ashleymills 0:5a29fd060ac8 694
ashleymills 0:5a29fd060ac8 695 printf("\r\n");
ashleymills 0:5a29fd060ac8 696 }
ashleymills 0:5a29fd060ac8 697 #endif
ashleymills 0:5a29fd060ac8 698
ashleymills 0:5a29fd060ac8 699 /**
ashleymills 0:5a29fd060ac8 700 * @brief Take a bigint and convert it into a byte sequence.
ashleymills 0:5a29fd060ac8 701 *
ashleymills 0:5a29fd060ac8 702 * This is useful after a decrypt operation.
ashleymills 0:5a29fd060ac8 703 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 704 * @param x [in] The bigint to be converted.
ashleymills 0:5a29fd060ac8 705 * @param data [out] The converted data as a byte stream.
ashleymills 0:5a29fd060ac8 706 * @param size [in] The maximum size of the byte stream. Unused bytes will be
ashleymills 0:5a29fd060ac8 707 * zeroed.
ashleymills 0:5a29fd060ac8 708 */
ashleymills 0:5a29fd060ac8 709 void bi_export(BI_CTX *ctx, bigint *x, uint8_t *data, int size)
ashleymills 0:5a29fd060ac8 710 {
ashleymills 0:5a29fd060ac8 711 int i, j, k = size-1;
ashleymills 0:5a29fd060ac8 712
ashleymills 0:5a29fd060ac8 713 check(x);
ashleymills 0:5a29fd060ac8 714 memset(data, 0, size); /* ensure all leading 0's are cleared */
ashleymills 0:5a29fd060ac8 715
ashleymills 0:5a29fd060ac8 716 for (i = 0; i < x->size; i++)
ashleymills 0:5a29fd060ac8 717 {
ashleymills 0:5a29fd060ac8 718 for (j = 0; j < COMP_BYTE_SIZE; j++)
ashleymills 0:5a29fd060ac8 719 {
ashleymills 0:5a29fd060ac8 720 comp mask = 0xff << (j*8);
ashleymills 0:5a29fd060ac8 721 int num = (x->comps[i] & mask) >> (j*8);
ashleymills 0:5a29fd060ac8 722 data[k--] = num;
ashleymills 0:5a29fd060ac8 723
ashleymills 0:5a29fd060ac8 724 if (k < 0)
ashleymills 0:5a29fd060ac8 725 {
ashleymills 0:5a29fd060ac8 726 goto buf_done;
ashleymills 0:5a29fd060ac8 727 }
ashleymills 0:5a29fd060ac8 728 }
ashleymills 0:5a29fd060ac8 729 }
ashleymills 0:5a29fd060ac8 730 buf_done:
ashleymills 0:5a29fd060ac8 731
ashleymills 0:5a29fd060ac8 732 bi_free(ctx, x);
ashleymills 0:5a29fd060ac8 733 }
ashleymills 0:5a29fd060ac8 734
ashleymills 0:5a29fd060ac8 735 /**
ashleymills 0:5a29fd060ac8 736 * @brief Pre-calculate some of the expensive steps in reduction.
ashleymills 0:5a29fd060ac8 737 *
ashleymills 0:5a29fd060ac8 738 * This function should only be called once (normally when a session starts).
ashleymills 0:5a29fd060ac8 739 * When the session is over, bi_free_mod() should be called. bi_mod_power()
ashleymills 0:5a29fd060ac8 740 * relies on this function being called.
ashleymills 0:5a29fd060ac8 741 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 742 * @param bim [in] The bigint modulus that will be used.
ashleymills 0:5a29fd060ac8 743 * @param mod_offset [in] There are three moduluii that can be stored - the
ashleymills 0:5a29fd060ac8 744 * standard modulus, and its two primes p and q. This offset refers to which
ashleymills 0:5a29fd060ac8 745 * modulus we are referring to.
ashleymills 0:5a29fd060ac8 746 * @see bi_free_mod(), bi_mod_power().
ashleymills 0:5a29fd060ac8 747 */
ashleymills 0:5a29fd060ac8 748 void bi_set_mod(BI_CTX *ctx, bigint *bim, int mod_offset)
ashleymills 0:5a29fd060ac8 749 {
ashleymills 0:5a29fd060ac8 750 int k = bim->size;
ashleymills 0:5a29fd060ac8 751 comp d = (comp)((long_comp)COMP_RADIX/(bim->comps[k-1]+1));
ashleymills 0:5a29fd060ac8 752 #ifdef CONFIG_BIGINT_MONTGOMERY
ashleymills 0:5a29fd060ac8 753 bigint *R, *R2;
ashleymills 0:5a29fd060ac8 754 #endif
ashleymills 0:5a29fd060ac8 755
ashleymills 0:5a29fd060ac8 756 ctx->bi_mod[mod_offset] = bim;
ashleymills 0:5a29fd060ac8 757 bi_permanent(ctx->bi_mod[mod_offset]);
ashleymills 0:5a29fd060ac8 758 ctx->bi_normalised_mod[mod_offset] = bi_int_multiply(ctx, bim, d);
ashleymills 0:5a29fd060ac8 759 bi_permanent(ctx->bi_normalised_mod[mod_offset]);
ashleymills 0:5a29fd060ac8 760
ashleymills 0:5a29fd060ac8 761 #if defined(CONFIG_BIGINT_MONTGOMERY)
ashleymills 0:5a29fd060ac8 762 /* set montgomery variables */
ashleymills 0:5a29fd060ac8 763 R = comp_left_shift(bi_clone(ctx, ctx->bi_radix), k-1); /* R */
ashleymills 0:5a29fd060ac8 764 R2 = comp_left_shift(bi_clone(ctx, ctx->bi_radix), k*2-1); /* R^2 */
ashleymills 0:5a29fd060ac8 765 ctx->bi_RR_mod_m[mod_offset] = bi_mod(ctx, R2); /* R^2 mod m */
ashleymills 0:5a29fd060ac8 766 ctx->bi_R_mod_m[mod_offset] = bi_mod(ctx, R); /* R mod m */
ashleymills 0:5a29fd060ac8 767
ashleymills 0:5a29fd060ac8 768 bi_permanent(ctx->bi_RR_mod_m[mod_offset]);
ashleymills 0:5a29fd060ac8 769 bi_permanent(ctx->bi_R_mod_m[mod_offset]);
ashleymills 0:5a29fd060ac8 770
ashleymills 0:5a29fd060ac8 771 ctx->N0_dash[mod_offset] = modular_inverse(ctx->bi_mod[mod_offset]);
ashleymills 0:5a29fd060ac8 772
ashleymills 0:5a29fd060ac8 773 #elif defined (CONFIG_BIGINT_BARRETT)
ashleymills 0:5a29fd060ac8 774 ctx->bi_mu[mod_offset] =
ashleymills 0:5a29fd060ac8 775 bi_divide(ctx, comp_left_shift(
ashleymills 0:5a29fd060ac8 776 bi_clone(ctx, ctx->bi_radix), k*2-1), ctx->bi_mod[mod_offset], 0);
ashleymills 0:5a29fd060ac8 777 bi_permanent(ctx->bi_mu[mod_offset]);
ashleymills 0:5a29fd060ac8 778 #endif
ashleymills 0:5a29fd060ac8 779 }
ashleymills 0:5a29fd060ac8 780
ashleymills 0:5a29fd060ac8 781 /**
ashleymills 0:5a29fd060ac8 782 * @brief Used when cleaning various bigints at the end of a session.
ashleymills 0:5a29fd060ac8 783 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 784 * @param mod_offset [in] The offset to use.
ashleymills 0:5a29fd060ac8 785 * @see bi_set_mod().
ashleymills 0:5a29fd060ac8 786 */
ashleymills 0:5a29fd060ac8 787 void bi_free_mod(BI_CTX *ctx, int mod_offset)
ashleymills 0:5a29fd060ac8 788 {
ashleymills 0:5a29fd060ac8 789 bi_depermanent(ctx->bi_mod[mod_offset]);
ashleymills 0:5a29fd060ac8 790 bi_free(ctx, ctx->bi_mod[mod_offset]);
ashleymills 0:5a29fd060ac8 791 #if defined (CONFIG_BIGINT_MONTGOMERY)
ashleymills 0:5a29fd060ac8 792 bi_depermanent(ctx->bi_RR_mod_m[mod_offset]);
ashleymills 0:5a29fd060ac8 793 bi_depermanent(ctx->bi_R_mod_m[mod_offset]);
ashleymills 0:5a29fd060ac8 794 bi_free(ctx, ctx->bi_RR_mod_m[mod_offset]);
ashleymills 0:5a29fd060ac8 795 bi_free(ctx, ctx->bi_R_mod_m[mod_offset]);
ashleymills 0:5a29fd060ac8 796 #elif defined(CONFIG_BIGINT_BARRETT)
ashleymills 0:5a29fd060ac8 797 bi_depermanent(ctx->bi_mu[mod_offset]);
ashleymills 0:5a29fd060ac8 798 bi_free(ctx, ctx->bi_mu[mod_offset]);
ashleymills 0:5a29fd060ac8 799 #endif
ashleymills 0:5a29fd060ac8 800 bi_depermanent(ctx->bi_normalised_mod[mod_offset]);
ashleymills 0:5a29fd060ac8 801 bi_free(ctx, ctx->bi_normalised_mod[mod_offset]);
ashleymills 0:5a29fd060ac8 802 }
ashleymills 0:5a29fd060ac8 803
ashleymills 0:5a29fd060ac8 804 /**
ashleymills 0:5a29fd060ac8 805 * Perform a standard multiplication between two bigints.
ashleymills 0:5a29fd060ac8 806 *
ashleymills 0:5a29fd060ac8 807 * Barrett reduction has no need for some parts of the product, so ignore bits
ashleymills 0:5a29fd060ac8 808 * of the multiply. This routine gives Barrett its big performance
ashleymills 0:5a29fd060ac8 809 * improvements over Classical/Montgomery reduction methods.
ashleymills 0:5a29fd060ac8 810 */
ashleymills 0:5a29fd060ac8 811 static bigint *regular_multiply(BI_CTX *ctx, bigint *bia, bigint *bib,
ashleymills 0:5a29fd060ac8 812 int inner_partial, int outer_partial)
ashleymills 0:5a29fd060ac8 813 {
ashleymills 0:5a29fd060ac8 814 int i = 0, j;
ashleymills 0:5a29fd060ac8 815 int n = bia->size;
ashleymills 0:5a29fd060ac8 816 int t = bib->size;
ashleymills 0:5a29fd060ac8 817 bigint *biR = alloc(ctx, n + t);
ashleymills 0:5a29fd060ac8 818 comp *sr = biR->comps;
ashleymills 0:5a29fd060ac8 819 comp *sa = bia->comps;
ashleymills 0:5a29fd060ac8 820 comp *sb = bib->comps;
ashleymills 0:5a29fd060ac8 821
ashleymills 0:5a29fd060ac8 822 check(bia);
ashleymills 0:5a29fd060ac8 823 check(bib);
ashleymills 0:5a29fd060ac8 824
ashleymills 0:5a29fd060ac8 825 /* clear things to start with */
ashleymills 0:5a29fd060ac8 826 memset(biR->comps, 0, ((n+t)*COMP_BYTE_SIZE));
ashleymills 0:5a29fd060ac8 827
ashleymills 0:5a29fd060ac8 828 do
ashleymills 0:5a29fd060ac8 829 {
ashleymills 0:5a29fd060ac8 830 long_comp tmp;
ashleymills 0:5a29fd060ac8 831 comp carry = 0;
ashleymills 0:5a29fd060ac8 832 int r_index = i;
ashleymills 0:5a29fd060ac8 833 j = 0;
ashleymills 0:5a29fd060ac8 834
ashleymills 0:5a29fd060ac8 835 if (outer_partial && outer_partial-i > 0 && outer_partial < n)
ashleymills 0:5a29fd060ac8 836 {
ashleymills 0:5a29fd060ac8 837 r_index = outer_partial-1;
ashleymills 0:5a29fd060ac8 838 j = outer_partial-i-1;
ashleymills 0:5a29fd060ac8 839 }
ashleymills 0:5a29fd060ac8 840
ashleymills 0:5a29fd060ac8 841 do
ashleymills 0:5a29fd060ac8 842 {
ashleymills 0:5a29fd060ac8 843 if (inner_partial && r_index >= inner_partial)
ashleymills 0:5a29fd060ac8 844 {
ashleymills 0:5a29fd060ac8 845 break;
ashleymills 0:5a29fd060ac8 846 }
ashleymills 0:5a29fd060ac8 847
ashleymills 0:5a29fd060ac8 848 tmp = sr[r_index] + ((long_comp)sa[j])*sb[i] + carry;
ashleymills 0:5a29fd060ac8 849 sr[r_index++] = (comp)tmp; /* downsize */
ashleymills 0:5a29fd060ac8 850 carry = tmp >> COMP_BIT_SIZE;
ashleymills 0:5a29fd060ac8 851 } while (++j < n);
ashleymills 0:5a29fd060ac8 852
ashleymills 0:5a29fd060ac8 853 sr[r_index] = carry;
ashleymills 0:5a29fd060ac8 854 } while (++i < t);
ashleymills 0:5a29fd060ac8 855
ashleymills 0:5a29fd060ac8 856 bi_free(ctx, bia);
ashleymills 0:5a29fd060ac8 857 bi_free(ctx, bib);
ashleymills 0:5a29fd060ac8 858 return trim(biR);
ashleymills 0:5a29fd060ac8 859 }
ashleymills 0:5a29fd060ac8 860
ashleymills 0:5a29fd060ac8 861 #ifdef CONFIG_BIGINT_KARATSUBA
ashleymills 0:5a29fd060ac8 862 /*
ashleymills 0:5a29fd060ac8 863 * Karatsuba improves on regular multiplication due to only 3 multiplications
ashleymills 0:5a29fd060ac8 864 * being done instead of 4. The additional additions/subtractions are O(N)
ashleymills 0:5a29fd060ac8 865 * rather than O(N^2) and so for big numbers it saves on a few operations
ashleymills 0:5a29fd060ac8 866 */
ashleymills 0:5a29fd060ac8 867 static bigint *karatsuba(BI_CTX *ctx, bigint *bia, bigint *bib, int is_square)
ashleymills 0:5a29fd060ac8 868 {
ashleymills 0:5a29fd060ac8 869 bigint *x0, *x1;
ashleymills 0:5a29fd060ac8 870 bigint *p0, *p1, *p2;
ashleymills 0:5a29fd060ac8 871 int m;
ashleymills 0:5a29fd060ac8 872
ashleymills 0:5a29fd060ac8 873 if (is_square)
ashleymills 0:5a29fd060ac8 874 {
ashleymills 0:5a29fd060ac8 875 m = (bia->size + 1)/2;
ashleymills 0:5a29fd060ac8 876 }
ashleymills 0:5a29fd060ac8 877 else
ashleymills 0:5a29fd060ac8 878 {
ashleymills 0:5a29fd060ac8 879 m = (max(bia->size, bib->size) + 1)/2;
ashleymills 0:5a29fd060ac8 880 }
ashleymills 0:5a29fd060ac8 881
ashleymills 0:5a29fd060ac8 882 x0 = bi_clone(ctx, bia);
ashleymills 0:5a29fd060ac8 883 x0->size = m;
ashleymills 0:5a29fd060ac8 884 x1 = bi_clone(ctx, bia);
ashleymills 0:5a29fd060ac8 885 comp_right_shift(x1, m);
ashleymills 0:5a29fd060ac8 886 bi_free(ctx, bia);
ashleymills 0:5a29fd060ac8 887
ashleymills 0:5a29fd060ac8 888 /* work out the 3 partial products */
ashleymills 0:5a29fd060ac8 889 if (is_square)
ashleymills 0:5a29fd060ac8 890 {
ashleymills 0:5a29fd060ac8 891 p0 = bi_square(ctx, bi_copy(x0));
ashleymills 0:5a29fd060ac8 892 p2 = bi_square(ctx, bi_copy(x1));
ashleymills 0:5a29fd060ac8 893 p1 = bi_square(ctx, bi_add(ctx, x0, x1));
ashleymills 0:5a29fd060ac8 894 }
ashleymills 0:5a29fd060ac8 895 else /* normal multiply */
ashleymills 0:5a29fd060ac8 896 {
ashleymills 0:5a29fd060ac8 897 bigint *y0, *y1;
ashleymills 0:5a29fd060ac8 898 y0 = bi_clone(ctx, bib);
ashleymills 0:5a29fd060ac8 899 y0->size = m;
ashleymills 0:5a29fd060ac8 900 y1 = bi_clone(ctx, bib);
ashleymills 0:5a29fd060ac8 901 comp_right_shift(y1, m);
ashleymills 0:5a29fd060ac8 902 bi_free(ctx, bib);
ashleymills 0:5a29fd060ac8 903
ashleymills 0:5a29fd060ac8 904 p0 = bi_multiply(ctx, bi_copy(x0), bi_copy(y0));
ashleymills 0:5a29fd060ac8 905 p2 = bi_multiply(ctx, bi_copy(x1), bi_copy(y1));
ashleymills 0:5a29fd060ac8 906 p1 = bi_multiply(ctx, bi_add(ctx, x0, x1), bi_add(ctx, y0, y1));
ashleymills 0:5a29fd060ac8 907 }
ashleymills 0:5a29fd060ac8 908
ashleymills 0:5a29fd060ac8 909 p1 = bi_subtract(ctx,
ashleymills 0:5a29fd060ac8 910 bi_subtract(ctx, p1, bi_copy(p2), NULL), bi_copy(p0), NULL);
ashleymills 0:5a29fd060ac8 911
ashleymills 0:5a29fd060ac8 912 comp_left_shift(p1, m);
ashleymills 0:5a29fd060ac8 913 comp_left_shift(p2, 2*m);
ashleymills 0:5a29fd060ac8 914 return bi_add(ctx, p1, bi_add(ctx, p0, p2));
ashleymills 0:5a29fd060ac8 915 }
ashleymills 0:5a29fd060ac8 916 #endif
ashleymills 0:5a29fd060ac8 917
ashleymills 0:5a29fd060ac8 918 /**
ashleymills 0:5a29fd060ac8 919 * @brief Perform a multiplication operation between two bigints.
ashleymills 0:5a29fd060ac8 920 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 921 * @param bia [in] A bigint.
ashleymills 0:5a29fd060ac8 922 * @param bib [in] Another bigint.
ashleymills 0:5a29fd060ac8 923 * @return The result of the multiplication.
ashleymills 0:5a29fd060ac8 924 */
ashleymills 0:5a29fd060ac8 925 bigint *bi_multiply(BI_CTX *ctx, bigint *bia, bigint *bib)
ashleymills 0:5a29fd060ac8 926 {
ashleymills 0:5a29fd060ac8 927 check(bia);
ashleymills 0:5a29fd060ac8 928 check(bib);
ashleymills 0:5a29fd060ac8 929
ashleymills 0:5a29fd060ac8 930 #ifdef CONFIG_BIGINT_KARATSUBA
ashleymills 0:5a29fd060ac8 931 if (min(bia->size, bib->size) < MUL_KARATSUBA_THRESH)
ashleymills 0:5a29fd060ac8 932 {
ashleymills 0:5a29fd060ac8 933 return regular_multiply(ctx, bia, bib, 0, 0);
ashleymills 0:5a29fd060ac8 934 }
ashleymills 0:5a29fd060ac8 935
ashleymills 0:5a29fd060ac8 936 return karatsuba(ctx, bia, bib, 0);
ashleymills 0:5a29fd060ac8 937 #else
ashleymills 0:5a29fd060ac8 938 return regular_multiply(ctx, bia, bib, 0, 0);
ashleymills 0:5a29fd060ac8 939 #endif
ashleymills 0:5a29fd060ac8 940 }
ashleymills 0:5a29fd060ac8 941
ashleymills 0:5a29fd060ac8 942 #ifdef CONFIG_BIGINT_SQUARE
ashleymills 0:5a29fd060ac8 943 /*
ashleymills 0:5a29fd060ac8 944 * Perform the actual square operion. It takes into account overflow.
ashleymills 0:5a29fd060ac8 945 */
ashleymills 0:5a29fd060ac8 946 static bigint *regular_square(BI_CTX *ctx, bigint *bi)
ashleymills 0:5a29fd060ac8 947 {
ashleymills 0:5a29fd060ac8 948 int t = bi->size;
ashleymills 0:5a29fd060ac8 949 int i = 0, j;
ashleymills 0:5a29fd060ac8 950 bigint *biR = alloc(ctx, t*2+1);
ashleymills 0:5a29fd060ac8 951 comp *w = biR->comps;
ashleymills 0:5a29fd060ac8 952 comp *x = bi->comps;
ashleymills 0:5a29fd060ac8 953 long_comp carry;
ashleymills 0:5a29fd060ac8 954 memset(w, 0, biR->size*COMP_BYTE_SIZE);
ashleymills 0:5a29fd060ac8 955
ashleymills 0:5a29fd060ac8 956 do
ashleymills 0:5a29fd060ac8 957 {
ashleymills 0:5a29fd060ac8 958 long_comp tmp = w[2*i] + (long_comp)x[i]*x[i];
ashleymills 0:5a29fd060ac8 959 w[2*i] = (comp)tmp;
ashleymills 0:5a29fd060ac8 960 carry = tmp >> COMP_BIT_SIZE;
ashleymills 0:5a29fd060ac8 961
ashleymills 0:5a29fd060ac8 962 for (j = i+1; j < t; j++)
ashleymills 0:5a29fd060ac8 963 {
ashleymills 0:5a29fd060ac8 964 uint8_t c = 0;
ashleymills 0:5a29fd060ac8 965 long_comp xx = (long_comp)x[i]*x[j];
ashleymills 0:5a29fd060ac8 966 if ((COMP_MAX-xx) < xx)
ashleymills 0:5a29fd060ac8 967 c = 1;
ashleymills 0:5a29fd060ac8 968
ashleymills 0:5a29fd060ac8 969 tmp = (xx<<1);
ashleymills 0:5a29fd060ac8 970
ashleymills 0:5a29fd060ac8 971 if ((COMP_MAX-tmp) < w[i+j])
ashleymills 0:5a29fd060ac8 972 c = 1;
ashleymills 0:5a29fd060ac8 973
ashleymills 0:5a29fd060ac8 974 tmp += w[i+j];
ashleymills 0:5a29fd060ac8 975
ashleymills 0:5a29fd060ac8 976 if ((COMP_MAX-tmp) < carry)
ashleymills 0:5a29fd060ac8 977 c = 1;
ashleymills 0:5a29fd060ac8 978
ashleymills 0:5a29fd060ac8 979 tmp += carry;
ashleymills 0:5a29fd060ac8 980 w[i+j] = (comp)tmp;
ashleymills 0:5a29fd060ac8 981 carry = tmp >> COMP_BIT_SIZE;
ashleymills 0:5a29fd060ac8 982
ashleymills 0:5a29fd060ac8 983 if (c)
ashleymills 0:5a29fd060ac8 984 carry += COMP_RADIX;
ashleymills 0:5a29fd060ac8 985 }
ashleymills 0:5a29fd060ac8 986
ashleymills 0:5a29fd060ac8 987 tmp = w[i+t] + carry;
ashleymills 0:5a29fd060ac8 988 w[i+t] = (comp)tmp;
ashleymills 0:5a29fd060ac8 989 w[i+t+1] = tmp >> COMP_BIT_SIZE;
ashleymills 0:5a29fd060ac8 990 } while (++i < t);
ashleymills 0:5a29fd060ac8 991
ashleymills 0:5a29fd060ac8 992 bi_free(ctx, bi);
ashleymills 0:5a29fd060ac8 993 return trim(biR);
ashleymills 0:5a29fd060ac8 994 }
ashleymills 0:5a29fd060ac8 995
ashleymills 0:5a29fd060ac8 996 /**
ashleymills 0:5a29fd060ac8 997 * @brief Perform a square operation on a bigint.
ashleymills 0:5a29fd060ac8 998 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 999 * @param bia [in] A bigint.
ashleymills 0:5a29fd060ac8 1000 * @return The result of the multiplication.
ashleymills 0:5a29fd060ac8 1001 */
ashleymills 0:5a29fd060ac8 1002 bigint *bi_square(BI_CTX *ctx, bigint *bia)
ashleymills 0:5a29fd060ac8 1003 {
ashleymills 0:5a29fd060ac8 1004 check(bia);
ashleymills 0:5a29fd060ac8 1005
ashleymills 0:5a29fd060ac8 1006 #ifdef CONFIG_BIGINT_KARATSUBA
ashleymills 0:5a29fd060ac8 1007 if (bia->size < SQU_KARATSUBA_THRESH)
ashleymills 0:5a29fd060ac8 1008 {
ashleymills 0:5a29fd060ac8 1009 return regular_square(ctx, bia);
ashleymills 0:5a29fd060ac8 1010 }
ashleymills 0:5a29fd060ac8 1011
ashleymills 0:5a29fd060ac8 1012 return karatsuba(ctx, bia, NULL, 1);
ashleymills 0:5a29fd060ac8 1013 #else
ashleymills 0:5a29fd060ac8 1014 return regular_square(ctx, bia);
ashleymills 0:5a29fd060ac8 1015 #endif
ashleymills 0:5a29fd060ac8 1016 }
ashleymills 0:5a29fd060ac8 1017 #endif
ashleymills 0:5a29fd060ac8 1018
ashleymills 0:5a29fd060ac8 1019 /**
ashleymills 0:5a29fd060ac8 1020 * @brief Compare two bigints.
ashleymills 0:5a29fd060ac8 1021 * @param bia [in] A bigint.
ashleymills 0:5a29fd060ac8 1022 * @param bib [in] Another bigint.
ashleymills 0:5a29fd060ac8 1023 * @return -1 if smaller, 1 if larger and 0 if equal.
ashleymills 0:5a29fd060ac8 1024 */
ashleymills 0:5a29fd060ac8 1025 int bi_compare(bigint *bia, bigint *bib)
ashleymills 0:5a29fd060ac8 1026 {
ashleymills 0:5a29fd060ac8 1027 int r, i;
ashleymills 0:5a29fd060ac8 1028
ashleymills 0:5a29fd060ac8 1029 check(bia);
ashleymills 0:5a29fd060ac8 1030 check(bib);
ashleymills 0:5a29fd060ac8 1031
ashleymills 0:5a29fd060ac8 1032 if (bia->size > bib->size)
ashleymills 0:5a29fd060ac8 1033 r = 1;
ashleymills 0:5a29fd060ac8 1034 else if (bia->size < bib->size)
ashleymills 0:5a29fd060ac8 1035 r = -1;
ashleymills 0:5a29fd060ac8 1036 else
ashleymills 0:5a29fd060ac8 1037 {
ashleymills 0:5a29fd060ac8 1038 comp *a = bia->comps;
ashleymills 0:5a29fd060ac8 1039 comp *b = bib->comps;
ashleymills 0:5a29fd060ac8 1040
ashleymills 0:5a29fd060ac8 1041 /* Same number of components. Compare starting from the high end
ashleymills 0:5a29fd060ac8 1042 * and working down. */
ashleymills 0:5a29fd060ac8 1043 r = 0;
ashleymills 0:5a29fd060ac8 1044 i = bia->size - 1;
ashleymills 0:5a29fd060ac8 1045
ashleymills 0:5a29fd060ac8 1046 do
ashleymills 0:5a29fd060ac8 1047 {
ashleymills 0:5a29fd060ac8 1048 if (a[i] > b[i])
ashleymills 0:5a29fd060ac8 1049 {
ashleymills 0:5a29fd060ac8 1050 r = 1;
ashleymills 0:5a29fd060ac8 1051 break;
ashleymills 0:5a29fd060ac8 1052 }
ashleymills 0:5a29fd060ac8 1053 else if (a[i] < b[i])
ashleymills 0:5a29fd060ac8 1054 {
ashleymills 0:5a29fd060ac8 1055 r = -1;
ashleymills 0:5a29fd060ac8 1056 break;
ashleymills 0:5a29fd060ac8 1057 }
ashleymills 0:5a29fd060ac8 1058 } while (--i >= 0);
ashleymills 0:5a29fd060ac8 1059 }
ashleymills 0:5a29fd060ac8 1060
ashleymills 0:5a29fd060ac8 1061 return r;
ashleymills 0:5a29fd060ac8 1062 }
ashleymills 0:5a29fd060ac8 1063
ashleymills 0:5a29fd060ac8 1064 /*
ashleymills 0:5a29fd060ac8 1065 * Allocate and zero more components. Does not consume bi.
ashleymills 0:5a29fd060ac8 1066 */
ashleymills 0:5a29fd060ac8 1067 static void more_comps(bigint *bi, int n)
ashleymills 0:5a29fd060ac8 1068 {
ashleymills 0:5a29fd060ac8 1069 if (n > bi->max_comps)
ashleymills 0:5a29fd060ac8 1070 {
ashleymills 0:5a29fd060ac8 1071 bi->max_comps = max(bi->max_comps * 2, n);
ashleymills 0:5a29fd060ac8 1072 bi->comps = (comp*)realloc(bi->comps, bi->max_comps * COMP_BYTE_SIZE);
ashleymills 0:5a29fd060ac8 1073 }
ashleymills 0:5a29fd060ac8 1074
ashleymills 0:5a29fd060ac8 1075 if (n > bi->size)
ashleymills 0:5a29fd060ac8 1076 {
ashleymills 0:5a29fd060ac8 1077 memset(&bi->comps[bi->size], 0, (n-bi->size)*COMP_BYTE_SIZE);
ashleymills 0:5a29fd060ac8 1078 }
ashleymills 0:5a29fd060ac8 1079
ashleymills 0:5a29fd060ac8 1080 bi->size = n;
ashleymills 0:5a29fd060ac8 1081 }
ashleymills 0:5a29fd060ac8 1082
ashleymills 0:5a29fd060ac8 1083 /*
ashleymills 0:5a29fd060ac8 1084 * Make a new empty bigint. It may just use an old one if one is available.
ashleymills 0:5a29fd060ac8 1085 * Otherwise get one off the heap.
ashleymills 0:5a29fd060ac8 1086 */
ashleymills 0:5a29fd060ac8 1087 static bigint *alloc(BI_CTX *ctx, int size)
ashleymills 0:5a29fd060ac8 1088 {
ashleymills 0:5a29fd060ac8 1089 bigint *biR;
ashleymills 0:5a29fd060ac8 1090
ashleymills 0:5a29fd060ac8 1091 /* Can we recycle an old bigint? */
ashleymills 0:5a29fd060ac8 1092 if (ctx->free_list != NULL)
ashleymills 0:5a29fd060ac8 1093 {
ashleymills 0:5a29fd060ac8 1094 biR = ctx->free_list;
ashleymills 0:5a29fd060ac8 1095 ctx->free_list = biR->next;
ashleymills 0:5a29fd060ac8 1096 ctx->free_count--;
ashleymills 0:5a29fd060ac8 1097
ashleymills 0:5a29fd060ac8 1098 if (biR->refs != 0)
ashleymills 0:5a29fd060ac8 1099 {
ashleymills 0:5a29fd060ac8 1100 #ifdef CONFIG_SSL_FULL_MODE
ashleymills 0:5a29fd060ac8 1101 printf("alloc: refs was not 0\n");
ashleymills 0:5a29fd060ac8 1102 #endif
ashleymills 0:5a29fd060ac8 1103 abort(); /* create a stack trace from a core dump */
ashleymills 0:5a29fd060ac8 1104 }
ashleymills 0:5a29fd060ac8 1105
ashleymills 0:5a29fd060ac8 1106 more_comps(biR, size);
ashleymills 0:5a29fd060ac8 1107 }
ashleymills 0:5a29fd060ac8 1108 else
ashleymills 0:5a29fd060ac8 1109 {
ashleymills 0:5a29fd060ac8 1110 /* No free bigints available - create a new one. */
ashleymills 0:5a29fd060ac8 1111 biR = (bigint *)malloc(sizeof(bigint));
ashleymills 0:5a29fd060ac8 1112 biR->comps = (comp*)malloc(size * COMP_BYTE_SIZE);
ashleymills 0:5a29fd060ac8 1113 biR->max_comps = size; /* give some space to spare */
ashleymills 0:5a29fd060ac8 1114 }
ashleymills 0:5a29fd060ac8 1115
ashleymills 0:5a29fd060ac8 1116 biR->size = size;
ashleymills 0:5a29fd060ac8 1117 biR->refs = 1;
ashleymills 0:5a29fd060ac8 1118 biR->next = NULL;
ashleymills 0:5a29fd060ac8 1119 ctx->active_count++;
ashleymills 0:5a29fd060ac8 1120 return biR;
ashleymills 0:5a29fd060ac8 1121 }
ashleymills 0:5a29fd060ac8 1122
ashleymills 0:5a29fd060ac8 1123 /*
ashleymills 0:5a29fd060ac8 1124 * Work out the highest '1' bit in an exponent. Used when doing sliding-window
ashleymills 0:5a29fd060ac8 1125 * exponentiation.
ashleymills 0:5a29fd060ac8 1126 */
ashleymills 0:5a29fd060ac8 1127 static int find_max_exp_index(bigint *biexp)
ashleymills 0:5a29fd060ac8 1128 {
ashleymills 0:5a29fd060ac8 1129 int i = COMP_BIT_SIZE-1;
ashleymills 0:5a29fd060ac8 1130 comp shift = COMP_RADIX/2;
ashleymills 0:5a29fd060ac8 1131 comp test = biexp->comps[biexp->size-1]; /* assume no leading zeroes */
ashleymills 0:5a29fd060ac8 1132
ashleymills 0:5a29fd060ac8 1133 check(biexp);
ashleymills 0:5a29fd060ac8 1134
ashleymills 0:5a29fd060ac8 1135 do
ashleymills 0:5a29fd060ac8 1136 {
ashleymills 0:5a29fd060ac8 1137 if (test & shift)
ashleymills 0:5a29fd060ac8 1138 {
ashleymills 0:5a29fd060ac8 1139 return i+(biexp->size-1)*COMP_BIT_SIZE;
ashleymills 0:5a29fd060ac8 1140 }
ashleymills 0:5a29fd060ac8 1141
ashleymills 0:5a29fd060ac8 1142 shift >>= 1;
ashleymills 0:5a29fd060ac8 1143 } while (i-- != 0);
ashleymills 0:5a29fd060ac8 1144
ashleymills 0:5a29fd060ac8 1145 return -1; /* error - must have been a leading 0 */
ashleymills 0:5a29fd060ac8 1146 }
ashleymills 0:5a29fd060ac8 1147
ashleymills 0:5a29fd060ac8 1148 /*
ashleymills 0:5a29fd060ac8 1149 * Is a particular bit is an exponent 1 or 0? Used when doing sliding-window
ashleymills 0:5a29fd060ac8 1150 * exponentiation.
ashleymills 0:5a29fd060ac8 1151 */
ashleymills 0:5a29fd060ac8 1152 static int exp_bit_is_one(bigint *biexp, int offset)
ashleymills 0:5a29fd060ac8 1153 {
ashleymills 0:5a29fd060ac8 1154 comp test = biexp->comps[offset / COMP_BIT_SIZE];
ashleymills 0:5a29fd060ac8 1155 int num_shifts = offset % COMP_BIT_SIZE;
ashleymills 0:5a29fd060ac8 1156 comp shift = 1;
ashleymills 0:5a29fd060ac8 1157 int i;
ashleymills 0:5a29fd060ac8 1158
ashleymills 0:5a29fd060ac8 1159 check(biexp);
ashleymills 0:5a29fd060ac8 1160
ashleymills 0:5a29fd060ac8 1161 for (i = 0; i < num_shifts; i++)
ashleymills 0:5a29fd060ac8 1162 {
ashleymills 0:5a29fd060ac8 1163 shift <<= 1;
ashleymills 0:5a29fd060ac8 1164 }
ashleymills 0:5a29fd060ac8 1165
ashleymills 0:5a29fd060ac8 1166 return (test & shift) != 0;
ashleymills 0:5a29fd060ac8 1167 }
ashleymills 0:5a29fd060ac8 1168
ashleymills 0:5a29fd060ac8 1169 #ifdef CONFIG_BIGINT_CHECK_ON
ashleymills 0:5a29fd060ac8 1170 /*
ashleymills 0:5a29fd060ac8 1171 * Perform a sanity check on bi.
ashleymills 0:5a29fd060ac8 1172 */
ashleymills 0:5a29fd060ac8 1173 static void check(const bigint *bi)
ashleymills 0:5a29fd060ac8 1174 {
ashleymills 0:5a29fd060ac8 1175 if (bi->refs <= 0)
ashleymills 0:5a29fd060ac8 1176 {
ashleymills 0:5a29fd060ac8 1177 printf("check: zero or negative refs in bigint\n");
ashleymills 0:5a29fd060ac8 1178 abort();
ashleymills 0:5a29fd060ac8 1179 }
ashleymills 0:5a29fd060ac8 1180
ashleymills 0:5a29fd060ac8 1181 if (bi->next != NULL)
ashleymills 0:5a29fd060ac8 1182 {
ashleymills 0:5a29fd060ac8 1183 printf("check: attempt to use a bigint from "
ashleymills 0:5a29fd060ac8 1184 "the free list\n");
ashleymills 0:5a29fd060ac8 1185 abort();
ashleymills 0:5a29fd060ac8 1186 }
ashleymills 0:5a29fd060ac8 1187 }
ashleymills 0:5a29fd060ac8 1188 #endif
ashleymills 0:5a29fd060ac8 1189
ashleymills 0:5a29fd060ac8 1190 /*
ashleymills 0:5a29fd060ac8 1191 * Delete any leading 0's (and allow for 0).
ashleymills 0:5a29fd060ac8 1192 */
ashleymills 0:5a29fd060ac8 1193 static bigint *trim(bigint *bi)
ashleymills 0:5a29fd060ac8 1194 {
ashleymills 0:5a29fd060ac8 1195 check(bi);
ashleymills 0:5a29fd060ac8 1196
ashleymills 0:5a29fd060ac8 1197 while (bi->comps[bi->size-1] == 0 && bi->size > 1)
ashleymills 0:5a29fd060ac8 1198 {
ashleymills 0:5a29fd060ac8 1199 bi->size--;
ashleymills 0:5a29fd060ac8 1200 }
ashleymills 0:5a29fd060ac8 1201
ashleymills 0:5a29fd060ac8 1202 return bi;
ashleymills 0:5a29fd060ac8 1203 }
ashleymills 0:5a29fd060ac8 1204
ashleymills 0:5a29fd060ac8 1205 #if defined(CONFIG_BIGINT_MONTGOMERY)
ashleymills 0:5a29fd060ac8 1206 /**
ashleymills 0:5a29fd060ac8 1207 * @brief Perform a single montgomery reduction.
ashleymills 0:5a29fd060ac8 1208 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 1209 * @param bixy [in] A bigint.
ashleymills 0:5a29fd060ac8 1210 * @return The result of the montgomery reduction.
ashleymills 0:5a29fd060ac8 1211 */
ashleymills 0:5a29fd060ac8 1212 bigint *bi_mont(BI_CTX *ctx, bigint *bixy)
ashleymills 0:5a29fd060ac8 1213 {
ashleymills 0:5a29fd060ac8 1214 int i = 0, n;
ashleymills 0:5a29fd060ac8 1215 uint8_t mod_offset = ctx->mod_offset;
ashleymills 0:5a29fd060ac8 1216 bigint *bim = ctx->bi_mod[mod_offset];
ashleymills 0:5a29fd060ac8 1217 comp mod_inv = ctx->N0_dash[mod_offset];
ashleymills 0:5a29fd060ac8 1218
ashleymills 0:5a29fd060ac8 1219 check(bixy);
ashleymills 0:5a29fd060ac8 1220
ashleymills 0:5a29fd060ac8 1221 if (ctx->use_classical) /* just use classical instead */
ashleymills 0:5a29fd060ac8 1222 {
ashleymills 0:5a29fd060ac8 1223 return bi_mod(ctx, bixy);
ashleymills 0:5a29fd060ac8 1224 }
ashleymills 0:5a29fd060ac8 1225
ashleymills 0:5a29fd060ac8 1226 n = bim->size;
ashleymills 0:5a29fd060ac8 1227
ashleymills 0:5a29fd060ac8 1228 do
ashleymills 0:5a29fd060ac8 1229 {
ashleymills 0:5a29fd060ac8 1230 bixy = bi_add(ctx, bixy, comp_left_shift(
ashleymills 0:5a29fd060ac8 1231 bi_int_multiply(ctx, bim, bixy->comps[i]*mod_inv), i));
ashleymills 0:5a29fd060ac8 1232 } while (++i < n);
ashleymills 0:5a29fd060ac8 1233
ashleymills 0:5a29fd060ac8 1234 comp_right_shift(bixy, n);
ashleymills 0:5a29fd060ac8 1235
ashleymills 0:5a29fd060ac8 1236 if (bi_compare(bixy, bim) >= 0)
ashleymills 0:5a29fd060ac8 1237 {
ashleymills 0:5a29fd060ac8 1238 bixy = bi_subtract(ctx, bixy, bim, NULL);
ashleymills 0:5a29fd060ac8 1239 }
ashleymills 0:5a29fd060ac8 1240
ashleymills 0:5a29fd060ac8 1241 return bixy;
ashleymills 0:5a29fd060ac8 1242 }
ashleymills 0:5a29fd060ac8 1243
ashleymills 0:5a29fd060ac8 1244 #elif defined(CONFIG_BIGINT_BARRETT)
ashleymills 0:5a29fd060ac8 1245 /*
ashleymills 0:5a29fd060ac8 1246 * Stomp on the most significant components to give the illusion of a "mod base
ashleymills 0:5a29fd060ac8 1247 * radix" operation
ashleymills 0:5a29fd060ac8 1248 */
ashleymills 0:5a29fd060ac8 1249 static bigint *comp_mod(bigint *bi, int mod)
ashleymills 0:5a29fd060ac8 1250 {
ashleymills 0:5a29fd060ac8 1251 check(bi);
ashleymills 0:5a29fd060ac8 1252
ashleymills 0:5a29fd060ac8 1253 if (bi->size > mod)
ashleymills 0:5a29fd060ac8 1254 {
ashleymills 0:5a29fd060ac8 1255 bi->size = mod;
ashleymills 0:5a29fd060ac8 1256 }
ashleymills 0:5a29fd060ac8 1257
ashleymills 0:5a29fd060ac8 1258 return bi;
ashleymills 0:5a29fd060ac8 1259 }
ashleymills 0:5a29fd060ac8 1260
ashleymills 0:5a29fd060ac8 1261 /**
ashleymills 0:5a29fd060ac8 1262 * @brief Perform a single Barrett reduction.
ashleymills 0:5a29fd060ac8 1263 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 1264 * @param bi [in] A bigint.
ashleymills 0:5a29fd060ac8 1265 * @return The result of the Barrett reduction.
ashleymills 0:5a29fd060ac8 1266 */
ashleymills 0:5a29fd060ac8 1267 bigint *bi_barrett(BI_CTX *ctx, bigint *bi)
ashleymills 0:5a29fd060ac8 1268 {
ashleymills 0:5a29fd060ac8 1269 bigint *q1, *q2, *q3, *r1, *r2, *r;
ashleymills 0:5a29fd060ac8 1270 uint8_t mod_offset = ctx->mod_offset;
ashleymills 0:5a29fd060ac8 1271 bigint *bim = ctx->bi_mod[mod_offset];
ashleymills 0:5a29fd060ac8 1272 int k = bim->size;
ashleymills 0:5a29fd060ac8 1273
ashleymills 0:5a29fd060ac8 1274 check(bi);
ashleymills 0:5a29fd060ac8 1275 check(bim);
ashleymills 0:5a29fd060ac8 1276
ashleymills 0:5a29fd060ac8 1277 /* use Classical method instead - Barrett cannot help here */
ashleymills 0:5a29fd060ac8 1278 if (bi->size > k*2)
ashleymills 0:5a29fd060ac8 1279 {
ashleymills 0:5a29fd060ac8 1280 return bi_mod(ctx, bi);
ashleymills 0:5a29fd060ac8 1281 }
ashleymills 0:5a29fd060ac8 1282
ashleymills 0:5a29fd060ac8 1283 q1 = comp_right_shift(bi_clone(ctx, bi), k-1);
ashleymills 0:5a29fd060ac8 1284
ashleymills 0:5a29fd060ac8 1285 /* do outer partial multiply */
ashleymills 0:5a29fd060ac8 1286 q2 = regular_multiply(ctx, q1, ctx->bi_mu[mod_offset], 0, k-1);
ashleymills 0:5a29fd060ac8 1287 q3 = comp_right_shift(q2, k+1);
ashleymills 0:5a29fd060ac8 1288 r1 = comp_mod(bi, k+1);
ashleymills 0:5a29fd060ac8 1289
ashleymills 0:5a29fd060ac8 1290 /* do inner partial multiply */
ashleymills 0:5a29fd060ac8 1291 r2 = comp_mod(regular_multiply(ctx, q3, bim, k+1, 0), k+1);
ashleymills 0:5a29fd060ac8 1292 r = bi_subtract(ctx, r1, r2, NULL);
ashleymills 0:5a29fd060ac8 1293
ashleymills 0:5a29fd060ac8 1294 /* if (r >= m) r = r - m; */
ashleymills 0:5a29fd060ac8 1295 if (bi_compare(r, bim) >= 0)
ashleymills 0:5a29fd060ac8 1296 {
ashleymills 0:5a29fd060ac8 1297 r = bi_subtract(ctx, r, bim, NULL);
ashleymills 0:5a29fd060ac8 1298 }
ashleymills 0:5a29fd060ac8 1299
ashleymills 0:5a29fd060ac8 1300 return r;
ashleymills 0:5a29fd060ac8 1301 }
ashleymills 0:5a29fd060ac8 1302 #endif /* CONFIG_BIGINT_BARRETT */
ashleymills 0:5a29fd060ac8 1303
ashleymills 0:5a29fd060ac8 1304 #ifdef CONFIG_BIGINT_SLIDING_WINDOW
ashleymills 0:5a29fd060ac8 1305 /*
ashleymills 0:5a29fd060ac8 1306 * Work out g1, g3, g5, g7... etc for the sliding-window algorithm
ashleymills 0:5a29fd060ac8 1307 */
ashleymills 0:5a29fd060ac8 1308 static void precompute_slide_window(BI_CTX *ctx, int window, bigint *g1)
ashleymills 0:5a29fd060ac8 1309 {
ashleymills 0:5a29fd060ac8 1310 int k = 1, i;
ashleymills 0:5a29fd060ac8 1311 bigint *g2;
ashleymills 0:5a29fd060ac8 1312
ashleymills 0:5a29fd060ac8 1313 for (i = 0; i < window-1; i++) /* compute 2^(window-1) */
ashleymills 0:5a29fd060ac8 1314 {
ashleymills 0:5a29fd060ac8 1315 k <<= 1;
ashleymills 0:5a29fd060ac8 1316 }
ashleymills 0:5a29fd060ac8 1317
ashleymills 0:5a29fd060ac8 1318 ctx->g = (bigint **)malloc(k*sizeof(bigint *));
ashleymills 0:5a29fd060ac8 1319 ctx->g[0] = bi_clone(ctx, g1);
ashleymills 0:5a29fd060ac8 1320 bi_permanent(ctx->g[0]);
ashleymills 0:5a29fd060ac8 1321 g2 = bi_residue(ctx, bi_square(ctx, ctx->g[0])); /* g^2 */
ashleymills 0:5a29fd060ac8 1322
ashleymills 0:5a29fd060ac8 1323 for (i = 1; i < k; i++)
ashleymills 0:5a29fd060ac8 1324 {
ashleymills 0:5a29fd060ac8 1325 ctx->g[i] = bi_residue(ctx, bi_multiply(ctx, ctx->g[i-1], bi_copy(g2)));
ashleymills 0:5a29fd060ac8 1326 bi_permanent(ctx->g[i]);
ashleymills 0:5a29fd060ac8 1327 }
ashleymills 0:5a29fd060ac8 1328
ashleymills 0:5a29fd060ac8 1329 bi_free(ctx, g2);
ashleymills 0:5a29fd060ac8 1330 ctx->window = k;
ashleymills 0:5a29fd060ac8 1331 }
ashleymills 0:5a29fd060ac8 1332 #endif
ashleymills 0:5a29fd060ac8 1333
ashleymills 0:5a29fd060ac8 1334 /**
ashleymills 0:5a29fd060ac8 1335 * @brief Perform a modular exponentiation.
ashleymills 0:5a29fd060ac8 1336 *
ashleymills 0:5a29fd060ac8 1337 * This function requires bi_set_mod() to have been called previously. This is
ashleymills 0:5a29fd060ac8 1338 * one of the optimisations used for performance.
ashleymills 0:5a29fd060ac8 1339 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 1340 * @param bi [in] The bigint on which to perform the mod power operation.
ashleymills 0:5a29fd060ac8 1341 * @param biexp [in] The bigint exponent.
ashleymills 0:5a29fd060ac8 1342 * @return The result of the mod exponentiation operation
ashleymills 0:5a29fd060ac8 1343 * @see bi_set_mod().
ashleymills 0:5a29fd060ac8 1344 */
ashleymills 0:5a29fd060ac8 1345 bigint *bi_mod_power(BI_CTX *ctx, bigint *bi, bigint *biexp)
ashleymills 0:5a29fd060ac8 1346 {
ashleymills 0:5a29fd060ac8 1347 int i = find_max_exp_index(biexp), j, window_size = 1;
ashleymills 0:5a29fd060ac8 1348 bigint *biR = int_to_bi(ctx, 1);
ashleymills 0:5a29fd060ac8 1349
ashleymills 0:5a29fd060ac8 1350 #if defined(CONFIG_BIGINT_MONTGOMERY)
ashleymills 0:5a29fd060ac8 1351 uint8_t mod_offset = ctx->mod_offset;
ashleymills 0:5a29fd060ac8 1352 if (!ctx->use_classical)
ashleymills 0:5a29fd060ac8 1353 {
ashleymills 0:5a29fd060ac8 1354 /* preconvert */
ashleymills 0:5a29fd060ac8 1355 bi = bi_mont(ctx,
ashleymills 0:5a29fd060ac8 1356 bi_multiply(ctx, bi, ctx->bi_RR_mod_m[mod_offset])); /* x' */
ashleymills 0:5a29fd060ac8 1357 bi_free(ctx, biR);
ashleymills 0:5a29fd060ac8 1358 biR = ctx->bi_R_mod_m[mod_offset]; /* A */
ashleymills 0:5a29fd060ac8 1359 }
ashleymills 0:5a29fd060ac8 1360 #endif
ashleymills 0:5a29fd060ac8 1361
ashleymills 0:5a29fd060ac8 1362 check(bi);
ashleymills 0:5a29fd060ac8 1363 check(biexp);
ashleymills 0:5a29fd060ac8 1364
ashleymills 0:5a29fd060ac8 1365 #ifdef CONFIG_BIGINT_SLIDING_WINDOW
ashleymills 0:5a29fd060ac8 1366 for (j = i; j > 32; j /= 5) /* work out an optimum size */
ashleymills 0:5a29fd060ac8 1367 window_size++;
ashleymills 0:5a29fd060ac8 1368
ashleymills 0:5a29fd060ac8 1369 /* work out the slide constants */
ashleymills 0:5a29fd060ac8 1370 precompute_slide_window(ctx, window_size, bi);
ashleymills 0:5a29fd060ac8 1371 #else /* just one constant */
ashleymills 0:5a29fd060ac8 1372 ctx->g = (bigint **)malloc(sizeof(bigint *));
ashleymills 0:5a29fd060ac8 1373 ctx->g[0] = bi_clone(ctx, bi);
ashleymills 0:5a29fd060ac8 1374 ctx->window = 1;
ashleymills 0:5a29fd060ac8 1375 bi_permanent(ctx->g[0]);
ashleymills 0:5a29fd060ac8 1376 #endif
ashleymills 0:5a29fd060ac8 1377
ashleymills 0:5a29fd060ac8 1378 /* if sliding-window is off, then only one bit will be done at a time and
ashleymills 0:5a29fd060ac8 1379 * will reduce to standard left-to-right exponentiation */
ashleymills 0:5a29fd060ac8 1380 do
ashleymills 0:5a29fd060ac8 1381 {
ashleymills 0:5a29fd060ac8 1382 if (exp_bit_is_one(biexp, i))
ashleymills 0:5a29fd060ac8 1383 {
ashleymills 0:5a29fd060ac8 1384 int l = i-window_size+1;
ashleymills 0:5a29fd060ac8 1385 int part_exp = 0;
ashleymills 0:5a29fd060ac8 1386
ashleymills 0:5a29fd060ac8 1387 if (l < 0) /* LSB of exponent will always be 1 */
ashleymills 0:5a29fd060ac8 1388 l = 0;
ashleymills 0:5a29fd060ac8 1389 else
ashleymills 0:5a29fd060ac8 1390 {
ashleymills 0:5a29fd060ac8 1391 while (exp_bit_is_one(biexp, l) == 0)
ashleymills 0:5a29fd060ac8 1392 l++; /* go back up */
ashleymills 0:5a29fd060ac8 1393 }
ashleymills 0:5a29fd060ac8 1394
ashleymills 0:5a29fd060ac8 1395 /* build up the section of the exponent */
ashleymills 0:5a29fd060ac8 1396 for (j = i; j >= l; j--)
ashleymills 0:5a29fd060ac8 1397 {
ashleymills 0:5a29fd060ac8 1398 biR = bi_residue(ctx, bi_square(ctx, biR));
ashleymills 0:5a29fd060ac8 1399 if (exp_bit_is_one(biexp, j))
ashleymills 0:5a29fd060ac8 1400 part_exp++;
ashleymills 0:5a29fd060ac8 1401
ashleymills 0:5a29fd060ac8 1402 if (j != l)
ashleymills 0:5a29fd060ac8 1403 part_exp <<= 1;
ashleymills 0:5a29fd060ac8 1404 }
ashleymills 0:5a29fd060ac8 1405
ashleymills 0:5a29fd060ac8 1406 part_exp = (part_exp-1)/2; /* adjust for array */
ashleymills 0:5a29fd060ac8 1407 biR = bi_residue(ctx, bi_multiply(ctx, biR, ctx->g[part_exp]));
ashleymills 0:5a29fd060ac8 1408 i = l-1;
ashleymills 0:5a29fd060ac8 1409 }
ashleymills 0:5a29fd060ac8 1410 else /* square it */
ashleymills 0:5a29fd060ac8 1411 {
ashleymills 0:5a29fd060ac8 1412 biR = bi_residue(ctx, bi_square(ctx, biR));
ashleymills 0:5a29fd060ac8 1413 i--;
ashleymills 0:5a29fd060ac8 1414 }
ashleymills 0:5a29fd060ac8 1415 } while (i >= 0);
ashleymills 0:5a29fd060ac8 1416
ashleymills 0:5a29fd060ac8 1417 /* cleanup */
ashleymills 0:5a29fd060ac8 1418 for (i = 0; i < ctx->window; i++)
ashleymills 0:5a29fd060ac8 1419 {
ashleymills 0:5a29fd060ac8 1420 bi_depermanent(ctx->g[i]);
ashleymills 0:5a29fd060ac8 1421 bi_free(ctx, ctx->g[i]);
ashleymills 0:5a29fd060ac8 1422 }
ashleymills 0:5a29fd060ac8 1423
ashleymills 0:5a29fd060ac8 1424 free(ctx->g);
ashleymills 0:5a29fd060ac8 1425 bi_free(ctx, bi);
ashleymills 0:5a29fd060ac8 1426 bi_free(ctx, biexp);
ashleymills 0:5a29fd060ac8 1427 #if defined CONFIG_BIGINT_MONTGOMERY
ashleymills 0:5a29fd060ac8 1428 return ctx->use_classical ? biR : bi_mont(ctx, biR); /* convert back */
ashleymills 0:5a29fd060ac8 1429 #else /* CONFIG_BIGINT_CLASSICAL or CONFIG_BIGINT_BARRETT */
ashleymills 0:5a29fd060ac8 1430 return biR;
ashleymills 0:5a29fd060ac8 1431 #endif
ashleymills 0:5a29fd060ac8 1432 }
ashleymills 0:5a29fd060ac8 1433
ashleymills 0:5a29fd060ac8 1434 #ifdef CONFIG_SSL_CERT_VERIFICATION
ashleymills 0:5a29fd060ac8 1435 /**
ashleymills 0:5a29fd060ac8 1436 * @brief Perform a modular exponentiation using a temporary modulus.
ashleymills 0:5a29fd060ac8 1437 *
ashleymills 0:5a29fd060ac8 1438 * We need this function to check the signatures of certificates. The modulus
ashleymills 0:5a29fd060ac8 1439 * of this function is temporary as it's just used for authentication.
ashleymills 0:5a29fd060ac8 1440 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 1441 * @param bi [in] The bigint to perform the exp/mod.
ashleymills 0:5a29fd060ac8 1442 * @param bim [in] The temporary modulus.
ashleymills 0:5a29fd060ac8 1443 * @param biexp [in] The bigint exponent.
ashleymills 0:5a29fd060ac8 1444 * @return The result of the mod exponentiation operation
ashleymills 0:5a29fd060ac8 1445 * @see bi_set_mod().
ashleymills 0:5a29fd060ac8 1446 */
ashleymills 0:5a29fd060ac8 1447 bigint *bi_mod_power2(BI_CTX *ctx, bigint *bi, bigint *bim, bigint *biexp)
ashleymills 0:5a29fd060ac8 1448 {
ashleymills 0:5a29fd060ac8 1449 bigint *biR, *tmp_biR;
ashleymills 0:5a29fd060ac8 1450
ashleymills 0:5a29fd060ac8 1451 /* Set up a temporary bigint context and transfer what we need between
ashleymills 0:5a29fd060ac8 1452 * them. We need to do this since we want to keep the original modulus
ashleymills 0:5a29fd060ac8 1453 * which is already in this context. This operation is only called when
ashleymills 0:5a29fd060ac8 1454 * doing peer verification, and so is not expensive :-) */
ashleymills 0:5a29fd060ac8 1455 BI_CTX *tmp_ctx = bi_initialize();
ashleymills 0:5a29fd060ac8 1456 bi_set_mod(tmp_ctx, bi_clone(tmp_ctx, bim), BIGINT_M_OFFSET);
ashleymills 0:5a29fd060ac8 1457 tmp_biR = bi_mod_power(tmp_ctx,
ashleymills 0:5a29fd060ac8 1458 bi_clone(tmp_ctx, bi),
ashleymills 0:5a29fd060ac8 1459 bi_clone(tmp_ctx, biexp));
ashleymills 0:5a29fd060ac8 1460 biR = bi_clone(ctx, tmp_biR);
ashleymills 0:5a29fd060ac8 1461 bi_free(tmp_ctx, tmp_biR);
ashleymills 0:5a29fd060ac8 1462 bi_free_mod(tmp_ctx, BIGINT_M_OFFSET);
ashleymills 0:5a29fd060ac8 1463 bi_terminate(tmp_ctx);
ashleymills 0:5a29fd060ac8 1464
ashleymills 0:5a29fd060ac8 1465 bi_free(ctx, bi);
ashleymills 0:5a29fd060ac8 1466 bi_free(ctx, bim);
ashleymills 0:5a29fd060ac8 1467 bi_free(ctx, biexp);
ashleymills 0:5a29fd060ac8 1468 return biR;
ashleymills 0:5a29fd060ac8 1469 }
ashleymills 0:5a29fd060ac8 1470 #endif
ashleymills 0:5a29fd060ac8 1471
ashleymills 0:5a29fd060ac8 1472 #ifdef CONFIG_BIGINT_CRT
ashleymills 0:5a29fd060ac8 1473 /**
ashleymills 0:5a29fd060ac8 1474 * @brief Use the Chinese Remainder Theorem to quickly perform RSA decrypts.
ashleymills 0:5a29fd060ac8 1475 *
ashleymills 0:5a29fd060ac8 1476 * @param ctx [in] The bigint session context.
ashleymills 0:5a29fd060ac8 1477 * @param bi [in] The bigint to perform the exp/mod.
ashleymills 0:5a29fd060ac8 1478 * @param dP [in] CRT's dP bigint
ashleymills 0:5a29fd060ac8 1479 * @param dQ [in] CRT's dQ bigint
ashleymills 0:5a29fd060ac8 1480 * @param p [in] CRT's p bigint
ashleymills 0:5a29fd060ac8 1481 * @param q [in] CRT's q bigint
ashleymills 0:5a29fd060ac8 1482 * @param qInv [in] CRT's qInv bigint
ashleymills 0:5a29fd060ac8 1483 * @return The result of the CRT operation
ashleymills 0:5a29fd060ac8 1484 */
ashleymills 0:5a29fd060ac8 1485 bigint *bi_crt(BI_CTX *ctx, bigint *bi,
ashleymills 0:5a29fd060ac8 1486 bigint *dP, bigint *dQ,
ashleymills 0:5a29fd060ac8 1487 bigint *p, bigint *q, bigint *qInv)
ashleymills 0:5a29fd060ac8 1488 {
ashleymills 0:5a29fd060ac8 1489 bigint *m1, *m2, *h;
ashleymills 0:5a29fd060ac8 1490
ashleymills 0:5a29fd060ac8 1491 /* Montgomery has a condition the 0 < x, y < m and these products violate
ashleymills 0:5a29fd060ac8 1492 * that condition. So disable Montgomery when using CRT */
ashleymills 0:5a29fd060ac8 1493 #if defined(CONFIG_BIGINT_MONTGOMERY)
ashleymills 0:5a29fd060ac8 1494 ctx->use_classical = 1;
ashleymills 0:5a29fd060ac8 1495 #endif
ashleymills 0:5a29fd060ac8 1496 ctx->mod_offset = BIGINT_P_OFFSET;
ashleymills 0:5a29fd060ac8 1497 m1 = bi_mod_power(ctx, bi_copy(bi), dP);
ashleymills 0:5a29fd060ac8 1498
ashleymills 0:5a29fd060ac8 1499 ctx->mod_offset = BIGINT_Q_OFFSET;
ashleymills 0:5a29fd060ac8 1500 m2 = bi_mod_power(ctx, bi, dQ);
ashleymills 0:5a29fd060ac8 1501
ashleymills 0:5a29fd060ac8 1502 h = bi_subtract(ctx, bi_add(ctx, m1, p), bi_copy(m2), NULL);
ashleymills 0:5a29fd060ac8 1503 h = bi_multiply(ctx, h, qInv);
ashleymills 0:5a29fd060ac8 1504 ctx->mod_offset = BIGINT_P_OFFSET;
ashleymills 0:5a29fd060ac8 1505 h = bi_residue(ctx, h);
ashleymills 0:5a29fd060ac8 1506 #if defined(CONFIG_BIGINT_MONTGOMERY)
ashleymills 0:5a29fd060ac8 1507 ctx->use_classical = 0; /* reset for any further operation */
ashleymills 0:5a29fd060ac8 1508 #endif
ashleymills 0:5a29fd060ac8 1509 return bi_add(ctx, m2, bi_multiply(ctx, q, h));
ashleymills 0:5a29fd060ac8 1510 }
ashleymills 0:5a29fd060ac8 1511 #endif
ashleymills 0:5a29fd060ac8 1512 /** @} */