41 Commits

Author SHA1 Message Date
Brian Smith
2270dc6943 Rename crypto_word back to crypto_word_t.
Originally I was trying to be pedantic and avoid any use of `_t`-
suffixed names. However, this hasn't really accomplished anything
except annoying me, so just do what BoringSSL does.
2023-09-28 18:11:05 -07:00
Brian Smith
7886603cee Use some variant of "ring core" instead of "GFp" as a prefix for everything.
"GFp_" isn't in the code at all anymore.
2021-05-02 22:09:07 -07:00
Brian Smith
384f7d056b Replace manual FFI symbol prefixing with automatic symbol prefixing.
Revert the names used in the BoringSSL C/asm code to the names used in
BoringSSL. This substantially reduces the diff between *ring* and
BoringSSL for these files.

Use a variant of BoringSSL's symbol prefixing machinery to semi-
automatically prefix FFI symbols with the `GFp_` prefix. The names aren't
all exactly the same as before, because previously we *replaced* a
symbol's original prefix with the `GFp_` prefix; now we're prepending
`GFp_`. In the future we'll use a different prefix entirely.

This paves the way for using different prefixes for each version so that
multiple versions of *ring* can be linked into an executable at once.
2021-05-02 22:09:07 -07:00
Brian Smith
d085defcab Remove unused LIMBS_copy. 2020-06-18 19:05:01 -05:00
Brian Smith
fae863956b bigint: Replace GFp_bn_mul_add_word with GFp_limbs_mul_add_limb.
Replace `GFp_bn_mul_add_word` with a clearer, simpler implementation.
The new `GFp_limbs_mul_add_limb` avoid explicit branches at the C code
level, unlike the code it replaces. (Obviously, even with the new
"branchless" code the compiler might be able to synthesize branches.)
2020-05-29 21:07:20 -05:00
Brian Smith
0e7fdf5e91 Split ASSERT into dev_assert_secret and debug_assert_nonsecret. 2020-05-29 13:23:29 -05:00
Brian Smith
ed47ae8c67 Support clang-cl better. 2019-07-22 12:08:35 -10:00
Brian Smith
4399add9cf Don't require the C toolchain to provide assert.h for non-debug builds. 2019-07-15 21:33:55 -10:00
Brian Smith
0bab61cd23 Remove #include <string.h> in P-256 and P-384 code. 2019-06-14 13:48:57 -10:00
Brian Smith
0728827d2e Don't enable -Wmissing-prototypes and -Wmissing-declarations.
These really don't make much sense any more given most calls are from
Rust to C.
2019-02-13 08:28:30 -10:00
Brian Smith
dbdc510653 Simplify endian conversion in C code.
The relevant Clang bugs have been fixed and the code that uses these
functions is basically unused on Windows so MSVC's optimizer is
irrelevant to it.
2019-02-06 14:39:49 -10:00
Brian Smith
cda9d33d31 Use Rust for RSA exponentiation. 2018-11-29 16:01:00 -10:00
Brian Smith
72f5efd17f Fix name of LIMB_shr.
It was named `LIMB_shl` but it's a right shift.
2018-11-25 16:38:34 -10:00
Brian Smith
09ab5b73c6 Refactor limbs_minimal_bits.
Refactor the code to make it clearer how (timing) side channels are
avoided, and to make it a total function. Move this generic logic from
`rsa` to `limbs`.
2018-11-15 22:12:21 -10:00
Brian Smith
ad0f2efe17 Use limbs_copy instead of memcpy wherever limbs_copy makes sense.
Continue eliminating strings.h dependencies.
2018-06-07 15:10:53 -10:00
Brian Smith
ae66000e30 Remove binding from RSA.
We'll bring it back if/when we implement operations on secret messages
(i.e. RSA encryption).
2018-05-20 13:13:56 -10:00
Brian Smith
afb2c27350 Remove some redundant compile-time assertions.
The equivalence assertions between `size_t` and other types is stronger
than what is needed; they were added when `size_t` was the type used
for constant-time operations instead of `crypto_word`, and weren't
removed. Note `Limb` and `BN_ULONG` are aliases for `crypto_word`.
2018-05-18 13:36:03 -10:00
Brian Smith
c19f1d3cd4 Remove redundant includes of GFp/type_check.h.
crypto/internal.h includes it so nothing else needs to.
2018-05-18 13:32:50 -10:00
Brian Smith
0027633cc9 Rename crypto_word_t to crypto_word.
Avoid using the `_t` suffix since that's undefined behavior in C.
2018-05-18 13:32:49 -10:00
Brian Smith
0cb0bafe4d Remove bn.h dependency from crypto/limbs. 2018-05-16 13:13:46 -10:00
Brian Smith
e4034dded4 Use fixed-width ring elements (and modulus) in RSA signing.
Improve the constant-timedness of RSA.
2018-05-06 11:13:59 -10:00
Brian Smith
d5b08754a4 Add limbs_are_even_constant_time(). 2018-05-06 10:45:35 -10:00
Brian Smith
b89643ba10 Add limbs_less_than_limb_constant_time(). 2018-05-06 10:27:17 -10:00
Brian Smith
94b84afba5 Remove GFp_bn_sub_words. 2018-05-05 08:24:13 -10:00
Brian Smith
acf188b422 Fix build breakage. 2018-05-05 07:37:47 -10:00
Brian Smith
e70787436f Re-implement Elem::is_one()/Nonnegative::is_one(). 2018-05-04 10:30:33 -10:00
Brian Smith
a20f2ac013 Avoid using BIGNUM inside GFp_BN_mod_exp_mont_consttime.
`GFp_BN_mod_exp_mont_consttime`'s API still uses `BIGNUM` but its
implementation no longer does. This removes the last use of
BN_FLG_STATIC_DATA, which will be removed shortly.
2018-05-03 12:28:20 -10:00
Brian Smith
a7b44dee79 Merge BoringSSL 518ba07: Switch constant-time functions to using |crypto_word_t|.
This was a simple but non-trivial merge.
2018-04-26 16:49:26 -10:00
Brian Smith
2c56be7e2c Rename size_t constant-time utilities to match BoringSSL's.
Make it easier to keep the code in sync by using the same names.
2017-12-28 19:19:46 -10:00
Brian Smith
8090623a2e Indicate that MSVC 2015 Update 2 or later is required for -msvc.
Previously the message just said that MSVC 2015 or later is
required for -msvc targets. However, Update 2 is actually required.
2017-12-23 11:37:01 -10:00
Brian Smith
aa6dcd5b55 Replace GFp_BN_usub(). 2017-04-26 17:24:40 -10:00
Brian Smith
f2e5be3c00 Replace GFp_BN_uadd(). 2017-04-26 17:17:52 -10:00
Brian Smith
8c1d54b353 Replace GFp_BN_mod_sub_quick(). 2017-04-26 17:17:52 -10:00
Brian Smith
caab9f0efe Update limbs.c copyright line. 2017-04-26 13:39:26 -10:00
Brian Smith
ff71d521ff Use "GFp/" instead of "openssl/" for #includes.
Avoid any potential conflicts with OpenSSL header files by using a
different namespace.
2017-04-19 14:56:44 -10:00
Brian Smith
7ef64a1b0e Rename GFp_DoubleLimb to DoubleLimb.
Match the new naming convetions in the limbs C submodule.
2017-03-02 15:36:41 -10:00
Brian Smith
8e8050caaa Use LIMBS_shl_mod() for P-384 multiplication by 2. 2017-02-16 12:01:15 -10:00
Brian Smith
77a1f935d9 Implement constant-time modular left shift by 1 bit. 2017-02-16 11:57:08 -10:00
Brian Smith
9d70c1daa5 Factor out constant-time modular addition and subtraction. 2017-02-09 17:04:04 -10:00
Brian Smith
6822329083 Use limb_ and limbs_ instead of gfp_ for low-level limb ops.
These operations will be used not just for finite fields over primes
but also for Z/Zn.
2017-01-01 20:09:50 -10:00
Brian Smith
7dcaddfaba Give GFp_* modular arithmetic primitives more general names.
These aren't just useful for finite fields over primes GFp. They can
be used for arithmetic in the ring Z/Zn where n isn't prime, as is
the case for RSA arithmetic modulo the public modulus `n`.

Now it is clear now that we're not going to need to disambiguate the
types in this module with other libraries' types, so remove the `GFp_`
prefixes.
2017-01-01 20:09:49 -10:00