Commit e0fa6324 authored by Matt Caswell's avatar Matt Caswell
Browse files

Add some new constant time functions needed by curve448 



Reviewed-by: default avatarBernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/5105)
parent 7114a5a1

include/internal/constant_time_locl.h

+93 −0
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
# define HEADER_CONSTANT_TIME_LOCL_H



# include <stdlib.h>

# include <string.h>

# include <openssl/e_os2.h>              /* For 'ossl_inline' */



#ifdef __cplusplus
@@ -33,6 +34,8 @@ extern "C" { 


/* Returns the given value with the MSB copied to all the other bits. */

static ossl_inline unsigned int constant_time_msb(unsigned int a);

/* Convenience method for uint32_t. */

static ossl_inline uint32_t constant_time_msb_32(uint32_t a);

/* Convenience method for uint64_t. */

static ossl_inline uint64_t constant_time_msb_64(uint64_t a);
@@ -56,6 +59,8 @@ static ossl_inline unsigned char constant_time_ge_8(unsigned int a, 
static ossl_inline unsigned int constant_time_is_zero(unsigned int a);

/* Convenience method for getting an 8-bit mask. */

static ossl_inline unsigned char constant_time_is_zero_8(unsigned int a);

/* Convenience method for getting a 32-bit mask. */

static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a);



/* Returns 0xff..f if a == b and 0 otherwise. */

static ossl_inline unsigned int constant_time_eq(unsigned int a,
@@ -82,6 +87,11 @@ static ossl_inline unsigned int constant_time_select(unsigned int mask, 
static ossl_inline unsigned char constant_time_select_8(unsigned char mask,

                                                        unsigned char a,

                                                        unsigned char b);



/* Convenience method for uint32_t. */

static ossl_inline uint32_t constant_time_select_32(uint32_t mask, uint32_t a,

                                                    uint32_t b);



/* Convenience method for uint64_t. */

static ossl_inline uint64_t constant_time_select_64(uint64_t mask, uint64_t a,

                                                    uint64_t b);
@@ -95,6 +105,12 @@ static ossl_inline unsigned int constant_time_msb(unsigned int a) 
    return 0 - (a >> (sizeof(a) * 8 - 1));

}





static ossl_inline uint32_t constant_time_msb_32(uint32_t a)

{

    return 0 - (a >> 31);

}



static ossl_inline uint64_t constant_time_msb_64(uint64_t a)

{

    return 0 - (a >> 63);
@@ -164,6 +180,11 @@ static ossl_inline unsigned char constant_time_is_zero_8(unsigned int a) 
    return (unsigned char)constant_time_is_zero(a);

}



static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a)

{

    return constant_time_msb_32(~a & (a - 1));

}



static ossl_inline unsigned int constant_time_eq(unsigned int a,

                                                 unsigned int b)

{
@@ -229,12 +250,84 @@ static ossl_inline int constant_time_select_int_s(size_t mask, int a, int b) 
                                      (unsigned)(b));

}



static ossl_inline uint32_t constant_time_select_32(uint32_t mask, uint32_t a,

                                                    uint32_t b)

{

    return (mask & a) | (~mask & b);

}



static ossl_inline uint64_t constant_time_select_64(uint64_t mask, uint64_t a,

                                                    uint64_t b)

{

    return (mask & a) | (~mask & b);

}



/*

 * mask must be 0xFFFFFFFF or 0x00000000.

 *

 * if (mask) {

 *     uint32_t tmp = *a;

 *

 *     *a = *b;

 *     *b = tmp;

 * }

 */

static ossl_inline void constant_time_cond_swap_32(uint32_t mask, uint32_t *a,

                                                   uint32_t *b)

{

    uint32_t xor = *a ^ *b;



    xor &= mask;

    *a ^= xor;

    *b ^= xor;

}



/*

 * mask must be 0xFFFFFFFF or 0x00000000.

 *

 * if (mask) {

 *     uint64_t tmp = *a;

 *

 *     *a = *b;

 *     *b = tmp;

 * }

 */

static ossl_inline void constant_time_cond_swap_64(uint64_t mask, uint64_t *a,

                                                   uint64_t *b)

{

    uint64_t xor = *a ^ *b;



    xor &= mask;

    *a ^= xor;

    *b ^= xor;

}



/*

 * table is a two dimensional array of bytes. Each row has rowsize elements.

 * Copies row number idx into out. rowsize and numrows are not considered

 * private.

 */

static ossl_inline void constant_time_lookup(void *out,

                                             const void *table,

                                             size_t rowsize,

                                             size_t numrows,

                                             size_t idx)

{

    size_t i, j;

    const unsigned char *tablec = (const unsigned char *)table;

    unsigned char *outc = (unsigned char *)out;

    unsigned char mask;



    memset(out, 0, rowsize);



    /* Note idx may underflow - but that is well defined */

    for (i = 0; i < numrows; i++, idx--) {

        mask = (unsigned char)constant_time_is_zero_s(idx);

        for (j = 0; j < rowsize; j++)

            *(outc + j) |= constant_time_select_8(mask, *(tablec++), 0);

    }

}



#ifdef __cplusplus

}

#endif