From 6dacc9b38a0ee404abbac79bef46f08644ac90da Mon Sep 17 00:00:00 2001 From: David Garske Date: Fri, 6 Nov 2026 10:09:37 -0800 Subject: [PATCH] Run one point operation per SP ECC non-blocking step --- src/internal.c | 60 ++ wolfcrypt/src/sp_arm32.c | 1527 ++++----------------------------- wolfcrypt/src/sp_arm64.c | 1536 ++++----------------------------- wolfcrypt/src/sp_armthumb.c | 1527 ++++----------------------------- wolfcrypt/src/sp_c32.c | 1599 +++++------------------------------ wolfcrypt/src/sp_c64.c | 1599 +++++------------------------------ wolfcrypt/src/sp_cortexm.c | 1531 ++++----------------------------- wolfcrypt/src/sp_riscv64.c | 1531 ++++----------------------------- wolfcrypt/src/sp_x86_64.c | 1495 ++++---------------------------- wolfcrypt/test/test.c | 74 ++ 10 files changed, 1518 insertions(+), 10961 deletions(-) diff --git a/src/internal.c b/src/internal.c index 81f89bd4c90..e264cf8a388 100644 --- a/src/internal.c +++ b/src/internal.c @@ -10083,20 +10083,64 @@ int AllocKey(WOLFSSL* ssl, int type, void** pKey) static int ReuseKey(WOLFSSL* ssl, int type, void* pKey) { int ret = 0; +#if defined(WC_RSA_NONBLOCK) && defined(WOLFSSL_ASYNC_CRYPT_SW) && \ + defined(WC_ASYNC_ENABLE_RSA) + RsaNb* rsaNb; +#endif +#if defined(WC_ECC_NONBLOCK) && defined(WOLFSSL_ASYNC_CRYPT_SW) && \ + defined(WC_ASYNC_ENABLE_ECC) + ecc_nb_ctx_t* eccNbCtx; +#endif +#if defined(WC_X25519_NONBLOCK) && defined(WOLFSSL_ASYNC_CRYPT_SW) && \ + defined(WC_ASYNC_ENABLE_X25519) + x25519_nb_ctx_t* x25519NbCtx; +#endif (void)ssl; switch (type) { #ifndef NO_RSA case DYNAMIC_TYPE_RSA: + #if defined(WC_RSA_NONBLOCK) && defined(WOLFSSL_ASYNC_CRYPT_SW) && \ + defined(WC_ASYNC_ENABLE_RSA) + rsaNb = ((RsaKey*)pKey)->nb; + #endif wc_FreeRsaKey((RsaKey*)pKey); ret = wc_InitRsaKey_ex((RsaKey*)pKey, ssl->heap, ssl->devId); + #if defined(WC_RSA_NONBLOCK) && defined(WOLFSSL_ASYNC_CRYPT_SW) && \ + defined(WC_ASYNC_ENABLE_RSA) + if (rsaNb != NULL) { + if (ret == 0) { + ret = wc_RsaSetNonBlock((RsaKey*)pKey, rsaNb); + } + if (ret != 0) { + XFREE(rsaNb, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER); + } + } + #endif break; #endif /* ! NO_RSA */ #ifdef HAVE_ECC case DYNAMIC_TYPE_ECC: + #if defined(WC_ECC_NONBLOCK) && defined(WOLFSSL_ASYNC_CRYPT_SW) && \ + defined(WC_ASYNC_ENABLE_ECC) + /* Keep the non-blocking context AllocKey attached; init clears it + * from the key. */ + eccNbCtx = ((ecc_key*)pKey)->nb_ctx; + #endif wc_ecc_free((ecc_key*)pKey); ret = wc_ecc_init_ex((ecc_key*)pKey, ssl->heap, ssl->devId); + #if defined(WC_ECC_NONBLOCK) && defined(WOLFSSL_ASYNC_CRYPT_SW) && \ + defined(WC_ASYNC_ENABLE_ECC) + if (eccNbCtx != NULL) { + if (ret == 0) { + ret = wc_ecc_set_nonblock((ecc_key*)pKey, eccNbCtx); + } + if (ret != 0) { + XFREE(eccNbCtx, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER); + } + } + #endif break; #endif /* HAVE_ECC */ #ifdef HAVE_ED25519 @@ -10108,9 +10152,25 @@ static int ReuseKey(WOLFSSL* ssl, int type, void* pKey) #endif /* HAVE_CURVE25519 */ #ifdef HAVE_CURVE25519 case DYNAMIC_TYPE_CURVE25519: + #if defined(WC_X25519_NONBLOCK) && defined(WOLFSSL_ASYNC_CRYPT_SW) && \ + defined(WC_ASYNC_ENABLE_X25519) + x25519NbCtx = ((curve25519_key*)pKey)->nb_ctx; + #endif wc_curve25519_free((curve25519_key*)pKey); ret = wc_curve25519_init_ex((curve25519_key*)pKey, ssl->heap, ssl->devId); + #if defined(WC_X25519_NONBLOCK) && defined(WOLFSSL_ASYNC_CRYPT_SW) && \ + defined(WC_ASYNC_ENABLE_X25519) + if (x25519NbCtx != NULL) { + if (ret == 0) { + ret = wc_curve25519_set_nonblock((curve25519_key*)pKey, + x25519NbCtx); + } + if (ret != 0) { + XFREE(x25519NbCtx, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER); + } + } + #endif break; #endif /* HAVE_CURVE25519 */ #ifdef HAVE_ED448 diff --git a/wolfcrypt/src/sp_arm32.c b/wolfcrypt/src/sp_arm32.c index 7b19fdaec85..386ee683445 100644 --- a/wolfcrypt/src/sp_arm32.c +++ b/wolfcrypt/src/sp_arm32.c @@ -75458,151 +75458,6 @@ static void sp_256_proj_point_dbl_8(sp_point_256* r, const sp_point_256* p, sp_256_mont_sub_8(y, y, t2, p256_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_dbl_8_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_dbl_8_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_dbl_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_dbl_8_ctx* ctx = (sp_256_proj_point_dbl_8_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_dbl_8_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*8; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_256_mont_sqr_8(ctx->t1, p->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_256_mont_mul_8(ctx->z, p->y, p->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_256_mont_dbl_8(ctx->z, ctx->z, p256_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_256_mont_sub_8(ctx->t2, p->x, ctx->t1, p256_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_256_mont_add_8(ctx->t1, p->x, ctx->t1, p256_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_256_mont_mul_8(ctx->t2, ctx->t1, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_256_mont_tpl_8(ctx->t1, ctx->t2, p256_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_256_mont_dbl_8(ctx->y, p->y, p256_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_256_mont_sqr_8(ctx->y, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_256_mont_sqr_8(ctx->t2, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_256_mont_div2_8(ctx->t2, ctx->t2, p256_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_256_mont_mul_8(ctx->y, ctx->y, p->x, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_256_mont_sqr_8(ctx->x, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_256_mont_mul_8(ctx->y, ctx->y, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->t2, p256_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -75717,214 +75572,6 @@ static void sp_256_proj_point_add_8(sp_point_256* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_add_8_ctx { - int state; - sp_256_proj_point_dbl_8_ctx dbl_ctx; - const sp_point_256* ap[2]; - sp_point_256* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_add_8_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_add_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, const sp_point_256* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_add_8_ctx* ctx = (sp_256_proj_point_add_8_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_add_8_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_256* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*8; - ctx->t2 = t + 4*8; - ctx->t3 = t + 6*8; - ctx->t4 = t + 8*8; - ctx->t5 = t + 10*8; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_256_mont_sqr_8(ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - sp_256_mont_mul_8(ctx->t3, ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - sp_256_mont_mul_8(ctx->t1, ctx->t1, p->x, p256_mod, p256_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_256_mont_sqr_8(ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 5; - break; - case 5: - sp_256_mont_mul_8(ctx->t4, ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 6; - break; - case 6: - sp_256_mont_mul_8(ctx->t2, ctx->t2, q->x, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_256_mont_mul_8(ctx->t3, ctx->t3, p->y, p256_mod, p256_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_256_mont_mul_8(ctx->t4, ctx->t4, q->y, p256_mod, p256_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_256_cmp_equal_8(ctx->t2, ctx->t1) & - sp_256_cmp_equal_8(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_256_proj_point_dbl_8(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_256_mont_sub_8(ctx->t2, ctx->t2, ctx->t1, p256_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_256_mont_sub_8(ctx->t4, ctx->t4, ctx->t3, p256_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_256_mont_sqr_8(ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - sp_256_mont_mul_8(ctx->y, ctx->t1, ctx->t5, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - sp_256_mont_mul_8(ctx->t5, ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_256_mont_mul_8(ctx->z, p->z, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 16; - break; - case 16: - sp_256_mont_mul_8(ctx->z, ctx->z, q->z, p256_mod, p256_mp_mod); - ctx->state = 17; - break; - case 17: - sp_256_mont_sqr_8(ctx->x, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->t5, p256_mod); - ctx->state = 19; - break; - case 19: - sp_256_mont_mul_8(ctx->t5, ctx->t5, ctx->t3, p256_mod, p256_mp_mod); - ctx->state = 20; - break; - case 20: - sp_256_mont_dbl_8(ctx->t3, ctx->y, p256_mod); - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->t3, p256_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 22; - break; - case 22: - sp_256_mont_mul_8(ctx->y, ctx->y, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 23; - break; - case 23: - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->t5, p256_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 8; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 8; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 8; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -77163,10 +76810,6 @@ static int sp_256_ecc_mulmod_8(sp_point_256* r, const sp_point_256* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_8_ctx { int state; - union { - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; - }; sp_point_256 t[3]; sp_digit tmp[2 * 8 * 6]; sp_digit n; @@ -77241,27 +76884,22 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } ctx->y = (ctx->n >> 31) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_256)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_8(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_256)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_256)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); - ctx->state = 4; - ctx->c--; - } + sp_256_proj_point_dbl_8(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_256)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -77429,17 +77067,12 @@ static void sp_256_get_point_33_8(sp_point_256* r, const sp_point_256* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_256_ecc_mulmod_8_ctx { int state; - union { - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_256 t[33 + 2]; sp_digit tmp[2 * 8 * 6]; ecc_recode_256 v[43]; int i; - int j; } sp_256_ecc_mulmod_8_ctx; /* Multiply the point by the scalar and return the result. @@ -77465,6 +77098,7 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_256_ecc_mulmod_8_ctx* ctx = (sp_256_ecc_mulmod_8_ctx*)sp_ctx->data; sp_point_256* rt = &ctx->t[33]; sp_point_256* p = &ctx->t[33 + 1]; @@ -77494,29 +77128,20 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, err = sp_256_mod_mul_norm_8(ctx->t[1].z, g->z, p256_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_256_proj_point_dbl_8(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_256_proj_point_add_8(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -77533,19 +77158,13 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_256_proj_point_dbl_8(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -77561,22 +77180,16 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMSET(negy, 0, sizeof(sp_digit) * 8); sp_256_mont_sub_8(negy, negy, p->y, p256_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 8); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_8(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -79153,10 +78766,6 @@ static int sp_256_ecc_mulmod_base_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_base_8_ctx { int state; - union { - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; - }; sp_point_256 rt; sp_point_256 p; sp_digit tmp[2 * 8 * 6]; @@ -79222,15 +78831,11 @@ static int sp_256_ecc_mulmod_base_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->y; ctx->i = 30; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_256_proj_point_dbl_8(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -79250,21 +78855,16 @@ static int sp_256_ecc_mulmod_base_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMCPY(p->y, p256_table[ctx->y].y, sizeof(p->y[0]) * 8); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_256_proj_point_add_qz1_8(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -80629,7 +80229,8 @@ typedef struct sp_256_mont_inv_order_8_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -80640,6 +80241,7 @@ static int sp_256_mont_inv_order_8_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_256_mont_inv_order_8_ctx* ctx = (sp_256_mont_inv_order_8_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_256_mont_inv_order_8_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -80652,17 +80254,17 @@ static int sp_256_mont_inv_order_8_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_256_mont_sqr_order_8(t, t); - ctx->state = 2; - break; - case 2: - if ((p256_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_256_mont_mul_order_8(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_256_mont_sqr_order_8(t, t); + if ((p256_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_256_mont_mul_order_8(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 8U); err = MP_OKAY; break; @@ -82192,8 +81794,6 @@ typedef struct sp_ecc_verify_256_ctx { union { sp_256_ecc_mulmod_8_ctx mulmod_ctx; sp_256_mont_inv_order_8_ctx mont_inv_order_ctx; - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; }; sp_digit u1[2*8]; sp_digit u2[2*8]; @@ -82295,14 +81895,12 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_256_iszero_8(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_256_proj_point_add_8(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -82357,6 +81955,9 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_256_ctx)); + } return err; } @@ -94290,151 +93891,6 @@ static void sp_384_proj_point_dbl_12(sp_point_384* r, const sp_point_384* p, sp_384_mont_sub_12(y, y, t2, p384_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_dbl_12_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_dbl_12_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_dbl_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_dbl_12_ctx* ctx = (sp_384_proj_point_dbl_12_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_dbl_12_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*12; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_384_mont_sqr_12(ctx->t1, p->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_384_mont_mul_12(ctx->z, p->y, p->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_384_mont_dbl_12(ctx->z, ctx->z, p384_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_384_mont_sub_12(ctx->t2, p->x, ctx->t1, p384_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_384_mont_add_12(ctx->t1, p->x, ctx->t1, p384_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_384_mont_mul_12(ctx->t2, ctx->t1, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_384_mont_tpl_12(ctx->t1, ctx->t2, p384_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_384_mont_dbl_12(ctx->y, p->y, p384_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_384_mont_sqr_12(ctx->y, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_384_mont_sqr_12(ctx->t2, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_384_mont_div2_12(ctx->t2, ctx->t2, p384_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_384_mont_mul_12(ctx->y, ctx->y, p->x, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_384_mont_sqr_12(ctx->x, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_384_mont_mul_12(ctx->y, ctx->y, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->t2, p384_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -94551,214 +94007,6 @@ static void sp_384_proj_point_add_12(sp_point_384* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_add_12_ctx { - int state; - sp_384_proj_point_dbl_12_ctx dbl_ctx; - const sp_point_384* ap[2]; - sp_point_384* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_add_12_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_add_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, const sp_point_384* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_add_12_ctx* ctx = (sp_384_proj_point_add_12_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_add_12_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_384* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*12; - ctx->t2 = t + 4*12; - ctx->t3 = t + 6*12; - ctx->t4 = t + 8*12; - ctx->t5 = t + 10*12; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_384_mont_sqr_12(ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - sp_384_mont_mul_12(ctx->t3, ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - sp_384_mont_mul_12(ctx->t1, ctx->t1, p->x, p384_mod, p384_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_384_mont_sqr_12(ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 5; - break; - case 5: - sp_384_mont_mul_12(ctx->t4, ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 6; - break; - case 6: - sp_384_mont_mul_12(ctx->t2, ctx->t2, q->x, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_384_mont_mul_12(ctx->t3, ctx->t3, p->y, p384_mod, p384_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_384_mont_mul_12(ctx->t4, ctx->t4, q->y, p384_mod, p384_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_384_cmp_equal_12(ctx->t2, ctx->t1) & - sp_384_cmp_equal_12(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_384_proj_point_dbl_12(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_384_mont_sub_12(ctx->t2, ctx->t2, ctx->t1, p384_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_384_mont_sub_12(ctx->t4, ctx->t4, ctx->t3, p384_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_384_mont_sqr_12(ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - sp_384_mont_mul_12(ctx->y, ctx->t1, ctx->t5, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - sp_384_mont_mul_12(ctx->t5, ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_384_mont_mul_12(ctx->z, p->z, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 16; - break; - case 16: - sp_384_mont_mul_12(ctx->z, ctx->z, q->z, p384_mod, p384_mp_mod); - ctx->state = 17; - break; - case 17: - sp_384_mont_sqr_12(ctx->x, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->t5, p384_mod); - ctx->state = 19; - break; - case 19: - sp_384_mont_mul_12(ctx->t5, ctx->t5, ctx->t3, p384_mod, p384_mp_mod); - ctx->state = 20; - break; - case 20: - sp_384_mont_dbl_12(ctx->t3, ctx->y, p384_mod); - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->t3, p384_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 22; - break; - case 22: - sp_384_mont_mul_12(ctx->y, ctx->y, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 23; - break; - case 23: - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->t5, p384_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 12; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 12; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 12; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -96053,10 +95301,6 @@ static int sp_384_ecc_mulmod_12(sp_point_384* r, const sp_point_384* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_12_ctx { int state; - union { - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; - }; sp_point_384 t[3]; sp_digit tmp[2 * 12 * 6]; sp_digit n; @@ -96131,27 +95375,22 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } ctx->y = (ctx->n >> 31) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_384)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_12(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_384)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_384)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); - ctx->state = 4; - ctx->c--; - } + sp_384_proj_point_dbl_12(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_384)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -96343,17 +95582,12 @@ static void sp_384_get_point_33_12(sp_point_384* r, const sp_point_384* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_384_ecc_mulmod_12_ctx { int state; - union { - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_384 t[33 + 2]; sp_digit tmp[2 * 12 * 6]; ecc_recode_384 v[65]; int i; - int j; } sp_384_ecc_mulmod_12_ctx; /* Multiply the point by the scalar and return the result. @@ -96379,6 +95613,7 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_384_ecc_mulmod_12_ctx* ctx = (sp_384_ecc_mulmod_12_ctx*)sp_ctx->data; sp_point_384* rt = &ctx->t[33]; sp_point_384* p = &ctx->t[33 + 1]; @@ -96408,29 +95643,20 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, err = sp_384_mod_mul_norm_12(ctx->t[1].z, g->z, p384_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_384_proj_point_dbl_12(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_384_proj_point_add_12(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -96447,19 +95673,13 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_384_proj_point_dbl_12(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -96475,22 +95695,16 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMSET(negy, 0, sizeof(sp_digit) * 12); sp_384_mont_sub_12(negy, negy, p->y, p384_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 12); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_12(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -98067,10 +97281,6 @@ static int sp_384_ecc_mulmod_base_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_base_12_ctx { int state; - union { - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; - }; sp_point_384 rt; sp_point_384 p; sp_digit tmp[2 * 12 * 6]; @@ -98136,15 +97346,11 @@ static int sp_384_ecc_mulmod_base_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->y; ctx->i = 46; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_384_proj_point_dbl_12(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -98164,21 +97370,16 @@ static int sp_384_ecc_mulmod_base_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMCPY(p->y, p384_table[ctx->y].y, sizeof(p->y[0]) * 12); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_384_proj_point_add_qz1_12(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -99688,7 +98889,8 @@ typedef struct sp_384_mont_inv_order_12_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -99699,6 +98901,7 @@ static int sp_384_mont_inv_order_12_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_384_mont_inv_order_12_ctx* ctx = (sp_384_mont_inv_order_12_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_384_mont_inv_order_12_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -99711,17 +98914,17 @@ static int sp_384_mont_inv_order_12_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const ctx->state = 1; break; case 1: - sp_384_mont_sqr_order_12(t, t); - ctx->state = 2; - break; - case 2: - if ((p384_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_384_mont_mul_order_12(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_384_mont_sqr_order_12(t, t); + if ((p384_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_384_mont_mul_order_12(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 12U); err = MP_OKAY; break; @@ -101334,8 +100537,6 @@ typedef struct sp_ecc_verify_384_ctx { union { sp_384_ecc_mulmod_12_ctx mulmod_ctx; sp_384_mont_inv_order_12_ctx mont_inv_order_ctx; - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; }; sp_digit u1[2*12]; sp_digit u2[2*12]; @@ -101437,14 +100638,12 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_384_iszero_12(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_384_proj_point_add_12(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -101499,6 +100698,9 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_384_ctx)); + } return err; } @@ -122243,151 +121445,6 @@ static void sp_521_proj_point_dbl_17(sp_point_521* r, const sp_point_521* p, sp_521_mont_sub_17(y, y, t2, p521_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_dbl_17_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_dbl_17_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_dbl_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_dbl_17_ctx* ctx = (sp_521_proj_point_dbl_17_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_dbl_17_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*17; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_521_mont_sqr_17(ctx->t1, p->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_521_mont_mul_17(ctx->z, p->y, p->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_521_mont_dbl_17(ctx->z, ctx->z, p521_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_521_mont_sub_17(ctx->t2, p->x, ctx->t1, p521_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_521_mont_add_17(ctx->t1, p->x, ctx->t1, p521_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_521_mont_mul_17(ctx->t2, ctx->t1, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_521_mont_tpl_17(ctx->t1, ctx->t2, p521_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_521_mont_dbl_17(ctx->y, p->y, p521_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_521_mont_sqr_17(ctx->y, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_521_mont_sqr_17(ctx->t2, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_521_mont_div2_17(ctx->t2, ctx->t2, p521_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_521_mont_mul_17(ctx->y, ctx->y, p->x, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_521_mont_sqr_17(ctx->x, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_521_mont_mul_17(ctx->y, ctx->y, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->t2, p521_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -122507,214 +121564,6 @@ static void sp_521_proj_point_add_17(sp_point_521* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_add_17_ctx { - int state; - sp_521_proj_point_dbl_17_ctx dbl_ctx; - const sp_point_521* ap[2]; - sp_point_521* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_add_17_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_add_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, const sp_point_521* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_add_17_ctx* ctx = (sp_521_proj_point_add_17_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_add_17_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_521* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*17; - ctx->t2 = t + 4*17; - ctx->t3 = t + 6*17; - ctx->t4 = t + 8*17; - ctx->t5 = t + 10*17; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_521_mont_sqr_17(ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - sp_521_mont_mul_17(ctx->t3, ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - sp_521_mont_mul_17(ctx->t1, ctx->t1, p->x, p521_mod, p521_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_521_mont_sqr_17(ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 5; - break; - case 5: - sp_521_mont_mul_17(ctx->t4, ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 6; - break; - case 6: - sp_521_mont_mul_17(ctx->t2, ctx->t2, q->x, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_521_mont_mul_17(ctx->t3, ctx->t3, p->y, p521_mod, p521_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_521_mont_mul_17(ctx->t4, ctx->t4, q->y, p521_mod, p521_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_521_cmp_equal_17(ctx->t2, ctx->t1) & - sp_521_cmp_equal_17(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_521_proj_point_dbl_17(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_521_mont_sub_17(ctx->t2, ctx->t2, ctx->t1, p521_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_521_mont_sub_17(ctx->t4, ctx->t4, ctx->t3, p521_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_521_mont_sqr_17(ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - sp_521_mont_mul_17(ctx->y, ctx->t1, ctx->t5, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - sp_521_mont_mul_17(ctx->t5, ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_521_mont_mul_17(ctx->z, p->z, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 16; - break; - case 16: - sp_521_mont_mul_17(ctx->z, ctx->z, q->z, p521_mod, p521_mp_mod); - ctx->state = 17; - break; - case 17: - sp_521_mont_sqr_17(ctx->x, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->t5, p521_mod); - ctx->state = 19; - break; - case 19: - sp_521_mont_mul_17(ctx->t5, ctx->t5, ctx->t3, p521_mod, p521_mp_mod); - ctx->state = 20; - break; - case 20: - sp_521_mont_dbl_17(ctx->t3, ctx->y, p521_mod); - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->t3, p521_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 22; - break; - case 22: - sp_521_mont_mul_17(ctx->y, ctx->y, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 23; - break; - case 23: - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->t5, p521_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 17; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 17; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 17; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -124093,10 +122942,6 @@ static int sp_521_ecc_mulmod_17(sp_point_521* r, const sp_point_521* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_17_ctx { int state; - union { - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; - }; sp_point_521 t[3]; sp_digit tmp[2 * 17 * 6]; sp_digit n; @@ -124171,27 +123016,22 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } ctx->y = (ctx->n >> 31) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_521)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_17(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_521)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_521)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); - ctx->state = 4; - ctx->c--; - } + sp_521_proj_point_dbl_17(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_521)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -124413,17 +123253,12 @@ static void sp_521_get_point_33_17(sp_point_521* r, const sp_point_521* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_521_ecc_mulmod_17_ctx { int state; - union { - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_521 t[33 + 2]; sp_digit tmp[2 * 17 * 6]; ecc_recode_521 v[87]; int i; - int j; } sp_521_ecc_mulmod_17_ctx; /* Multiply the point by the scalar and return the result. @@ -124449,6 +123284,7 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_521_ecc_mulmod_17_ctx* ctx = (sp_521_ecc_mulmod_17_ctx*)sp_ctx->data; sp_point_521* rt = &ctx->t[33]; sp_point_521* p = &ctx->t[33 + 1]; @@ -124478,29 +123314,20 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, err = sp_521_mod_mul_norm_17(ctx->t[1].z, g->z, p521_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_521_proj_point_dbl_17(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_521_proj_point_add_17(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -124517,19 +123344,13 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_521_proj_point_dbl_17(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -124545,22 +123366,16 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMSET(negy, 0, sizeof(sp_digit) * 17); sp_521_mont_sub_17(negy, negy, p->y, p521_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 17); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_17(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -126681,10 +125496,6 @@ static int sp_521_ecc_mulmod_base_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_base_17_ctx { int state; - union { - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; - }; sp_point_521 rt; sp_point_521 p; sp_digit tmp[2 * 17 * 6]; @@ -126750,15 +125561,11 @@ static int sp_521_ecc_mulmod_base_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->y; ctx->i = 64; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_521_proj_point_dbl_17(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -126778,21 +125585,16 @@ static int sp_521_ecc_mulmod_base_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMCPY(p->y, p521_table[ctx->y].y, sizeof(p->y[0]) * 17); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_521_proj_point_add_qz1_17(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -128993,7 +127795,8 @@ typedef struct sp_521_mont_inv_order_17_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -129004,6 +127807,7 @@ static int sp_521_mont_inv_order_17_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_521_mont_inv_order_17_ctx* ctx = (sp_521_mont_inv_order_17_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_521_mont_inv_order_17_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -129016,17 +127820,17 @@ static int sp_521_mont_inv_order_17_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const ctx->state = 1; break; case 1: - sp_521_mont_sqr_order_17(t, t); - ctx->state = 2; - break; - case 2: - if ((p521_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_521_mont_mul_order_17(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_521_mont_sqr_order_17(t, t); + if ((p521_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_521_mont_mul_order_17(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 17U); err = MP_OKAY; break; @@ -131183,8 +129987,6 @@ typedef struct sp_ecc_verify_521_ctx { union { sp_521_ecc_mulmod_17_ctx mulmod_ctx; sp_521_mont_inv_order_17_ctx mont_inv_order_ctx; - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; }; sp_digit u1[2*17]; sp_digit u2[2*17]; @@ -131289,14 +130091,12 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_521_iszero_17(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_521_proj_point_add_17(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -131351,6 +130151,9 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_521_ctx)); + } return err; } diff --git a/wolfcrypt/src/sp_arm64.c b/wolfcrypt/src/sp_arm64.c index d91647c5590..a79a3c5dedd 100644 --- a/wolfcrypt/src/sp_arm64.c +++ b/wolfcrypt/src/sp_arm64.c @@ -25069,146 +25069,6 @@ static void sp_256_proj_point_dbl_4(sp_point_256* r, const sp_point_256* p, sp_256_mont_sub_4(y, y, t2, p256_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_dbl_4_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_dbl_4_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_dbl_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_dbl_4_ctx* ctx = (sp_256_proj_point_dbl_4_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_dbl_4_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*4; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_256_mont_sqr_4(ctx->t1, p->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_256_mont_mul_4(ctx->z, p->y, p->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_256_mont_dbl_4(ctx->z, ctx->z, p256_mod); - ctx->state = 4; - break; - case 4: - /* T1/T2 = X +/- T1 */ - sp_256_mont_add_sub_4(ctx->t1, ctx->t2, p->x, ctx->t1, p256_mod); - ctx->state = 5; - break; - case 5: - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_256_mont_mul_4(ctx->t2, ctx->t1, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_256_mont_tpl_4(ctx->t1, ctx->t2, p256_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_256_mont_dbl_4(ctx->y, p->y, p256_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_256_mont_sqr_4(ctx->y, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_256_mont_sqr_4(ctx->t2, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_256_mont_div2_4(ctx->t2, ctx->t2, p256_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_256_mont_mul_4(ctx->y, ctx->y, p->x, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_256_mont_sqr_4(ctx->x, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - 2*Y */ - /* Y = Y - X */ - sp_256_mont_rsb_sub_dbl_4(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 15; - break; - case 15: - ctx->state = 16; - break; - case 16: - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_256_mont_mul_4(ctx->y, ctx->y, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_256_mont_sub_4(ctx->y, ctx->y, ctx->t2, p256_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Double the Montgomery form projective point p a number of times. * * @param [in, out] p Point to double and result. @@ -25449,255 +25309,6 @@ static void sp_256_proj_point_add_4(sp_point_256* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_add_4_ctx { - int state; - sp_256_proj_point_dbl_4_ctx dbl_ctx; - const sp_point_256* ap[2]; - sp_point_256* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_add_4_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_add_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, const sp_point_256* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_add_4_ctx* ctx = (sp_256_proj_point_add_4_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_add_4_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_256* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*4; - ctx->t2 = t + 4*4; - ctx->t3 = t + 6*4; - ctx->t4 = t + 8*4; - ctx->t5 = t + 10*4; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_256_mont_sqr_4(ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - sp_256_mont_mul_4(ctx->t3, ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - sp_256_mont_mul_4(ctx->t1, ctx->t1, p->x, p256_mod, p256_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_256_mont_sqr_4(ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 5; - break; - case 5: - sp_256_mont_mul_4(ctx->t4, ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 6; - break; - case 6: - sp_256_mont_mul_4(ctx->t2, ctx->t2, q->x, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_256_mont_mul_4(ctx->t3, ctx->t3, p->y, p256_mod, p256_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_256_mont_mul_4(ctx->t4, ctx->t4, q->y, p256_mod, p256_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_256_cmp_equal_4(ctx->t2, ctx->t1) & - sp_256_cmp_equal_4(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_256_proj_point_dbl_4(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_256_mont_sub_4(ctx->t2, ctx->t2, ctx->t1, p256_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_256_mont_sub_4(ctx->t4, ctx->t4, ctx->t3, p256_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_256_mont_sqr_4(ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - sp_256_mont_mul_4(ctx->y, ctx->t1, ctx->t5, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - sp_256_mont_mul_4(ctx->t5, ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_256_mont_mul_4(ctx->z, p->z, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 16; - break; - case 16: - sp_256_mont_mul_4(ctx->z, ctx->z, q->z, p256_mod, p256_mp_mod); - ctx->state = 17; - break; - case 17: - sp_256_mont_sqr_4(ctx->x, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - sp_256_mont_sub_4(ctx->x, ctx->x, ctx->t5, p256_mod); - ctx->state = 19; - break; - case 19: - sp_256_mont_mul_4(ctx->t5, ctx->t5, ctx->t3, p256_mod, p256_mp_mod); - ctx->state = 20; - break; - case 20: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_256_mont_rsb_sub_dbl_4(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 21; - break; - case 21: - ctx->state = 22; - break; - case 22: - sp_256_mont_mul_4(ctx->y, ctx->y, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 23; - break; - case 23: - sp_256_mont_sub_4(ctx->y, ctx->y, ctx->t5, p256_mod); - ctx->state = 24; - break; - case 24: - { -{ - __asm__ __volatile__ ( - "ldrsw x6, [%x[p], #192]\n\t" - "ldrsw x7, [%x[q], #192]\n\t" - "ldp x8, x9, [%x[x]]\n\t" - "ldp x10, x11, [%x[x], #16]\n\t" - "ldp x12, x13, [%x[y]]\n\t" - "ldp x14, x15, [%x[y], #16]\n\t" - "ldp x16, x17, [%x[z]]\n\t" - "ldp x19, x20, [%x[z], #16]\n\t" - "bics xzr, x7, x6\n\t" - "ldp x21, x22, [%x[p]]\n\t" - "ldp x23, x24, [%x[p], #16]\n\t" - "csel x8, x8, x21, eq\n\t" - "csel x9, x9, x22, eq\n\t" - "csel x10, x10, x23, eq\n\t" - "csel x11, x11, x24, eq\n\t" - "ldp x21, x22, [%x[p], #64]\n\t" - "ldp x23, x24, [%x[p], #80]\n\t" - "csel x12, x12, x21, eq\n\t" - "csel x13, x13, x22, eq\n\t" - "csel x14, x14, x23, eq\n\t" - "csel x15, x15, x24, eq\n\t" - "ldp x21, x22, [%x[p], #128]\n\t" - "ldp x23, x24, [%x[p], #144]\n\t" - "csel x16, x16, x21, eq\n\t" - "csel x17, x17, x22, eq\n\t" - "csel x19, x19, x23, eq\n\t" - "csel x20, x20, x24, eq\n\t" - "bics xzr, x6, x7\n\t" - "and x6, x6, x7\n\t" - "ldp x21, x22, [%x[q]]\n\t" - "ldp x23, x24, [%x[q], #16]\n\t" - "csel x8, x8, x21, eq\n\t" - "csel x9, x9, x22, eq\n\t" - "csel x10, x10, x23, eq\n\t" - "csel x11, x11, x24, eq\n\t" - "ldp x21, x22, [%x[q], #64]\n\t" - "ldp x23, x24, [%x[q], #80]\n\t" - "csel x12, x12, x21, eq\n\t" - "csel x13, x13, x22, eq\n\t" - "csel x14, x14, x23, eq\n\t" - "csel x15, x15, x24, eq\n\t" - "ldp x21, x22, [%x[q], #128]\n\t" - "ldp x23, x24, [%x[q], #144]\n\t" - "csel x16, x16, x21, eq\n\t" - "csel x17, x17, x22, eq\n\t" - "csel x19, x19, x23, eq\n\t" - "csel x20, x20, x24, eq\n\t" - "orr x16, x16, x6\n\t" - "stp x8, x9, [%x[r]]\n\t" - "stp x10, x11, [%x[r], #16]\n\t" - "stp x12, x13, [%x[r], #64]\n\t" - "stp x14, x15, [%x[r], #80]\n\t" - "stp x16, x17, [%x[r], #128]\n\t" - "stp x19, x20, [%x[r], #144]\n\t" - "str w6, [%x[r], #192]\n\t" - : - : [r] "r" (r), [p] "r" (p), [q] "r" (q), [x] "r" (ctx->x), - [y] "r" (ctx->y), [z] "r" (ctx->z) - : "memory", "cc", "x6", "x7", "x8", "x9", "x10", "x11", "x12", "x13", - "x14", "x15", "x16", "x17", "x19", "x20", "x21", "x22", "x23", - "x24" - ); -} - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Double the Montgomery form projective point p a number of times. * * @param [out] r Result of repeated doubling of point. @@ -27109,10 +26720,6 @@ static int sp_256_ecc_mulmod_4(sp_point_256* r, const sp_point_256* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_4_ctx { int state; - union { - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; - }; sp_point_256 t[3]; sp_digit tmp[2 * 4 * 6]; sp_digit n; @@ -27187,27 +26794,22 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } ctx->y = (ctx->n >> 63) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_256)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_4(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_256)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_4_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_256)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); - ctx->state = 4; - ctx->c--; - } + sp_256_proj_point_dbl_4(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_256)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -27238,17 +26840,12 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_4_ctx { int state; - union { - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_256 t[33 + 2]; sp_digit tmp[2 * 4 * 6]; ecc_recode_256 v[43]; int i; - int j; } sp_256_ecc_mulmod_4_ctx; /* Multiply the point by the scalar and return the result. @@ -27274,6 +26871,7 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_256_ecc_mulmod_4_ctx* ctx = (sp_256_ecc_mulmod_4_ctx*)sp_ctx->data; sp_point_256* rt = &ctx->t[33]; sp_point_256* p = &ctx->t[33 + 1]; @@ -27303,29 +26901,20 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, err = sp_256_mod_mul_norm_4(ctx->t[1].z, g->z, p256_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_256_proj_point_dbl_4_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_256_proj_point_dbl_4(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_256_proj_point_add_4(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -27342,19 +26931,13 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_4_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_256_proj_point_dbl_4(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -27370,22 +26953,16 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMSET(negy, 0, sizeof(sp_digit) * 4); sp_256_mont_sub_4(negy, negy, p->y, p256_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 4); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_4(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -55849,10 +55426,6 @@ static int sp_256_ecc_mulmod_base_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_base_4_ctx { int state; - union { - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; - }; sp_point_256 rt; sp_point_256 p; sp_digit tmp[2 * 4 * 6]; @@ -55941,20 +55514,16 @@ static int sp_256_ecc_mulmod_base_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, sp_256_sub_4(negy, p256_mod, p->y); sp_256_norm_4(negy); sp_256_cond_copy_4(p->y, negy, (sp_digit)(0 - v[ctx->i].neg)); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - ctx->state = 2; - } + sp_256_proj_point_add_qz1_4(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 2; } break; case 4: /* MAP */ @@ -57328,7 +56897,8 @@ typedef struct sp_256_mont_inv_order_4_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -57339,6 +56909,7 @@ static int sp_256_mont_inv_order_4_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_256_mont_inv_order_4_ctx* ctx = (sp_256_mont_inv_order_4_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_256_mont_inv_order_4_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -57351,17 +56922,17 @@ static int sp_256_mont_inv_order_4_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_256_mont_sqr_order_4(t, t); - ctx->state = 2; - break; - case 2: - if ((p256_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_256_mont_mul_order_4(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_256_mont_sqr_order_4(t, t); + if ((p256_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_256_mont_mul_order_4(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 4U); err = MP_OKAY; break; @@ -58349,8 +57920,6 @@ typedef struct sp_ecc_verify_256_ctx { union { sp_256_ecc_mulmod_4_ctx mulmod_ctx; sp_256_mont_inv_order_4_ctx mont_inv_order_ctx; - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; }; sp_digit u1[2*4]; sp_digit u2[2*4]; @@ -58452,14 +58021,12 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_256_iszero_4(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_256_proj_point_add_4(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -58514,6 +58081,9 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_256_ctx)); + } return err; } @@ -60868,151 +60438,6 @@ static void sp_384_proj_point_dbl_6(sp_point_384* r, const sp_point_384* p, sp_384_mont_sub_6(y, y, t2, p384_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_dbl_6_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_dbl_6_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_dbl_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_dbl_6_ctx* ctx = (sp_384_proj_point_dbl_6_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_dbl_6_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*6; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_384_mont_sqr_6(ctx->t1, p->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_384_mont_mul_6(ctx->z, p->y, p->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_384_mont_dbl_6(ctx->z, ctx->z, p384_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_384_mont_sub_6(ctx->t2, p->x, ctx->t1, p384_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_384_mont_add_6(ctx->t1, p->x, ctx->t1, p384_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_384_mont_mul_6(ctx->t2, ctx->t1, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_384_mont_tpl_6(ctx->t1, ctx->t2, p384_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_384_mont_dbl_6(ctx->y, p->y, p384_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_384_mont_sqr_6(ctx->y, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_384_mont_sqr_6(ctx->t2, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_384_mont_div2_6(ctx->t2, ctx->t2, p384_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_384_mont_mul_6(ctx->y, ctx->y, p->x, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_384_mont_sqr_6(ctx->x, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_384_mont_mul_6(ctx->y, ctx->y, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->t2, p384_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Double the Montgomery form projective point p a number of times. * * @param [in, out] p Point to double and result. @@ -61217,214 +60642,6 @@ static void sp_384_proj_point_add_6(sp_point_384* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_add_6_ctx { - int state; - sp_384_proj_point_dbl_6_ctx dbl_ctx; - const sp_point_384* ap[2]; - sp_point_384* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_add_6_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_add_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, const sp_point_384* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_add_6_ctx* ctx = (sp_384_proj_point_add_6_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_add_6_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_384* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*6; - ctx->t2 = t + 4*6; - ctx->t3 = t + 6*6; - ctx->t4 = t + 8*6; - ctx->t5 = t + 10*6; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_384_mont_sqr_6(ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - sp_384_mont_mul_6(ctx->t3, ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - sp_384_mont_mul_6(ctx->t1, ctx->t1, p->x, p384_mod, p384_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_384_mont_sqr_6(ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 5; - break; - case 5: - sp_384_mont_mul_6(ctx->t4, ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 6; - break; - case 6: - sp_384_mont_mul_6(ctx->t2, ctx->t2, q->x, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_384_mont_mul_6(ctx->t3, ctx->t3, p->y, p384_mod, p384_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_384_mont_mul_6(ctx->t4, ctx->t4, q->y, p384_mod, p384_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_384_cmp_equal_6(ctx->t2, ctx->t1) & - sp_384_cmp_equal_6(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_384_proj_point_dbl_6(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_384_mont_sub_6(ctx->t2, ctx->t2, ctx->t1, p384_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_384_mont_sub_6(ctx->t4, ctx->t4, ctx->t3, p384_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_384_mont_sqr_6(ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - sp_384_mont_mul_6(ctx->y, ctx->t1, ctx->t5, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - sp_384_mont_mul_6(ctx->t5, ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_384_mont_mul_6(ctx->z, p->z, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 16; - break; - case 16: - sp_384_mont_mul_6(ctx->z, ctx->z, q->z, p384_mod, p384_mp_mod); - ctx->state = 17; - break; - case 17: - sp_384_mont_sqr_6(ctx->x, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->t5, p384_mod); - ctx->state = 19; - break; - case 19: - sp_384_mont_mul_6(ctx->t5, ctx->t5, ctx->t3, p384_mod, p384_mp_mod); - ctx->state = 20; - break; - case 20: - sp_384_mont_dbl_6(ctx->t3, ctx->y, p384_mod); - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->t3, p384_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 22; - break; - case 22: - sp_384_mont_mul_6(ctx->y, ctx->y, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 23; - break; - case 23: - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->t5, p384_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 6; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 6; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 6; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Double the Montgomery form projective point p a number of times. * * @param [out] r Result of repeated doubling of point. @@ -62796,10 +62013,6 @@ static int sp_384_ecc_mulmod_6(sp_point_384* r, const sp_point_384* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_6_ctx { int state; - union { - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; - }; sp_point_384 t[3]; sp_digit tmp[2 * 6 * 6]; sp_digit n; @@ -62874,27 +62087,22 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } ctx->y = (ctx->n >> 63) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_384)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_6(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_384)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_6_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_384)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); - ctx->state = 4; - ctx->c--; - } + sp_384_proj_point_dbl_6(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_384)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -62925,17 +62133,12 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_6_ctx { int state; - union { - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_384 t[33 + 2]; sp_digit tmp[2 * 6 * 6]; ecc_recode_384 v[65]; int i; - int j; } sp_384_ecc_mulmod_6_ctx; /* Multiply the point by the scalar and return the result. @@ -62961,6 +62164,7 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_384_ecc_mulmod_6_ctx* ctx = (sp_384_ecc_mulmod_6_ctx*)sp_ctx->data; sp_point_384* rt = &ctx->t[33]; sp_point_384* p = &ctx->t[33 + 1]; @@ -62990,29 +62194,20 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, err = sp_384_mod_mul_norm_6(ctx->t[1].z, g->z, p384_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_384_proj_point_dbl_6_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_384_proj_point_dbl_6(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_384_proj_point_add_6(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -63029,19 +62224,13 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_6_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_384_proj_point_dbl_6(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -63057,22 +62246,16 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMSET(negy, 0, sizeof(sp_digit) * 6); sp_384_mont_sub_6(negy, negy, p->y, p384_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 6); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_6(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -82895,10 +82078,6 @@ static int sp_384_ecc_mulmod_base_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_base_6_ctx { int state; - union { - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; - }; sp_point_384 rt; sp_point_384 p; sp_digit tmp[2 * 6 * 6]; @@ -82979,20 +82158,16 @@ static int sp_384_ecc_mulmod_base_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, sp_384_sub_6(negy, p384_mod, p->y); sp_384_norm_6(negy); sp_384_cond_copy_6(p->y, negy, (sp_digit)(0 - v[ctx->i].neg)); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - ctx->state = 2; - } + sp_384_proj_point_add_qz1_6(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 2; } break; case 4: /* MAP */ @@ -83884,7 +83059,8 @@ typedef struct sp_384_mont_inv_order_6_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -83895,6 +83071,7 @@ static int sp_384_mont_inv_order_6_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_384_mont_inv_order_6_ctx* ctx = (sp_384_mont_inv_order_6_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_384_mont_inv_order_6_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -83907,17 +83084,17 @@ static int sp_384_mont_inv_order_6_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_384_mont_sqr_order_6(t, t); - ctx->state = 2; - break; - case 2: - if ((p384_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_384_mont_mul_order_6(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_384_mont_sqr_order_6(t, t); + if ((p384_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_384_mont_mul_order_6(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 6U); err = MP_OKAY; break; @@ -84728,8 +83905,6 @@ typedef struct sp_ecc_verify_384_ctx { union { sp_384_ecc_mulmod_6_ctx mulmod_ctx; sp_384_mont_inv_order_6_ctx mont_inv_order_ctx; - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; }; sp_digit u1[2*6]; sp_digit u2[2*6]; @@ -84831,14 +84006,12 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_384_iszero_6(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_384_proj_point_add_6(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -84893,6 +84066,9 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_384_ctx)); + } return err; } @@ -89529,151 +88705,6 @@ static void sp_521_proj_point_dbl_9(sp_point_521* r, const sp_point_521* p, sp_521_mont_sub_9(y, y, t2, p521_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_dbl_9_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_dbl_9_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_dbl_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_dbl_9_ctx* ctx = (sp_521_proj_point_dbl_9_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_dbl_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*9; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_521_mont_sqr_9(ctx->t1, p->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_521_mont_mul_9(ctx->z, p->y, p->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_521_mont_dbl_9(ctx->z, ctx->z, p521_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_521_mont_sub_9(ctx->t2, p->x, ctx->t1, p521_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_521_mont_add_9(ctx->t1, p->x, ctx->t1, p521_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_521_mont_mul_9(ctx->t2, ctx->t1, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_521_mont_tpl_9(ctx->t1, ctx->t2, p521_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_521_mont_dbl_9(ctx->y, p->y, p521_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_521_mont_sqr_9(ctx->y, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_521_mont_sqr_9(ctx->t2, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_521_mont_div2_9(ctx->t2, ctx->t2, p521_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_521_mont_mul_9(ctx->y, ctx->y, p->x, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_521_mont_sqr_9(ctx->x, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_521_mont_mul_9(ctx->y, ctx->y, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->t2, p521_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Double the Montgomery form projective point p a number of times. * * @param [in, out] p Point to double and result. @@ -89880,214 +88911,6 @@ static void sp_521_proj_point_add_9(sp_point_521* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_add_9_ctx { - int state; - sp_521_proj_point_dbl_9_ctx dbl_ctx; - const sp_point_521* ap[2]; - sp_point_521* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_add_9_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_add_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, const sp_point_521* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_add_9_ctx* ctx = (sp_521_proj_point_add_9_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_add_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_521* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*9; - ctx->t2 = t + 4*9; - ctx->t3 = t + 6*9; - ctx->t4 = t + 8*9; - ctx->t5 = t + 10*9; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_521_mont_sqr_9(ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - sp_521_mont_mul_9(ctx->t3, ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - sp_521_mont_mul_9(ctx->t1, ctx->t1, p->x, p521_mod, p521_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_521_mont_sqr_9(ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 5; - break; - case 5: - sp_521_mont_mul_9(ctx->t4, ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 6; - break; - case 6: - sp_521_mont_mul_9(ctx->t2, ctx->t2, q->x, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_521_mont_mul_9(ctx->t3, ctx->t3, p->y, p521_mod, p521_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_521_mont_mul_9(ctx->t4, ctx->t4, q->y, p521_mod, p521_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_521_cmp_equal_9(ctx->t2, ctx->t1) & - sp_521_cmp_equal_9(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_521_proj_point_dbl_9(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_521_mont_sub_9(ctx->t2, ctx->t2, ctx->t1, p521_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_521_mont_sub_9(ctx->t4, ctx->t4, ctx->t3, p521_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_521_mont_sqr_9(ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - sp_521_mont_mul_9(ctx->y, ctx->t1, ctx->t5, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - sp_521_mont_mul_9(ctx->t5, ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_521_mont_mul_9(ctx->z, p->z, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 16; - break; - case 16: - sp_521_mont_mul_9(ctx->z, ctx->z, q->z, p521_mod, p521_mp_mod); - ctx->state = 17; - break; - case 17: - sp_521_mont_sqr_9(ctx->x, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->t5, p521_mod); - ctx->state = 19; - break; - case 19: - sp_521_mont_mul_9(ctx->t5, ctx->t5, ctx->t3, p521_mod, p521_mp_mod); - ctx->state = 20; - break; - case 20: - sp_521_mont_dbl_9(ctx->t3, ctx->y, p521_mod); - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->t3, p521_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 22; - break; - case 22: - sp_521_mont_mul_9(ctx->y, ctx->y, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 23; - break; - case 23: - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->t5, p521_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 9; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 9; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 9; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Double the Montgomery form projective point p a number of times. * * @param [out] r Result of repeated doubling of point. @@ -91522,10 +90345,6 @@ static int sp_521_ecc_mulmod_9(sp_point_521* r, const sp_point_521* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; sp_point_521 t[3]; sp_digit tmp[2 * 9 * 6]; sp_digit n; @@ -91600,27 +90419,22 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } ctx->y = (ctx->n >> 63) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_521)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_9(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_521)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_521)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); - ctx->state = 4; - ctx->c--; - } + sp_521_proj_point_dbl_9(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_521)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -91651,17 +90465,12 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_521 t[33 + 2]; sp_digit tmp[2 * 9 * 6]; ecc_recode_521 v[87]; int i; - int j; } sp_521_ecc_mulmod_9_ctx; /* Multiply the point by the scalar and return the result. @@ -91687,6 +90496,7 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_521_ecc_mulmod_9_ctx* ctx = (sp_521_ecc_mulmod_9_ctx*)sp_ctx->data; sp_point_521* rt = &ctx->t[33]; sp_point_521* p = &ctx->t[33 + 1]; @@ -91716,29 +90526,20 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, err = sp_521_mod_mul_norm_9(ctx->t[1].z, g->z, p521_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_521_proj_point_dbl_9(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_521_proj_point_add_9(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -91755,19 +90556,13 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_521_proj_point_dbl_9(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -91783,22 +90578,16 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMSET(negy, 0, sizeof(sp_digit) * 9); sp_521_mont_sub_9(negy, negy, p->y, p521_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 9); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_9(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -128335,10 +127124,6 @@ static int sp_521_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_base_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; sp_point_521 rt; sp_point_521 p; sp_digit tmp[2 * 9 * 6]; @@ -128419,20 +127204,16 @@ static int sp_521_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, sp_521_sub_9(negy, p521_mod, p->y); sp_521_norm_9(negy); sp_521_cond_copy_9(p->y, negy, (sp_digit)(0 - v[ctx->i].neg)); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - ctx->state = 2; - } + sp_521_proj_point_add_qz1_9(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 2; } break; case 4: /* MAP */ @@ -129073,7 +127854,8 @@ typedef struct sp_521_mont_inv_order_9_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -129084,6 +127866,7 @@ static int sp_521_mont_inv_order_9_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_521_mont_inv_order_9_ctx* ctx = (sp_521_mont_inv_order_9_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_521_mont_inv_order_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -129096,17 +127879,17 @@ static int sp_521_mont_inv_order_9_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_521_mont_sqr_order_9(t, t); - ctx->state = 2; - break; - case 2: - if ((p521_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_521_mont_mul_order_9(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_521_mont_sqr_order_9(t, t); + if ((p521_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_521_mont_mul_order_9(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 9U); err = MP_OKAY; break; @@ -129961,8 +128744,6 @@ typedef struct sp_ecc_verify_521_ctx { union { sp_521_ecc_mulmod_9_ctx mulmod_ctx; sp_521_mont_inv_order_9_ctx mont_inv_order_ctx; - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; }; sp_digit u1[2*9]; sp_digit u2[2*9]; @@ -130067,14 +128848,12 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_521_iszero_9(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_521_proj_point_add_9(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -130129,6 +128908,9 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_521_ctx)); + } return err; } diff --git a/wolfcrypt/src/sp_armthumb.c b/wolfcrypt/src/sp_armthumb.c index 8f03409b472..de106c89148 100644 --- a/wolfcrypt/src/sp_armthumb.c +++ b/wolfcrypt/src/sp_armthumb.c @@ -101080,151 +101080,6 @@ static void sp_256_proj_point_dbl_8(sp_point_256* r, const sp_point_256* p, sp_256_mont_sub_8(y, y, t2, p256_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_dbl_8_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_dbl_8_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_dbl_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_dbl_8_ctx* ctx = (sp_256_proj_point_dbl_8_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_dbl_8_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*8; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_256_mont_sqr_8(ctx->t1, p->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_256_mont_mul_8(ctx->z, p->y, p->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_256_mont_dbl_8(ctx->z, ctx->z, p256_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_256_mont_sub_8(ctx->t2, p->x, ctx->t1, p256_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_256_mont_add_8(ctx->t1, p->x, ctx->t1, p256_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_256_mont_mul_8(ctx->t2, ctx->t1, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_256_mont_tpl_8(ctx->t1, ctx->t2, p256_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_256_mont_dbl_8(ctx->y, p->y, p256_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_256_mont_sqr_8(ctx->y, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_256_mont_sqr_8(ctx->t2, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_256_mont_div2_8(ctx->t2, ctx->t2, p256_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_256_mont_mul_8(ctx->y, ctx->y, p->x, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_256_mont_sqr_8(ctx->x, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_256_mont_mul_8(ctx->y, ctx->y, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->t2, p256_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -101339,214 +101194,6 @@ static void sp_256_proj_point_add_8(sp_point_256* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_add_8_ctx { - int state; - sp_256_proj_point_dbl_8_ctx dbl_ctx; - const sp_point_256* ap[2]; - sp_point_256* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_add_8_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_add_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, const sp_point_256* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_add_8_ctx* ctx = (sp_256_proj_point_add_8_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_add_8_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_256* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*8; - ctx->t2 = t + 4*8; - ctx->t3 = t + 6*8; - ctx->t4 = t + 8*8; - ctx->t5 = t + 10*8; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_256_mont_sqr_8(ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - sp_256_mont_mul_8(ctx->t3, ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - sp_256_mont_mul_8(ctx->t1, ctx->t1, p->x, p256_mod, p256_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_256_mont_sqr_8(ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 5; - break; - case 5: - sp_256_mont_mul_8(ctx->t4, ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 6; - break; - case 6: - sp_256_mont_mul_8(ctx->t2, ctx->t2, q->x, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_256_mont_mul_8(ctx->t3, ctx->t3, p->y, p256_mod, p256_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_256_mont_mul_8(ctx->t4, ctx->t4, q->y, p256_mod, p256_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_256_cmp_equal_8(ctx->t2, ctx->t1) & - sp_256_cmp_equal_8(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_256_proj_point_dbl_8(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_256_mont_sub_8(ctx->t2, ctx->t2, ctx->t1, p256_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_256_mont_sub_8(ctx->t4, ctx->t4, ctx->t3, p256_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_256_mont_sqr_8(ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - sp_256_mont_mul_8(ctx->y, ctx->t1, ctx->t5, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - sp_256_mont_mul_8(ctx->t5, ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_256_mont_mul_8(ctx->z, p->z, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 16; - break; - case 16: - sp_256_mont_mul_8(ctx->z, ctx->z, q->z, p256_mod, p256_mp_mod); - ctx->state = 17; - break; - case 17: - sp_256_mont_sqr_8(ctx->x, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->t5, p256_mod); - ctx->state = 19; - break; - case 19: - sp_256_mont_mul_8(ctx->t5, ctx->t5, ctx->t3, p256_mod, p256_mp_mod); - ctx->state = 20; - break; - case 20: - sp_256_mont_dbl_8(ctx->t3, ctx->y, p256_mod); - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->t3, p256_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 22; - break; - case 22: - sp_256_mont_mul_8(ctx->y, ctx->y, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 23; - break; - case 23: - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->t5, p256_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 8; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 8; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 8; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -102785,10 +102432,6 @@ static int sp_256_ecc_mulmod_8(sp_point_256* r, const sp_point_256* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_8_ctx { int state; - union { - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; - }; sp_point_256 t[3]; sp_digit tmp[2 * 8 * 6]; sp_digit n; @@ -102863,27 +102506,22 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } ctx->y = (ctx->n >> 31) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_256)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_8(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_256)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_256)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); - ctx->state = 4; - ctx->c--; - } + sp_256_proj_point_dbl_8(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_256)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -103051,17 +102689,12 @@ static void sp_256_get_point_33_8(sp_point_256* r, const sp_point_256* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_256_ecc_mulmod_8_ctx { int state; - union { - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_256 t[33 + 2]; sp_digit tmp[2 * 8 * 6]; ecc_recode_256 v[43]; int i; - int j; } sp_256_ecc_mulmod_8_ctx; /* Multiply the point by the scalar and return the result. @@ -103087,6 +102720,7 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_256_ecc_mulmod_8_ctx* ctx = (sp_256_ecc_mulmod_8_ctx*)sp_ctx->data; sp_point_256* rt = &ctx->t[33]; sp_point_256* p = &ctx->t[33 + 1]; @@ -103116,29 +102750,20 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, err = sp_256_mod_mul_norm_8(ctx->t[1].z, g->z, p256_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_256_proj_point_dbl_8(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_256_proj_point_add_8(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -103155,19 +102780,13 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_256_proj_point_dbl_8(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -103183,22 +102802,16 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMSET(negy, 0, sizeof(sp_digit) * 8); sp_256_mont_sub_8(negy, negy, p->y, p256_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 8); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_8(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -104775,10 +104388,6 @@ static int sp_256_ecc_mulmod_base_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_base_8_ctx { int state; - union { - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; - }; sp_point_256 rt; sp_point_256 p; sp_digit tmp[2 * 8 * 6]; @@ -104844,15 +104453,11 @@ static int sp_256_ecc_mulmod_base_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->y; ctx->i = 30; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_256_proj_point_dbl_8(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -104872,21 +104477,16 @@ static int sp_256_ecc_mulmod_base_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMCPY(p->y, p256_table[ctx->y].y, sizeof(p->y[0]) * 8); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_256_proj_point_add_qz1_8(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -106559,7 +106159,8 @@ typedef struct sp_256_mont_inv_order_8_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -106570,6 +106171,7 @@ static int sp_256_mont_inv_order_8_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_256_mont_inv_order_8_ctx* ctx = (sp_256_mont_inv_order_8_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_256_mont_inv_order_8_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -106582,17 +106184,17 @@ static int sp_256_mont_inv_order_8_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_256_mont_sqr_order_8(t, t); - ctx->state = 2; - break; - case 2: - if ((p256_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_256_mont_mul_order_8(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_256_mont_sqr_order_8(t, t); + if ((p256_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_256_mont_mul_order_8(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 8U); err = MP_OKAY; break; @@ -108703,8 +108305,6 @@ typedef struct sp_ecc_verify_256_ctx { union { sp_256_ecc_mulmod_8_ctx mulmod_ctx; sp_256_mont_inv_order_8_ctx mont_inv_order_ctx; - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; }; sp_digit u1[2*8]; sp_digit u2[2*8]; @@ -108806,14 +108406,12 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_256_iszero_8(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_256_proj_point_add_8(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -108868,6 +108466,9 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_256_ctx)); + } return err; } @@ -112342,151 +111943,6 @@ static void sp_384_proj_point_dbl_12(sp_point_384* r, const sp_point_384* p, sp_384_mont_sub_12(y, y, t2, p384_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_dbl_12_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_dbl_12_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_dbl_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_dbl_12_ctx* ctx = (sp_384_proj_point_dbl_12_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_dbl_12_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*12; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_384_mont_sqr_12(ctx->t1, p->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_384_mont_mul_12(ctx->z, p->y, p->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_384_mont_dbl_12(ctx->z, ctx->z, p384_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_384_mont_sub_12(ctx->t2, p->x, ctx->t1, p384_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_384_mont_add_12(ctx->t1, p->x, ctx->t1, p384_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_384_mont_mul_12(ctx->t2, ctx->t1, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_384_mont_tpl_12(ctx->t1, ctx->t2, p384_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_384_mont_dbl_12(ctx->y, p->y, p384_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_384_mont_sqr_12(ctx->y, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_384_mont_sqr_12(ctx->t2, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_384_mont_div2_12(ctx->t2, ctx->t2, p384_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_384_mont_mul_12(ctx->y, ctx->y, p->x, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_384_mont_sqr_12(ctx->x, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_384_mont_mul_12(ctx->y, ctx->y, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->t2, p384_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -112603,214 +112059,6 @@ static void sp_384_proj_point_add_12(sp_point_384* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_add_12_ctx { - int state; - sp_384_proj_point_dbl_12_ctx dbl_ctx; - const sp_point_384* ap[2]; - sp_point_384* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_add_12_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_add_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, const sp_point_384* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_add_12_ctx* ctx = (sp_384_proj_point_add_12_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_add_12_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_384* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*12; - ctx->t2 = t + 4*12; - ctx->t3 = t + 6*12; - ctx->t4 = t + 8*12; - ctx->t5 = t + 10*12; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_384_mont_sqr_12(ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - sp_384_mont_mul_12(ctx->t3, ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - sp_384_mont_mul_12(ctx->t1, ctx->t1, p->x, p384_mod, p384_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_384_mont_sqr_12(ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 5; - break; - case 5: - sp_384_mont_mul_12(ctx->t4, ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 6; - break; - case 6: - sp_384_mont_mul_12(ctx->t2, ctx->t2, q->x, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_384_mont_mul_12(ctx->t3, ctx->t3, p->y, p384_mod, p384_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_384_mont_mul_12(ctx->t4, ctx->t4, q->y, p384_mod, p384_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_384_cmp_equal_12(ctx->t2, ctx->t1) & - sp_384_cmp_equal_12(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_384_proj_point_dbl_12(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_384_mont_sub_12(ctx->t2, ctx->t2, ctx->t1, p384_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_384_mont_sub_12(ctx->t4, ctx->t4, ctx->t3, p384_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_384_mont_sqr_12(ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - sp_384_mont_mul_12(ctx->y, ctx->t1, ctx->t5, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - sp_384_mont_mul_12(ctx->t5, ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_384_mont_mul_12(ctx->z, p->z, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 16; - break; - case 16: - sp_384_mont_mul_12(ctx->z, ctx->z, q->z, p384_mod, p384_mp_mod); - ctx->state = 17; - break; - case 17: - sp_384_mont_sqr_12(ctx->x, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->t5, p384_mod); - ctx->state = 19; - break; - case 19: - sp_384_mont_mul_12(ctx->t5, ctx->t5, ctx->t3, p384_mod, p384_mp_mod); - ctx->state = 20; - break; - case 20: - sp_384_mont_dbl_12(ctx->t3, ctx->y, p384_mod); - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->t3, p384_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 22; - break; - case 22: - sp_384_mont_mul_12(ctx->y, ctx->y, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 23; - break; - case 23: - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->t5, p384_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 12; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 12; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 12; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -114105,10 +113353,6 @@ static int sp_384_ecc_mulmod_12(sp_point_384* r, const sp_point_384* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_12_ctx { int state; - union { - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; - }; sp_point_384 t[3]; sp_digit tmp[2 * 12 * 6]; sp_digit n; @@ -114183,27 +113427,22 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } ctx->y = (ctx->n >> 31) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_384)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_12(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_384)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_384)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); - ctx->state = 4; - ctx->c--; - } + sp_384_proj_point_dbl_12(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_384)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -114395,17 +113634,12 @@ static void sp_384_get_point_33_12(sp_point_384* r, const sp_point_384* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_384_ecc_mulmod_12_ctx { int state; - union { - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_384 t[33 + 2]; sp_digit tmp[2 * 12 * 6]; ecc_recode_384 v[65]; int i; - int j; } sp_384_ecc_mulmod_12_ctx; /* Multiply the point by the scalar and return the result. @@ -114431,6 +113665,7 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_384_ecc_mulmod_12_ctx* ctx = (sp_384_ecc_mulmod_12_ctx*)sp_ctx->data; sp_point_384* rt = &ctx->t[33]; sp_point_384* p = &ctx->t[33 + 1]; @@ -114460,29 +113695,20 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, err = sp_384_mod_mul_norm_12(ctx->t[1].z, g->z, p384_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_384_proj_point_dbl_12(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_384_proj_point_add_12(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -114499,19 +113725,13 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_384_proj_point_dbl_12(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -114527,22 +113747,16 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMSET(negy, 0, sizeof(sp_digit) * 12); sp_384_mont_sub_12(negy, negy, p->y, p384_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 12); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_12(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -116119,10 +115333,6 @@ static int sp_384_ecc_mulmod_base_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_base_12_ctx { int state; - union { - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; - }; sp_point_384 rt; sp_point_384 p; sp_digit tmp[2 * 12 * 6]; @@ -116188,15 +115398,11 @@ static int sp_384_ecc_mulmod_base_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->y; ctx->i = 46; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_384_proj_point_dbl_12(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -116216,21 +115422,16 @@ static int sp_384_ecc_mulmod_base_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMCPY(p->y, p384_table[ctx->y].y, sizeof(p->y[0]) * 12); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_384_proj_point_add_qz1_12(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -117979,7 +117180,8 @@ typedef struct sp_384_mont_inv_order_12_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -117990,6 +117192,7 @@ static int sp_384_mont_inv_order_12_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_384_mont_inv_order_12_ctx* ctx = (sp_384_mont_inv_order_12_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_384_mont_inv_order_12_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -118002,17 +117205,17 @@ static int sp_384_mont_inv_order_12_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const ctx->state = 1; break; case 1: - sp_384_mont_sqr_order_12(t, t); - ctx->state = 2; - break; - case 2: - if ((p384_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_384_mont_mul_order_12(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_384_mont_sqr_order_12(t, t); + if ((p384_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_384_mont_mul_order_12(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 12U); err = MP_OKAY; break; @@ -120348,8 +119551,6 @@ typedef struct sp_ecc_verify_384_ctx { union { sp_384_ecc_mulmod_12_ctx mulmod_ctx; sp_384_mont_inv_order_12_ctx mont_inv_order_ctx; - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; }; sp_digit u1[2*12]; sp_digit u2[2*12]; @@ -120451,14 +119652,12 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_384_iszero_12(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_384_proj_point_add_12(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -120513,6 +119712,9 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_384_ctx)); + } return err; } @@ -126396,151 +125598,6 @@ static void sp_521_proj_point_dbl_17(sp_point_521* r, const sp_point_521* p, sp_521_mont_sub_17(y, y, t2, p521_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_dbl_17_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_dbl_17_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_dbl_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_dbl_17_ctx* ctx = (sp_521_proj_point_dbl_17_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_dbl_17_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*17; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_521_mont_sqr_17(ctx->t1, p->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_521_mont_mul_17(ctx->z, p->y, p->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_521_mont_dbl_17(ctx->z, ctx->z, p521_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_521_mont_sub_17(ctx->t2, p->x, ctx->t1, p521_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_521_mont_add_17(ctx->t1, p->x, ctx->t1, p521_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_521_mont_mul_17(ctx->t2, ctx->t1, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_521_mont_tpl_17(ctx->t1, ctx->t2, p521_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_521_mont_dbl_17(ctx->y, p->y, p521_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_521_mont_sqr_17(ctx->y, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_521_mont_sqr_17(ctx->t2, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_521_mont_div2_17(ctx->t2, ctx->t2, p521_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_521_mont_mul_17(ctx->y, ctx->y, p->x, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_521_mont_sqr_17(ctx->x, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_521_mont_mul_17(ctx->y, ctx->y, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->t2, p521_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -126660,214 +125717,6 @@ static void sp_521_proj_point_add_17(sp_point_521* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_add_17_ctx { - int state; - sp_521_proj_point_dbl_17_ctx dbl_ctx; - const sp_point_521* ap[2]; - sp_point_521* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_add_17_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_add_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, const sp_point_521* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_add_17_ctx* ctx = (sp_521_proj_point_add_17_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_add_17_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_521* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*17; - ctx->t2 = t + 4*17; - ctx->t3 = t + 6*17; - ctx->t4 = t + 8*17; - ctx->t5 = t + 10*17; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_521_mont_sqr_17(ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - sp_521_mont_mul_17(ctx->t3, ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - sp_521_mont_mul_17(ctx->t1, ctx->t1, p->x, p521_mod, p521_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_521_mont_sqr_17(ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 5; - break; - case 5: - sp_521_mont_mul_17(ctx->t4, ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 6; - break; - case 6: - sp_521_mont_mul_17(ctx->t2, ctx->t2, q->x, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_521_mont_mul_17(ctx->t3, ctx->t3, p->y, p521_mod, p521_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_521_mont_mul_17(ctx->t4, ctx->t4, q->y, p521_mod, p521_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_521_cmp_equal_17(ctx->t2, ctx->t1) & - sp_521_cmp_equal_17(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_521_proj_point_dbl_17(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_521_mont_sub_17(ctx->t2, ctx->t2, ctx->t1, p521_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_521_mont_sub_17(ctx->t4, ctx->t4, ctx->t3, p521_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_521_mont_sqr_17(ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - sp_521_mont_mul_17(ctx->y, ctx->t1, ctx->t5, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - sp_521_mont_mul_17(ctx->t5, ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_521_mont_mul_17(ctx->z, p->z, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 16; - break; - case 16: - sp_521_mont_mul_17(ctx->z, ctx->z, q->z, p521_mod, p521_mp_mod); - ctx->state = 17; - break; - case 17: - sp_521_mont_sqr_17(ctx->x, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->t5, p521_mod); - ctx->state = 19; - break; - case 19: - sp_521_mont_mul_17(ctx->t5, ctx->t5, ctx->t3, p521_mod, p521_mp_mod); - ctx->state = 20; - break; - case 20: - sp_521_mont_dbl_17(ctx->t3, ctx->y, p521_mod); - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->t3, p521_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 22; - break; - case 22: - sp_521_mont_mul_17(ctx->y, ctx->y, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 23; - break; - case 23: - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->t5, p521_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 17; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 17; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 17; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -128246,10 +127095,6 @@ static int sp_521_ecc_mulmod_17(sp_point_521* r, const sp_point_521* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_17_ctx { int state; - union { - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; - }; sp_point_521 t[3]; sp_digit tmp[2 * 17 * 6]; sp_digit n; @@ -128324,27 +127169,22 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } ctx->y = (ctx->n >> 31) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_521)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_17(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_521)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_521)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); - ctx->state = 4; - ctx->c--; - } + sp_521_proj_point_dbl_17(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_521)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -128566,17 +127406,12 @@ static void sp_521_get_point_33_17(sp_point_521* r, const sp_point_521* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_521_ecc_mulmod_17_ctx { int state; - union { - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_521 t[33 + 2]; sp_digit tmp[2 * 17 * 6]; ecc_recode_521 v[87]; int i; - int j; } sp_521_ecc_mulmod_17_ctx; /* Multiply the point by the scalar and return the result. @@ -128602,6 +127437,7 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_521_ecc_mulmod_17_ctx* ctx = (sp_521_ecc_mulmod_17_ctx*)sp_ctx->data; sp_point_521* rt = &ctx->t[33]; sp_point_521* p = &ctx->t[33 + 1]; @@ -128631,29 +127467,20 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, err = sp_521_mod_mul_norm_17(ctx->t[1].z, g->z, p521_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_521_proj_point_dbl_17(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_521_proj_point_add_17(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -128670,19 +127497,13 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_521_proj_point_dbl_17(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -128698,22 +127519,16 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMSET(negy, 0, sizeof(sp_digit) * 17); sp_521_mont_sub_17(negy, negy, p->y, p521_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 17); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_17(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -130834,10 +129649,6 @@ static int sp_521_ecc_mulmod_base_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_base_17_ctx { int state; - union { - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; - }; sp_point_521 rt; sp_point_521 p; sp_digit tmp[2 * 17 * 6]; @@ -130903,15 +129714,11 @@ static int sp_521_ecc_mulmod_base_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->y; ctx->i = 64; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_521_proj_point_dbl_17(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -130931,21 +129738,16 @@ static int sp_521_ecc_mulmod_base_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMCPY(p->y, p521_table[ctx->y].y, sizeof(p->y[0]) * 17); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_521_proj_point_add_qz1_17(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -134456,7 +133258,8 @@ typedef struct sp_521_mont_inv_order_17_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -134467,6 +133270,7 @@ static int sp_521_mont_inv_order_17_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_521_mont_inv_order_17_ctx* ctx = (sp_521_mont_inv_order_17_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_521_mont_inv_order_17_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -134479,17 +133283,17 @@ static int sp_521_mont_inv_order_17_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const ctx->state = 1; break; case 1: - sp_521_mont_sqr_order_17(t, t); - ctx->state = 2; - break; - case 2: - if ((p521_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_521_mont_mul_order_17(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_521_mont_sqr_order_17(t, t); + if ((p521_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_521_mont_mul_order_17(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 17U); err = MP_OKAY; break; @@ -137820,8 +136624,6 @@ typedef struct sp_ecc_verify_521_ctx { union { sp_521_ecc_mulmod_17_ctx mulmod_ctx; sp_521_mont_inv_order_17_ctx mont_inv_order_ctx; - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; }; sp_digit u1[2*17]; sp_digit u2[2*17]; @@ -137926,14 +136728,12 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_521_iszero_17(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_521_proj_point_add_17(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -137988,6 +136788,9 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_521_ctx)); + } return err; } diff --git a/wolfcrypt/src/sp_c32.c b/wolfcrypt/src/sp_c32.c index 3edd0cd1dd8..c373cbd2915 100644 --- a/wolfcrypt/src/sp_c32.c +++ b/wolfcrypt/src/sp_c32.c @@ -25157,151 +25157,6 @@ static void sp_256_proj_point_dbl_9(sp_point_256* r, const sp_point_256* p, sp_256_mont_sub_9(y, y, t2, p256_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_dbl_9_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_dbl_9_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_dbl_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_dbl_9_ctx* ctx = (sp_256_proj_point_dbl_9_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_dbl_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*9; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_256_mont_sqr_9(ctx->t1, p->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_256_mont_mul_9(ctx->z, p->y, p->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_256_mont_dbl_9(ctx->z, ctx->z, p256_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_256_mont_sub_9(ctx->t2, p->x, ctx->t1, p256_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_256_mont_add_9(ctx->t1, p->x, ctx->t1, p256_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_256_mont_mul_9(ctx->t2, ctx->t1, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_256_mont_tpl_9(ctx->t1, ctx->t2, p256_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_256_mont_dbl_9(ctx->y, p->y, p256_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_256_mont_sqr_9(ctx->y, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_256_mont_sqr_9(ctx->t2, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_256_mont_div2_9(ctx->t2, ctx->t2, p256_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_256_mont_mul_9(ctx->y, ctx->y, p->x, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_256_mont_sqr_9(ctx->x, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_256_mont_sub_9(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_256_mont_sub_9(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_256_mont_sub_9(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_256_mont_mul_9(ctx->y, ctx->y, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_256_mont_sub_9(ctx->y, ctx->y, ctx->t2, p256_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -25417,214 +25272,6 @@ static void sp_256_proj_point_add_9(sp_point_256* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_add_9_ctx { - int state; - sp_256_proj_point_dbl_9_ctx dbl_ctx; - const sp_point_256* ap[2]; - sp_point_256* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_add_9_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_add_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, const sp_point_256* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_add_9_ctx* ctx = (sp_256_proj_point_add_9_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_add_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_256* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*9; - ctx->t2 = t + 4*9; - ctx->t3 = t + 6*9; - ctx->t4 = t + 8*9; - ctx->t5 = t + 10*9; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_256_mont_sqr_9(ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - sp_256_mont_mul_9(ctx->t3, ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - sp_256_mont_mul_9(ctx->t1, ctx->t1, p->x, p256_mod, p256_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_256_mont_sqr_9(ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 5; - break; - case 5: - sp_256_mont_mul_9(ctx->t4, ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 6; - break; - case 6: - sp_256_mont_mul_9(ctx->t2, ctx->t2, q->x, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_256_mont_mul_9(ctx->t3, ctx->t3, p->y, p256_mod, p256_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_256_mont_mul_9(ctx->t4, ctx->t4, q->y, p256_mod, p256_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_256_cmp_equal_9(ctx->t2, ctx->t1) & - sp_256_cmp_equal_9(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_256_proj_point_dbl_9(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_256_mont_sub_9(ctx->t2, ctx->t2, ctx->t1, p256_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_256_mont_sub_9(ctx->t4, ctx->t4, ctx->t3, p256_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_256_mont_sqr_9(ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - sp_256_mont_mul_9(ctx->y, ctx->t1, ctx->t5, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - sp_256_mont_mul_9(ctx->t5, ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_256_mont_mul_9(ctx->z, p->z, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 16; - break; - case 16: - sp_256_mont_mul_9(ctx->z, ctx->z, q->z, p256_mod, p256_mp_mod); - ctx->state = 17; - break; - case 17: - sp_256_mont_sqr_9(ctx->x, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - sp_256_mont_sub_9(ctx->x, ctx->x, ctx->t5, p256_mod); - ctx->state = 19; - break; - case 19: - sp_256_mont_mul_9(ctx->t5, ctx->t5, ctx->t3, p256_mod, p256_mp_mod); - ctx->state = 20; - break; - case 20: - sp_256_mont_dbl_9(ctx->t3, ctx->y, p256_mod); - sp_256_mont_sub_9(ctx->x, ctx->x, ctx->t3, p256_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_256_mont_sub_9(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 22; - break; - case 22: - sp_256_mont_mul_9(ctx->y, ctx->y, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 23; - break; - case 23: - sp_256_mont_sub_9(ctx->y, ctx->y, ctx->t5, p256_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 9; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 9; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 9; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Multiply a number by Montgomery normalizer mod modulus (prime). * * @param [out] r The resulting Montgomery form number. @@ -26922,10 +26569,6 @@ static int sp_256_ecc_mulmod_9(sp_point_256* r, const sp_point_256* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_9_ctx { int state; - union { - sp_256_proj_point_dbl_9_ctx dbl_ctx; - sp_256_proj_point_add_9_ctx add_ctx; - }; sp_point_256 t[3]; sp_digit tmp[2 * 9 * 6]; sp_digit n; @@ -27000,39 +26643,34 @@ static int sp_256_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } ctx->y = (ctx->n >> 28) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_256_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_256)); - #else - XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), - sizeof(sp_point_256)); - #endif - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_9(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_256)); + #else + XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), + sizeof(sp_point_256)); + #endif + ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_256)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); - #else - XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], - sizeof(sp_point_256)); - #endif - ctx->state = 4; - ctx->c--; - } + sp_256_proj_point_dbl_9(&ctx->t[2], &ctx->t[2], ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_256)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); + #else + XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], + sizeof(sp_point_256)); + #endif + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -27063,17 +26701,12 @@ static int sp_256_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_9_ctx { int state; - union { - sp_256_proj_point_dbl_9_ctx dbl_ctx; - sp_256_proj_point_add_9_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_256 t[33 + 2]; sp_digit tmp[2 * 9 * 6]; ecc_recode_256 v[43]; int i; - int j; } sp_256_ecc_mulmod_9_ctx; /* Multiply the point by the scalar and return the result. @@ -27099,6 +26732,7 @@ static int sp_256_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_256_ecc_mulmod_9_ctx* ctx = (sp_256_ecc_mulmod_9_ctx*)sp_ctx->data; sp_point_256* rt = &ctx->t[33]; sp_point_256* p = &ctx->t[33 + 1]; @@ -27128,29 +26762,20 @@ static int sp_256_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, err = sp_256_mod_mul_norm_9(ctx->t[1].z, g->z, p256_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_256_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_256_proj_point_dbl_9(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_256_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_256_proj_point_add_9(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -27167,19 +26792,13 @@ static int sp_256_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_256_proj_point_dbl_9(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -27195,22 +26814,16 @@ static int sp_256_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, sp_256_sub_9(negy, p256_mod, p->y); sp_256_norm_9(negy); sp_256_cond_copy_9(p->y, negy, (sp_digit)0 - ctx->v[ctx->i].neg); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_256_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_9(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -28697,10 +28310,6 @@ static int sp_256_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_base_9_ctx { int state; - union { - sp_256_proj_point_dbl_9_ctx dbl_ctx; - sp_256_proj_point_add_9_ctx add_ctx; - }; sp_point_256 rt; sp_point_256 p; sp_digit tmp[2 * 9 * 6]; @@ -28766,15 +28375,11 @@ static int sp_256_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->y; ctx->i = 30; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_256_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_256_proj_point_dbl_9(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -28794,21 +28399,16 @@ static int sp_256_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMCPY(p->y, p256_table[ctx->y].y, sizeof(p->y[0]) * 9); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_256_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_256_proj_point_add_qz1_9(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -29563,7 +29163,8 @@ typedef struct sp_256_mont_inv_order_9_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -29574,6 +29175,7 @@ static int sp_256_mont_inv_order_9_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_256_mont_inv_order_9_ctx* ctx = (sp_256_mont_inv_order_9_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_256_mont_inv_order_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -29586,17 +29188,17 @@ static int sp_256_mont_inv_order_9_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_256_mont_sqr_order_9(t, t); - ctx->state = 2; - break; - case 2: - if ((p256_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_256_mont_mul_order_9(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_256_mont_sqr_order_9(t, t); + if ((p256_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_256_mont_mul_order_9(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 9U); err = MP_OKAY; break; @@ -30415,8 +30017,6 @@ typedef struct sp_ecc_verify_256_ctx { union { sp_256_ecc_mulmod_9_ctx mulmod_ctx; sp_256_mont_inv_order_9_ctx mont_inv_order_ctx; - sp_256_proj_point_dbl_9_ctx dbl_ctx; - sp_256_proj_point_add_9_ctx add_ctx; }; sp_digit u1[2*9]; sp_digit u2[2*9]; @@ -30518,14 +30118,12 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_256_iszero_9(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_256_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_256_proj_point_add_9(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -30580,6 +30178,9 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_256_ctx)); + } return err; } @@ -32737,151 +32338,6 @@ static void sp_384_proj_point_dbl_15(sp_point_384* r, const sp_point_384* p, sp_384_mont_sub_15(y, y, t2, p384_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_dbl_15_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_dbl_15_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_dbl_15_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_dbl_15_ctx* ctx = (sp_384_proj_point_dbl_15_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_dbl_15_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*15; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_384_mont_sqr_15(ctx->t1, p->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_384_mont_mul_15(ctx->z, p->y, p->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_384_mont_dbl_15(ctx->z, ctx->z, p384_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_384_mont_sub_15(ctx->t2, p->x, ctx->t1, p384_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_384_mont_add_15(ctx->t1, p->x, ctx->t1, p384_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_384_mont_mul_15(ctx->t2, ctx->t1, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_384_mont_tpl_15(ctx->t1, ctx->t2, p384_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_384_mont_dbl_15(ctx->y, p->y, p384_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_384_mont_sqr_15(ctx->y, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_384_mont_sqr_15(ctx->t2, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_384_mont_div2_15(ctx->t2, ctx->t2, p384_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_384_mont_mul_15(ctx->y, ctx->y, p->x, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_384_mont_sqr_15(ctx->x, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_384_mont_sub_15(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_384_mont_sub_15(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_384_mont_sub_15(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_384_mont_mul_15(ctx->y, ctx->y, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_384_mont_sub_15(ctx->y, ctx->y, ctx->t2, p384_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -32999,214 +32455,6 @@ static void sp_384_proj_point_add_15(sp_point_384* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_add_15_ctx { - int state; - sp_384_proj_point_dbl_15_ctx dbl_ctx; - const sp_point_384* ap[2]; - sp_point_384* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_add_15_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_add_15_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, const sp_point_384* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_add_15_ctx* ctx = (sp_384_proj_point_add_15_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_add_15_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_384* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*15; - ctx->t2 = t + 4*15; - ctx->t3 = t + 6*15; - ctx->t4 = t + 8*15; - ctx->t5 = t + 10*15; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_384_mont_sqr_15(ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - sp_384_mont_mul_15(ctx->t3, ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - sp_384_mont_mul_15(ctx->t1, ctx->t1, p->x, p384_mod, p384_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_384_mont_sqr_15(ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 5; - break; - case 5: - sp_384_mont_mul_15(ctx->t4, ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 6; - break; - case 6: - sp_384_mont_mul_15(ctx->t2, ctx->t2, q->x, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_384_mont_mul_15(ctx->t3, ctx->t3, p->y, p384_mod, p384_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_384_mont_mul_15(ctx->t4, ctx->t4, q->y, p384_mod, p384_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_384_cmp_equal_15(ctx->t2, ctx->t1) & - sp_384_cmp_equal_15(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_384_proj_point_dbl_15(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_384_mont_sub_15(ctx->t2, ctx->t2, ctx->t1, p384_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_384_mont_sub_15(ctx->t4, ctx->t4, ctx->t3, p384_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_384_mont_sqr_15(ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - sp_384_mont_mul_15(ctx->y, ctx->t1, ctx->t5, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - sp_384_mont_mul_15(ctx->t5, ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_384_mont_mul_15(ctx->z, p->z, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 16; - break; - case 16: - sp_384_mont_mul_15(ctx->z, ctx->z, q->z, p384_mod, p384_mp_mod); - ctx->state = 17; - break; - case 17: - sp_384_mont_sqr_15(ctx->x, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - sp_384_mont_sub_15(ctx->x, ctx->x, ctx->t5, p384_mod); - ctx->state = 19; - break; - case 19: - sp_384_mont_mul_15(ctx->t5, ctx->t5, ctx->t3, p384_mod, p384_mp_mod); - ctx->state = 20; - break; - case 20: - sp_384_mont_dbl_15(ctx->t3, ctx->y, p384_mod); - sp_384_mont_sub_15(ctx->x, ctx->x, ctx->t3, p384_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_384_mont_sub_15(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 22; - break; - case 22: - sp_384_mont_mul_15(ctx->y, ctx->y, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 23; - break; - case 23: - sp_384_mont_sub_15(ctx->y, ctx->y, ctx->t5, p384_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 15; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 15; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 15; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Multiply a number by Montgomery normalizer mod modulus (prime). * * @param [out] r The resulting Montgomery form number. @@ -34620,10 +33868,6 @@ static int sp_384_ecc_mulmod_15(sp_point_384* r, const sp_point_384* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_15_ctx { int state; - union { - sp_384_proj_point_dbl_15_ctx dbl_ctx; - sp_384_proj_point_add_15_ctx add_ctx; - }; sp_point_384 t[3]; sp_digit tmp[2 * 15 * 6]; sp_digit n; @@ -34698,39 +33942,34 @@ static int sp_384_ecc_mulmod_15_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } ctx->y = (ctx->n >> 25) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_384_proj_point_add_15_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_384)); - #else - XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), - sizeof(sp_point_384)); - #endif - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_15(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_384)); + #else + XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), + sizeof(sp_point_384)); + #endif + ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_15_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_384)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); - #else - XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], - sizeof(sp_point_384)); - #endif - ctx->state = 4; - ctx->c--; - } + sp_384_proj_point_dbl_15(&ctx->t[2], &ctx->t[2], ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_384)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); + #else + XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], + sizeof(sp_point_384)); + #endif + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -34761,17 +34000,12 @@ static int sp_384_ecc_mulmod_15_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_15_ctx { int state; - union { - sp_384_proj_point_dbl_15_ctx dbl_ctx; - sp_384_proj_point_add_15_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_384 t[33 + 2]; sp_digit tmp[2 * 15 * 6]; ecc_recode_384 v[65]; int i; - int j; } sp_384_ecc_mulmod_15_ctx; /* Multiply the point by the scalar and return the result. @@ -34797,6 +34031,7 @@ static int sp_384_ecc_mulmod_15_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_384_ecc_mulmod_15_ctx* ctx = (sp_384_ecc_mulmod_15_ctx*)sp_ctx->data; sp_point_384* rt = &ctx->t[33]; sp_point_384* p = &ctx->t[33 + 1]; @@ -34826,29 +34061,20 @@ static int sp_384_ecc_mulmod_15_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, err = sp_384_mod_mul_norm_15(ctx->t[1].z, g->z, p384_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_384_proj_point_dbl_15_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_384_proj_point_dbl_15(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_384_proj_point_add_15_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_384_proj_point_add_15(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -34865,19 +34091,13 @@ static int sp_384_ecc_mulmod_15_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_15_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_384_proj_point_dbl_15(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -34893,22 +34113,16 @@ static int sp_384_ecc_mulmod_15_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, sp_384_sub_15(negy, p384_mod, p->y); sp_384_norm_15(negy); sp_384_cond_copy_15(p->y, negy, (sp_digit)0 - ctx->v[ctx->i].neg); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_384_proj_point_add_15_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_15(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -36907,10 +36121,6 @@ static int sp_384_ecc_mulmod_base_15_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_base_15_ctx { int state; - union { - sp_384_proj_point_dbl_15_ctx dbl_ctx; - sp_384_proj_point_add_15_ctx add_ctx; - }; sp_point_384 rt; sp_point_384 p; sp_digit tmp[2 * 15 * 6]; @@ -36976,15 +36186,11 @@ static int sp_384_ecc_mulmod_base_15_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->y; ctx->i = 46; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_384_proj_point_dbl_15_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_384_proj_point_dbl_15(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -37004,21 +36210,16 @@ static int sp_384_ecc_mulmod_base_15_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMCPY(p->y, p384_table[ctx->y].y, sizeof(p->y[0]) * 15); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_384_proj_point_add_15_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_384_proj_point_add_qz1_15(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -37815,7 +37016,8 @@ typedef struct sp_384_mont_inv_order_15_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -37826,6 +37028,7 @@ static int sp_384_mont_inv_order_15_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_384_mont_inv_order_15_ctx* ctx = (sp_384_mont_inv_order_15_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_384_mont_inv_order_15_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -37838,17 +37041,17 @@ static int sp_384_mont_inv_order_15_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const ctx->state = 1; break; case 1: - sp_384_mont_sqr_order_15(t, t); - ctx->state = 2; - break; - case 2: - if ((p384_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_384_mont_mul_order_15(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_384_mont_sqr_order_15(t, t); + if ((p384_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_384_mont_mul_order_15(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 15U); err = MP_OKAY; break; @@ -38640,8 +37843,6 @@ typedef struct sp_ecc_verify_384_ctx { union { sp_384_ecc_mulmod_15_ctx mulmod_ctx; sp_384_mont_inv_order_15_ctx mont_inv_order_ctx; - sp_384_proj_point_dbl_15_ctx dbl_ctx; - sp_384_proj_point_add_15_ctx add_ctx; }; sp_digit u1[2*15]; sp_digit u2[2*15]; @@ -38743,14 +37944,12 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_384_iszero_15(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_384_proj_point_add_15_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_384_proj_point_add_15(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -38805,6 +38004,9 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_384_ctx)); + } return err; } @@ -40563,151 +39765,6 @@ static void sp_521_proj_point_dbl_21(sp_point_521* r, const sp_point_521* p, sp_521_mont_sub_21(y, y, t2, p521_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_dbl_21_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_dbl_21_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_dbl_21_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_dbl_21_ctx* ctx = (sp_521_proj_point_dbl_21_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_dbl_21_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*21; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_521_mont_sqr_21(ctx->t1, p->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_521_mont_mul_21(ctx->z, p->y, p->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_521_mont_dbl_21(ctx->z, ctx->z, p521_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_521_mont_sub_21(ctx->t2, p->x, ctx->t1, p521_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_521_mont_add_21(ctx->t1, p->x, ctx->t1, p521_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_521_mont_mul_21(ctx->t2, ctx->t1, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_521_mont_tpl_21(ctx->t1, ctx->t2, p521_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_521_mont_dbl_21(ctx->y, p->y, p521_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_521_mont_sqr_21(ctx->y, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_521_mont_sqr_21(ctx->t2, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_521_mont_div2_21(ctx->t2, ctx->t2, p521_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_521_mont_mul_21(ctx->y, ctx->y, p->x, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_521_mont_sqr_21(ctx->x, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_521_mont_sub_21(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_521_mont_sub_21(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_521_mont_sub_21(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_521_mont_mul_21(ctx->y, ctx->y, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_521_mont_sub_21(ctx->y, ctx->y, ctx->t2, p521_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -40828,214 +39885,6 @@ static void sp_521_proj_point_add_21(sp_point_521* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_add_21_ctx { - int state; - sp_521_proj_point_dbl_21_ctx dbl_ctx; - const sp_point_521* ap[2]; - sp_point_521* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_add_21_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_add_21_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, const sp_point_521* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_add_21_ctx* ctx = (sp_521_proj_point_add_21_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_add_21_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_521* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*21; - ctx->t2 = t + 4*21; - ctx->t3 = t + 6*21; - ctx->t4 = t + 8*21; - ctx->t5 = t + 10*21; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_521_mont_sqr_21(ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - sp_521_mont_mul_21(ctx->t3, ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - sp_521_mont_mul_21(ctx->t1, ctx->t1, p->x, p521_mod, p521_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_521_mont_sqr_21(ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 5; - break; - case 5: - sp_521_mont_mul_21(ctx->t4, ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 6; - break; - case 6: - sp_521_mont_mul_21(ctx->t2, ctx->t2, q->x, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_521_mont_mul_21(ctx->t3, ctx->t3, p->y, p521_mod, p521_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_521_mont_mul_21(ctx->t4, ctx->t4, q->y, p521_mod, p521_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_521_cmp_equal_21(ctx->t2, ctx->t1) & - sp_521_cmp_equal_21(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_521_proj_point_dbl_21(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_521_mont_sub_21(ctx->t2, ctx->t2, ctx->t1, p521_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_521_mont_sub_21(ctx->t4, ctx->t4, ctx->t3, p521_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_521_mont_sqr_21(ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - sp_521_mont_mul_21(ctx->y, ctx->t1, ctx->t5, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - sp_521_mont_mul_21(ctx->t5, ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_521_mont_mul_21(ctx->z, p->z, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 16; - break; - case 16: - sp_521_mont_mul_21(ctx->z, ctx->z, q->z, p521_mod, p521_mp_mod); - ctx->state = 17; - break; - case 17: - sp_521_mont_sqr_21(ctx->x, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - sp_521_mont_sub_21(ctx->x, ctx->x, ctx->t5, p521_mod); - ctx->state = 19; - break; - case 19: - sp_521_mont_mul_21(ctx->t5, ctx->t5, ctx->t3, p521_mod, p521_mp_mod); - ctx->state = 20; - break; - case 20: - sp_521_mont_dbl_21(ctx->t3, ctx->y, p521_mod); - sp_521_mont_sub_21(ctx->x, ctx->x, ctx->t3, p521_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_521_mont_sub_21(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 22; - break; - case 22: - sp_521_mont_mul_21(ctx->y, ctx->y, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 23; - break; - case 23: - sp_521_mont_sub_21(ctx->y, ctx->y, ctx->t5, p521_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 21; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 21; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 21; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Multiply a number by Montgomery normalizer mod modulus (prime). * * @param [out] r The resulting Montgomery form number. @@ -42383,10 +41232,6 @@ static int sp_521_ecc_mulmod_21(sp_point_521* r, const sp_point_521* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_21_ctx { int state; - union { - sp_521_proj_point_dbl_21_ctx dbl_ctx; - sp_521_proj_point_add_21_ctx add_ctx; - }; sp_point_521 t[3]; sp_digit tmp[2 * 21 * 6]; sp_digit n; @@ -42461,39 +41306,34 @@ static int sp_521_ecc_mulmod_21_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } ctx->y = (ctx->n >> 24) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_521_proj_point_add_21_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_521)); - #else - XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), - sizeof(sp_point_521)); - #endif - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_21(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_521)); + #else + XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), + sizeof(sp_point_521)); + #endif + ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_21_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_521)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); - #else - XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], - sizeof(sp_point_521)); - #endif - ctx->state = 4; - ctx->c--; - } + sp_521_proj_point_dbl_21(&ctx->t[2], &ctx->t[2], ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_521)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); + #else + XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], + sizeof(sp_point_521)); + #endif + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -42524,17 +41364,12 @@ static int sp_521_ecc_mulmod_21_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_21_ctx { int state; - union { - sp_521_proj_point_dbl_21_ctx dbl_ctx; - sp_521_proj_point_add_21_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_521 t[33 + 2]; sp_digit tmp[2 * 21 * 6]; ecc_recode_521 v[87]; int i; - int j; } sp_521_ecc_mulmod_21_ctx; /* Multiply the point by the scalar and return the result. @@ -42560,6 +41395,7 @@ static int sp_521_ecc_mulmod_21_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_521_ecc_mulmod_21_ctx* ctx = (sp_521_ecc_mulmod_21_ctx*)sp_ctx->data; sp_point_521* rt = &ctx->t[33]; sp_point_521* p = &ctx->t[33 + 1]; @@ -42589,29 +41425,20 @@ static int sp_521_ecc_mulmod_21_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, err = sp_521_mod_mul_norm_21(ctx->t[1].z, g->z, p521_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_521_proj_point_dbl_21_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_521_proj_point_dbl_21(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_521_proj_point_add_21_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_521_proj_point_add_21(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -42628,19 +41455,13 @@ static int sp_521_ecc_mulmod_21_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_21_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_521_proj_point_dbl_21(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -42656,22 +41477,16 @@ static int sp_521_ecc_mulmod_21_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, sp_521_sub_21(negy, p521_mod, p->y); sp_521_norm_21(negy); sp_521_cond_copy_21(p->y, negy, (sp_digit)0 - ctx->v[ctx->i].neg); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_521_proj_point_add_21_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_21(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -45180,10 +43995,6 @@ static int sp_521_ecc_mulmod_base_21_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_base_21_ctx { int state; - union { - sp_521_proj_point_dbl_21_ctx dbl_ctx; - sp_521_proj_point_add_21_ctx add_ctx; - }; sp_point_521 rt; sp_point_521 p; sp_digit tmp[2 * 21 * 6]; @@ -45249,15 +44060,11 @@ static int sp_521_ecc_mulmod_base_21_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->y; ctx->i = 64; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_521_proj_point_dbl_21_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_521_proj_point_dbl_21(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -45277,21 +44084,16 @@ static int sp_521_ecc_mulmod_base_21_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMCPY(p->y, p521_table[ctx->y].y, sizeof(p->y[0]) * 21); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_521_proj_point_add_21_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_521_proj_point_add_qz1_21(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -46111,7 +44913,8 @@ typedef struct sp_521_mont_inv_order_21_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -46122,6 +44925,7 @@ static int sp_521_mont_inv_order_21_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_521_mont_inv_order_21_ctx* ctx = (sp_521_mont_inv_order_21_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_521_mont_inv_order_21_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -46134,17 +44938,17 @@ static int sp_521_mont_inv_order_21_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const ctx->state = 1; break; case 1: - sp_521_mont_sqr_order_21(t, t); - ctx->state = 2; - break; - case 2: - if ((p521_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_521_mont_mul_order_21(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_521_mont_sqr_order_21(t, t); + if ((p521_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_521_mont_mul_order_21(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 21U); err = MP_OKAY; break; @@ -46970,8 +45774,6 @@ typedef struct sp_ecc_verify_521_ctx { union { sp_521_ecc_mulmod_21_ctx mulmod_ctx; sp_521_mont_inv_order_21_ctx mont_inv_order_ctx; - sp_521_proj_point_dbl_21_ctx dbl_ctx; - sp_521_proj_point_add_21_ctx add_ctx; }; sp_digit u1[2*21]; sp_digit u2[2*21]; @@ -47077,14 +45879,12 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_521_iszero_21(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_521_proj_point_add_21_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_521_proj_point_add_21(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -47139,6 +45939,9 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_521_ctx)); + } return err; } diff --git a/wolfcrypt/src/sp_c64.c b/wolfcrypt/src/sp_c64.c index 93da67e2df6..3a20529a193 100644 --- a/wolfcrypt/src/sp_c64.c +++ b/wolfcrypt/src/sp_c64.c @@ -26494,151 +26494,6 @@ static void sp_256_proj_point_dbl_5(sp_point_256* r, const sp_point_256* p, sp_256_mont_sub_5(y, y, t2, p256_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_dbl_5_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_dbl_5_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_dbl_5_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_dbl_5_ctx* ctx = (sp_256_proj_point_dbl_5_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_dbl_5_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*5; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_256_mont_sqr_5(ctx->t1, p->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_256_mont_mul_5(ctx->z, p->y, p->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_256_mont_dbl_5(ctx->z, ctx->z, p256_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_256_mont_sub_5(ctx->t2, p->x, ctx->t1, p256_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_256_mont_add_5(ctx->t1, p->x, ctx->t1, p256_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_256_mont_mul_5(ctx->t2, ctx->t1, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_256_mont_tpl_5(ctx->t1, ctx->t2, p256_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_256_mont_dbl_5(ctx->y, p->y, p256_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_256_mont_sqr_5(ctx->y, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_256_mont_sqr_5(ctx->t2, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_256_mont_div2_5(ctx->t2, ctx->t2, p256_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_256_mont_mul_5(ctx->y, ctx->y, p->x, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_256_mont_sqr_5(ctx->x, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_256_mont_sub_5(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_256_mont_sub_5(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_256_mont_sub_5(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_256_mont_mul_5(ctx->y, ctx->y, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_256_mont_sub_5(ctx->y, ctx->y, ctx->t2, p256_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -26752,214 +26607,6 @@ static void sp_256_proj_point_add_5(sp_point_256* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_add_5_ctx { - int state; - sp_256_proj_point_dbl_5_ctx dbl_ctx; - const sp_point_256* ap[2]; - sp_point_256* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_add_5_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_add_5_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, const sp_point_256* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_add_5_ctx* ctx = (sp_256_proj_point_add_5_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_add_5_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_256* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*5; - ctx->t2 = t + 4*5; - ctx->t3 = t + 6*5; - ctx->t4 = t + 8*5; - ctx->t5 = t + 10*5; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_256_mont_sqr_5(ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - sp_256_mont_mul_5(ctx->t3, ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - sp_256_mont_mul_5(ctx->t1, ctx->t1, p->x, p256_mod, p256_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_256_mont_sqr_5(ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 5; - break; - case 5: - sp_256_mont_mul_5(ctx->t4, ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 6; - break; - case 6: - sp_256_mont_mul_5(ctx->t2, ctx->t2, q->x, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_256_mont_mul_5(ctx->t3, ctx->t3, p->y, p256_mod, p256_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_256_mont_mul_5(ctx->t4, ctx->t4, q->y, p256_mod, p256_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_256_cmp_equal_5(ctx->t2, ctx->t1) & - sp_256_cmp_equal_5(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_256_proj_point_dbl_5(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_256_mont_sub_5(ctx->t2, ctx->t2, ctx->t1, p256_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_256_mont_sub_5(ctx->t4, ctx->t4, ctx->t3, p256_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_256_mont_sqr_5(ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - sp_256_mont_mul_5(ctx->y, ctx->t1, ctx->t5, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - sp_256_mont_mul_5(ctx->t5, ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_256_mont_mul_5(ctx->z, p->z, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 16; - break; - case 16: - sp_256_mont_mul_5(ctx->z, ctx->z, q->z, p256_mod, p256_mp_mod); - ctx->state = 17; - break; - case 17: - sp_256_mont_sqr_5(ctx->x, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - sp_256_mont_sub_5(ctx->x, ctx->x, ctx->t5, p256_mod); - ctx->state = 19; - break; - case 19: - sp_256_mont_mul_5(ctx->t5, ctx->t5, ctx->t3, p256_mod, p256_mp_mod); - ctx->state = 20; - break; - case 20: - sp_256_mont_dbl_5(ctx->t3, ctx->y, p256_mod); - sp_256_mont_sub_5(ctx->x, ctx->x, ctx->t3, p256_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_256_mont_sub_5(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 22; - break; - case 22: - sp_256_mont_mul_5(ctx->y, ctx->y, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 23; - break; - case 23: - sp_256_mont_sub_5(ctx->y, ctx->y, ctx->t5, p256_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 5; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 5; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 5; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Multiply a number by Montgomery normalizer mod modulus (prime). * * @param [out] r The resulting Montgomery form number. @@ -28194,10 +27841,6 @@ static int sp_256_ecc_mulmod_5(sp_point_256* r, const sp_point_256* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_5_ctx { int state; - union { - sp_256_proj_point_dbl_5_ctx dbl_ctx; - sp_256_proj_point_add_5_ctx add_ctx; - }; sp_point_256 t[3]; sp_digit tmp[2 * 5 * 6]; sp_digit n; @@ -28272,39 +27915,34 @@ static int sp_256_ecc_mulmod_5_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } ctx->y = (ctx->n >> 51) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_256_proj_point_add_5_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_256)); - #else - XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), - sizeof(sp_point_256)); - #endif - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_5(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_256)); + #else + XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), + sizeof(sp_point_256)); + #endif + ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_5_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_256)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); - #else - XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], - sizeof(sp_point_256)); - #endif - ctx->state = 4; - ctx->c--; - } + sp_256_proj_point_dbl_5(&ctx->t[2], &ctx->t[2], ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_256)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); + #else + XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], + sizeof(sp_point_256)); + #endif + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -28335,17 +27973,12 @@ static int sp_256_ecc_mulmod_5_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_5_ctx { int state; - union { - sp_256_proj_point_dbl_5_ctx dbl_ctx; - sp_256_proj_point_add_5_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_256 t[33 + 2]; sp_digit tmp[2 * 5 * 6]; ecc_recode_256 v[43]; int i; - int j; } sp_256_ecc_mulmod_5_ctx; /* Multiply the point by the scalar and return the result. @@ -28371,6 +28004,7 @@ static int sp_256_ecc_mulmod_5_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_256_ecc_mulmod_5_ctx* ctx = (sp_256_ecc_mulmod_5_ctx*)sp_ctx->data; sp_point_256* rt = &ctx->t[33]; sp_point_256* p = &ctx->t[33 + 1]; @@ -28400,29 +28034,20 @@ static int sp_256_ecc_mulmod_5_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, err = sp_256_mod_mul_norm_5(ctx->t[1].z, g->z, p256_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_256_proj_point_dbl_5_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_256_proj_point_dbl_5(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_256_proj_point_add_5_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_256_proj_point_add_5(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -28439,19 +28064,13 @@ static int sp_256_ecc_mulmod_5_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_5_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_256_proj_point_dbl_5(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -28467,22 +28086,16 @@ static int sp_256_ecc_mulmod_5_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, sp_256_sub_5(negy, p256_mod, p->y); sp_256_norm_5(negy); sp_256_cond_copy_5(p->y, negy, (sp_digit)0 - ctx->v[ctx->i].neg); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_256_proj_point_add_5_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_5(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -29969,10 +29582,6 @@ static int sp_256_ecc_mulmod_base_5_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_base_5_ctx { int state; - union { - sp_256_proj_point_dbl_5_ctx dbl_ctx; - sp_256_proj_point_add_5_ctx add_ctx; - }; sp_point_256 rt; sp_point_256 p; sp_digit tmp[2 * 5 * 6]; @@ -30038,15 +29647,11 @@ static int sp_256_ecc_mulmod_base_5_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->y; ctx->i = 30; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_256_proj_point_dbl_5_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_256_proj_point_dbl_5(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -30066,21 +29671,16 @@ static int sp_256_ecc_mulmod_base_5_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMCPY(p->y, p256_table[ctx->y].y, sizeof(p->y[0]) * 5); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_256_proj_point_add_5_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_256_proj_point_add_qz1_5(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -30819,7 +30419,8 @@ typedef struct sp_256_mont_inv_order_5_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -30830,6 +30431,7 @@ static int sp_256_mont_inv_order_5_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_256_mont_inv_order_5_ctx* ctx = (sp_256_mont_inv_order_5_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_256_mont_inv_order_5_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -30842,17 +30444,17 @@ static int sp_256_mont_inv_order_5_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_256_mont_sqr_order_5(t, t); - ctx->state = 2; - break; - case 2: - if ((p256_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_256_mont_mul_order_5(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_256_mont_sqr_order_5(t, t); + if ((p256_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_256_mont_mul_order_5(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 5U); err = MP_OKAY; break; @@ -31672,8 +31274,6 @@ typedef struct sp_ecc_verify_256_ctx { union { sp_256_ecc_mulmod_5_ctx mulmod_ctx; sp_256_mont_inv_order_5_ctx mont_inv_order_ctx; - sp_256_proj_point_dbl_5_ctx dbl_ctx; - sp_256_proj_point_add_5_ctx add_ctx; }; sp_digit u1[2*5]; sp_digit u2[2*5]; @@ -31775,14 +31375,12 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_256_iszero_5(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_256_proj_point_add_5_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_256_proj_point_add_5(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -31837,6 +31435,9 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_256_ctx)); + } return err; } @@ -33560,151 +33161,6 @@ static void sp_384_proj_point_dbl_7(sp_point_384* r, const sp_point_384* p, sp_384_mont_sub_7(y, y, t2, p384_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_dbl_7_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_dbl_7_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_dbl_7_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_dbl_7_ctx* ctx = (sp_384_proj_point_dbl_7_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_dbl_7_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*7; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_384_mont_sqr_7(ctx->t1, p->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_384_mont_mul_7(ctx->z, p->y, p->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_384_mont_dbl_7(ctx->z, ctx->z, p384_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_384_mont_sub_7(ctx->t2, p->x, ctx->t1, p384_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_384_mont_add_7(ctx->t1, p->x, ctx->t1, p384_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_384_mont_mul_7(ctx->t2, ctx->t1, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_384_mont_tpl_7(ctx->t1, ctx->t2, p384_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_384_mont_dbl_7(ctx->y, p->y, p384_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_384_mont_sqr_7(ctx->y, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_384_mont_sqr_7(ctx->t2, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_384_mont_div2_7(ctx->t2, ctx->t2, p384_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_384_mont_mul_7(ctx->y, ctx->y, p->x, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_384_mont_sqr_7(ctx->x, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_384_mont_sub_7(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_384_mont_sub_7(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_384_mont_sub_7(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_384_mont_mul_7(ctx->y, ctx->y, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_384_mont_sub_7(ctx->y, ctx->y, ctx->t2, p384_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -33819,214 +33275,6 @@ static void sp_384_proj_point_add_7(sp_point_384* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_add_7_ctx { - int state; - sp_384_proj_point_dbl_7_ctx dbl_ctx; - const sp_point_384* ap[2]; - sp_point_384* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_add_7_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_add_7_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, const sp_point_384* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_add_7_ctx* ctx = (sp_384_proj_point_add_7_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_add_7_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_384* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*7; - ctx->t2 = t + 4*7; - ctx->t3 = t + 6*7; - ctx->t4 = t + 8*7; - ctx->t5 = t + 10*7; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_384_mont_sqr_7(ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - sp_384_mont_mul_7(ctx->t3, ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - sp_384_mont_mul_7(ctx->t1, ctx->t1, p->x, p384_mod, p384_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_384_mont_sqr_7(ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 5; - break; - case 5: - sp_384_mont_mul_7(ctx->t4, ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 6; - break; - case 6: - sp_384_mont_mul_7(ctx->t2, ctx->t2, q->x, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_384_mont_mul_7(ctx->t3, ctx->t3, p->y, p384_mod, p384_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_384_mont_mul_7(ctx->t4, ctx->t4, q->y, p384_mod, p384_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_384_cmp_equal_7(ctx->t2, ctx->t1) & - sp_384_cmp_equal_7(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_384_proj_point_dbl_7(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_384_mont_sub_7(ctx->t2, ctx->t2, ctx->t1, p384_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_384_mont_sub_7(ctx->t4, ctx->t4, ctx->t3, p384_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_384_mont_sqr_7(ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - sp_384_mont_mul_7(ctx->y, ctx->t1, ctx->t5, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - sp_384_mont_mul_7(ctx->t5, ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_384_mont_mul_7(ctx->z, p->z, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 16; - break; - case 16: - sp_384_mont_mul_7(ctx->z, ctx->z, q->z, p384_mod, p384_mp_mod); - ctx->state = 17; - break; - case 17: - sp_384_mont_sqr_7(ctx->x, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - sp_384_mont_sub_7(ctx->x, ctx->x, ctx->t5, p384_mod); - ctx->state = 19; - break; - case 19: - sp_384_mont_mul_7(ctx->t5, ctx->t5, ctx->t3, p384_mod, p384_mp_mod); - ctx->state = 20; - break; - case 20: - sp_384_mont_dbl_7(ctx->t3, ctx->y, p384_mod); - sp_384_mont_sub_7(ctx->x, ctx->x, ctx->t3, p384_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_384_mont_sub_7(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 22; - break; - case 22: - sp_384_mont_mul_7(ctx->y, ctx->y, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 23; - break; - case 23: - sp_384_mont_sub_7(ctx->y, ctx->y, ctx->t5, p384_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 7; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 7; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 7; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Multiply a number by Montgomery normalizer mod modulus (prime). * * @param [out] r The resulting Montgomery form number. @@ -35317,10 +34565,6 @@ static int sp_384_ecc_mulmod_7(sp_point_384* r, const sp_point_384* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_7_ctx { int state; - union { - sp_384_proj_point_dbl_7_ctx dbl_ctx; - sp_384_proj_point_add_7_ctx add_ctx; - }; sp_point_384 t[3]; sp_digit tmp[2 * 7 * 6]; sp_digit n; @@ -35395,39 +34639,34 @@ static int sp_384_ecc_mulmod_7_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } ctx->y = (ctx->n >> 54) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_384_proj_point_add_7_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_384)); - #else - XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), - sizeof(sp_point_384)); - #endif - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_7(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_384)); + #else + XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), + sizeof(sp_point_384)); + #endif + ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_7_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_384)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); - #else - XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], - sizeof(sp_point_384)); - #endif - ctx->state = 4; - ctx->c--; - } + sp_384_proj_point_dbl_7(&ctx->t[2], &ctx->t[2], ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_384)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); + #else + XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], + sizeof(sp_point_384)); + #endif + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -35458,17 +34697,12 @@ static int sp_384_ecc_mulmod_7_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_7_ctx { int state; - union { - sp_384_proj_point_dbl_7_ctx dbl_ctx; - sp_384_proj_point_add_7_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_384 t[33 + 2]; sp_digit tmp[2 * 7 * 6]; ecc_recode_384 v[65]; int i; - int j; } sp_384_ecc_mulmod_7_ctx; /* Multiply the point by the scalar and return the result. @@ -35494,6 +34728,7 @@ static int sp_384_ecc_mulmod_7_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_384_ecc_mulmod_7_ctx* ctx = (sp_384_ecc_mulmod_7_ctx*)sp_ctx->data; sp_point_384* rt = &ctx->t[33]; sp_point_384* p = &ctx->t[33 + 1]; @@ -35523,29 +34758,20 @@ static int sp_384_ecc_mulmod_7_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, err = sp_384_mod_mul_norm_7(ctx->t[1].z, g->z, p384_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_384_proj_point_dbl_7_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_384_proj_point_dbl_7(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_384_proj_point_add_7_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_384_proj_point_add_7(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -35562,19 +34788,13 @@ static int sp_384_ecc_mulmod_7_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_7_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_384_proj_point_dbl_7(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -35590,22 +34810,16 @@ static int sp_384_ecc_mulmod_7_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, sp_384_sub_7(negy, p384_mod, p->y); sp_384_norm_7(negy); sp_384_cond_copy_7(p->y, negy, (sp_digit)0 - ctx->v[ctx->i].neg); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_384_proj_point_add_7_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_7(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -37602,10 +36816,6 @@ static int sp_384_ecc_mulmod_base_7_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_base_7_ctx { int state; - union { - sp_384_proj_point_dbl_7_ctx dbl_ctx; - sp_384_proj_point_add_7_ctx add_ctx; - }; sp_point_384 rt; sp_point_384 p; sp_digit tmp[2 * 7 * 6]; @@ -37671,15 +36881,11 @@ static int sp_384_ecc_mulmod_base_7_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->y; ctx->i = 46; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_384_proj_point_dbl_7_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_384_proj_point_dbl_7(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -37699,21 +36905,16 @@ static int sp_384_ecc_mulmod_base_7_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMCPY(p->y, p384_table[ctx->y].y, sizeof(p->y[0]) * 7); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_384_proj_point_add_7_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_384_proj_point_add_qz1_7(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -38462,7 +37663,8 @@ typedef struct sp_384_mont_inv_order_7_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -38473,6 +37675,7 @@ static int sp_384_mont_inv_order_7_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_384_mont_inv_order_7_ctx* ctx = (sp_384_mont_inv_order_7_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_384_mont_inv_order_7_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -38485,17 +37688,17 @@ static int sp_384_mont_inv_order_7_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_384_mont_sqr_order_7(t, t); - ctx->state = 2; - break; - case 2: - if ((p384_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_384_mont_mul_order_7(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_384_mont_sqr_order_7(t, t); + if ((p384_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_384_mont_mul_order_7(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 7U); err = MP_OKAY; break; @@ -39284,8 +38487,6 @@ typedef struct sp_ecc_verify_384_ctx { union { sp_384_ecc_mulmod_7_ctx mulmod_ctx; sp_384_mont_inv_order_7_ctx mont_inv_order_ctx; - sp_384_proj_point_dbl_7_ctx dbl_ctx; - sp_384_proj_point_add_7_ctx add_ctx; }; sp_digit u1[2*7]; sp_digit u2[2*7]; @@ -39387,14 +38588,12 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_384_iszero_7(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_384_proj_point_add_7_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_384_proj_point_add_7(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -39449,6 +38648,9 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_384_ctx)); + } return err; } @@ -41247,151 +40449,6 @@ static void sp_521_proj_point_dbl_9(sp_point_521* r, const sp_point_521* p, sp_521_mont_sub_9(y, y, t2, p521_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_dbl_9_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_dbl_9_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_dbl_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_dbl_9_ctx* ctx = (sp_521_proj_point_dbl_9_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_dbl_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*9; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_521_mont_sqr_9(ctx->t1, p->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_521_mont_mul_9(ctx->z, p->y, p->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_521_mont_dbl_9(ctx->z, ctx->z, p521_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_521_mont_sub_9(ctx->t2, p->x, ctx->t1, p521_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_521_mont_add_9(ctx->t1, p->x, ctx->t1, p521_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_521_mont_mul_9(ctx->t2, ctx->t1, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_521_mont_tpl_9(ctx->t1, ctx->t2, p521_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_521_mont_dbl_9(ctx->y, p->y, p521_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_521_mont_sqr_9(ctx->y, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_521_mont_sqr_9(ctx->t2, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_521_mont_div2_9(ctx->t2, ctx->t2, p521_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_521_mont_mul_9(ctx->y, ctx->y, p->x, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_521_mont_sqr_9(ctx->x, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_521_mont_mul_9(ctx->y, ctx->y, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->t2, p521_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -41507,214 +40564,6 @@ static void sp_521_proj_point_add_9(sp_point_521* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_add_9_ctx { - int state; - sp_521_proj_point_dbl_9_ctx dbl_ctx; - const sp_point_521* ap[2]; - sp_point_521* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_add_9_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_add_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, const sp_point_521* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_add_9_ctx* ctx = (sp_521_proj_point_add_9_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_add_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_521* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*9; - ctx->t2 = t + 4*9; - ctx->t3 = t + 6*9; - ctx->t4 = t + 8*9; - ctx->t5 = t + 10*9; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_521_mont_sqr_9(ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - sp_521_mont_mul_9(ctx->t3, ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - sp_521_mont_mul_9(ctx->t1, ctx->t1, p->x, p521_mod, p521_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_521_mont_sqr_9(ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 5; - break; - case 5: - sp_521_mont_mul_9(ctx->t4, ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 6; - break; - case 6: - sp_521_mont_mul_9(ctx->t2, ctx->t2, q->x, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_521_mont_mul_9(ctx->t3, ctx->t3, p->y, p521_mod, p521_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_521_mont_mul_9(ctx->t4, ctx->t4, q->y, p521_mod, p521_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_521_cmp_equal_9(ctx->t2, ctx->t1) & - sp_521_cmp_equal_9(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_521_proj_point_dbl_9(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_521_mont_sub_9(ctx->t2, ctx->t2, ctx->t1, p521_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_521_mont_sub_9(ctx->t4, ctx->t4, ctx->t3, p521_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_521_mont_sqr_9(ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - sp_521_mont_mul_9(ctx->y, ctx->t1, ctx->t5, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - sp_521_mont_mul_9(ctx->t5, ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_521_mont_mul_9(ctx->z, p->z, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 16; - break; - case 16: - sp_521_mont_mul_9(ctx->z, ctx->z, q->z, p521_mod, p521_mp_mod); - ctx->state = 17; - break; - case 17: - sp_521_mont_sqr_9(ctx->x, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->t5, p521_mod); - ctx->state = 19; - break; - case 19: - sp_521_mont_mul_9(ctx->t5, ctx->t5, ctx->t3, p521_mod, p521_mp_mod); - ctx->state = 20; - break; - case 20: - sp_521_mont_dbl_9(ctx->t3, ctx->y, p521_mod); - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->t3, p521_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 22; - break; - case 22: - sp_521_mont_mul_9(ctx->y, ctx->y, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 23; - break; - case 23: - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->t5, p521_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 9; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 9; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 9; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Multiply a number by Montgomery normalizer mod modulus (prime). * * @param [out] r The resulting Montgomery form number. @@ -42918,10 +41767,6 @@ static int sp_521_ecc_mulmod_9(sp_point_521* r, const sp_point_521* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; sp_point_521 t[3]; sp_digit tmp[2 * 9 * 6]; sp_digit n; @@ -42996,39 +41841,34 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } ctx->y = (ctx->n >> 57) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_521)); - #else - XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), - sizeof(sp_point_521)); - #endif - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_9(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_521)); + #else + XMEMCPY(&ctx->t[2], (void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), + sizeof(sp_point_521)); + #endif + ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - #ifdef WC_NO_PTR_INT_CAST - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_521)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); - #else - XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + - ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], - sizeof(sp_point_521)); - #endif - ctx->state = 4; - ctx->c--; - } + sp_521_proj_point_dbl_9(&ctx->t[2], &ctx->t[2], ctx->tmp); + #ifdef WC_NO_PTR_INT_CAST + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_521)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); + #else + XMEMCPY((void*)(((size_t)&ctx->t[0] & addr_mask[ctx->y^1]) + + ((size_t)&ctx->t[1] & addr_mask[ctx->y])), &ctx->t[2], + sizeof(sp_point_521)); + #endif + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -43059,17 +41899,12 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_521 t[33 + 2]; sp_digit tmp[2 * 9 * 6]; ecc_recode_521 v[87]; int i; - int j; } sp_521_ecc_mulmod_9_ctx; /* Multiply the point by the scalar and return the result. @@ -43095,6 +41930,7 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_521_ecc_mulmod_9_ctx* ctx = (sp_521_ecc_mulmod_9_ctx*)sp_ctx->data; sp_point_521* rt = &ctx->t[33]; sp_point_521* p = &ctx->t[33 + 1]; @@ -43124,29 +41960,20 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, err = sp_521_mod_mul_norm_9(ctx->t[1].z, g->z, p521_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_521_proj_point_dbl_9(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_521_proj_point_add_9(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -43163,19 +41990,13 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_521_proj_point_dbl_9(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -43191,22 +42012,16 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, sp_521_sub_9(negy, p521_mod, p->y); sp_521_norm_9(negy); sp_521_cond_copy_9(p->y, negy, (sp_digit)0 - ctx->v[ctx->i].neg); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_9(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -45203,10 +44018,6 @@ static int sp_521_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_base_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; sp_point_521 rt; sp_point_521 p; sp_digit tmp[2 * 9 * 6]; @@ -45272,15 +44083,11 @@ static int sp_521_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->y; ctx->i = 64; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_521_proj_point_dbl_9(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -45300,21 +44107,16 @@ static int sp_521_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMCPY(p->y, p521_table[ctx->y].y, sizeof(p->y[0]) * 9); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_521_proj_point_add_qz1_9(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -46072,7 +44874,8 @@ typedef struct sp_521_mont_inv_order_9_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -46083,6 +44886,7 @@ static int sp_521_mont_inv_order_9_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_521_mont_inv_order_9_ctx* ctx = (sp_521_mont_inv_order_9_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_521_mont_inv_order_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -46095,17 +44899,17 @@ static int sp_521_mont_inv_order_9_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_521_mont_sqr_order_9(t, t); - ctx->state = 2; - break; - case 2: - if ((p521_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_521_mont_mul_order_9(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_521_mont_sqr_order_9(t, t); + if ((p521_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_521_mont_mul_order_9(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 9U); err = MP_OKAY; break; @@ -46924,8 +45728,6 @@ typedef struct sp_ecc_verify_521_ctx { union { sp_521_ecc_mulmod_9_ctx mulmod_ctx; sp_521_mont_inv_order_9_ctx mont_inv_order_ctx; - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; }; sp_digit u1[2*9]; sp_digit u2[2*9]; @@ -47031,14 +45833,12 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_521_iszero_9(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_521_proj_point_add_9(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -47093,6 +45893,9 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_521_ctx)); + } return err; } diff --git a/wolfcrypt/src/sp_cortexm.c b/wolfcrypt/src/sp_cortexm.c index 2c6b8a26b7c..86534991b9a 100644 --- a/wolfcrypt/src/sp_cortexm.c +++ b/wolfcrypt/src/sp_cortexm.c @@ -40332,151 +40332,6 @@ static void sp_256_proj_point_dbl_8(sp_point_256* r, const sp_point_256* p, sp_256_mont_sub_8(y, y, t2, p256_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_dbl_8_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_dbl_8_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_dbl_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_dbl_8_ctx* ctx = (sp_256_proj_point_dbl_8_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_dbl_8_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*8; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_256_mont_sqr_8(ctx->t1, p->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_256_mont_mul_8(ctx->z, p->y, p->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_256_mont_dbl_8(ctx->z, ctx->z, p256_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_256_mont_sub_8(ctx->t2, p->x, ctx->t1, p256_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_256_mont_add_8(ctx->t1, p->x, ctx->t1, p256_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_256_mont_mul_8(ctx->t2, ctx->t1, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_256_mont_tpl_8(ctx->t1, ctx->t2, p256_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_256_mont_dbl_8(ctx->y, p->y, p256_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_256_mont_sqr_8(ctx->y, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_256_mont_sqr_8(ctx->t2, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_256_mont_div2_8(ctx->t2, ctx->t2, p256_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_256_mont_mul_8(ctx->y, ctx->y, p->x, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_256_mont_sqr_8(ctx->x, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_256_mont_mul_8(ctx->y, ctx->y, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->t2, p256_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -40591,214 +40446,6 @@ static void sp_256_proj_point_add_8(sp_point_256* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_add_8_ctx { - int state; - sp_256_proj_point_dbl_8_ctx dbl_ctx; - const sp_point_256* ap[2]; - sp_point_256* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_add_8_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_add_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, const sp_point_256* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_add_8_ctx* ctx = (sp_256_proj_point_add_8_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_add_8_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_256* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*8; - ctx->t2 = t + 4*8; - ctx->t3 = t + 6*8; - ctx->t4 = t + 8*8; - ctx->t5 = t + 10*8; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_256_mont_sqr_8(ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - sp_256_mont_mul_8(ctx->t3, ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - sp_256_mont_mul_8(ctx->t1, ctx->t1, p->x, p256_mod, p256_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_256_mont_sqr_8(ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 5; - break; - case 5: - sp_256_mont_mul_8(ctx->t4, ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 6; - break; - case 6: - sp_256_mont_mul_8(ctx->t2, ctx->t2, q->x, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_256_mont_mul_8(ctx->t3, ctx->t3, p->y, p256_mod, p256_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_256_mont_mul_8(ctx->t4, ctx->t4, q->y, p256_mod, p256_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_256_cmp_equal_8(ctx->t2, ctx->t1) & - sp_256_cmp_equal_8(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_256_proj_point_dbl_8(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_256_mont_sub_8(ctx->t2, ctx->t2, ctx->t1, p256_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_256_mont_sub_8(ctx->t4, ctx->t4, ctx->t3, p256_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_256_mont_sqr_8(ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - sp_256_mont_mul_8(ctx->y, ctx->t1, ctx->t5, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - sp_256_mont_mul_8(ctx->t5, ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_256_mont_mul_8(ctx->z, p->z, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 16; - break; - case 16: - sp_256_mont_mul_8(ctx->z, ctx->z, q->z, p256_mod, p256_mp_mod); - ctx->state = 17; - break; - case 17: - sp_256_mont_sqr_8(ctx->x, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->t5, p256_mod); - ctx->state = 19; - break; - case 19: - sp_256_mont_mul_8(ctx->t5, ctx->t5, ctx->t3, p256_mod, p256_mp_mod); - ctx->state = 20; - break; - case 20: - sp_256_mont_dbl_8(ctx->t3, ctx->y, p256_mod); - sp_256_mont_sub_8(ctx->x, ctx->x, ctx->t3, p256_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 22; - break; - case 22: - sp_256_mont_mul_8(ctx->y, ctx->y, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 23; - break; - case 23: - sp_256_mont_sub_8(ctx->y, ctx->y, ctx->t5, p256_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 8; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 8; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 8; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -42037,10 +41684,6 @@ static int sp_256_ecc_mulmod_8(sp_point_256* r, const sp_point_256* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_8_ctx { int state; - union { - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; - }; sp_point_256 t[3]; sp_digit tmp[2 * 8 * 6]; sp_digit n; @@ -42115,27 +41758,22 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } ctx->y = (ctx->n >> 31) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_256)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_8(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_256)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_256)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); - ctx->state = 4; - ctx->c--; - } + sp_256_proj_point_dbl_8(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_256)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -42303,17 +41941,12 @@ static void sp_256_get_point_33_8(sp_point_256* r, const sp_point_256* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_256_ecc_mulmod_8_ctx { int state; - union { - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_256 t[33 + 2]; sp_digit tmp[2 * 8 * 6]; ecc_recode_256 v[43]; int i; - int j; } sp_256_ecc_mulmod_8_ctx; /* Multiply the point by the scalar and return the result. @@ -42339,6 +41972,7 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_256_ecc_mulmod_8_ctx* ctx = (sp_256_ecc_mulmod_8_ctx*)sp_ctx->data; sp_point_256* rt = &ctx->t[33]; sp_point_256* p = &ctx->t[33 + 1]; @@ -42368,29 +42002,20 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, err = sp_256_mod_mul_norm_8(ctx->t[1].z, g->z, p256_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_256_proj_point_dbl_8(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_256_proj_point_add_8(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -42407,19 +42032,13 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_256_proj_point_dbl_8(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -42435,22 +42054,16 @@ static int sp_256_ecc_mulmod_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMSET(negy, 0, sizeof(sp_digit) * 8); sp_256_mont_sub_8(negy, negy, p->y, p256_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 8); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_8(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -44027,10 +43640,6 @@ static int sp_256_ecc_mulmod_base_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_base_8_ctx { int state; - union { - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; - }; sp_point_256 rt; sp_point_256 p; sp_digit tmp[2 * 8 * 6]; @@ -44096,15 +43705,11 @@ static int sp_256_ecc_mulmod_base_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->y; ctx->i = 30; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_256_proj_point_dbl_8_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_256_proj_point_dbl_8(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -44124,21 +43729,16 @@ static int sp_256_ecc_mulmod_base_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMCPY(p->y, p256_table[ctx->y].y, sizeof(p->y[0]) * 8); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_256_proj_point_add_qz1_8(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -45323,7 +44923,8 @@ typedef struct sp_256_mont_inv_order_8_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -45334,6 +44935,7 @@ static int sp_256_mont_inv_order_8_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_256_mont_inv_order_8_ctx* ctx = (sp_256_mont_inv_order_8_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_256_mont_inv_order_8_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -45346,17 +44948,17 @@ static int sp_256_mont_inv_order_8_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_256_mont_sqr_order_8(t, t); - ctx->state = 2; - break; - case 2: - if ((p256_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_256_mont_mul_order_8(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_256_mont_sqr_order_8(t, t); + if ((p256_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_256_mont_mul_order_8(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 8U); err = MP_OKAY; break; @@ -46683,8 +46285,6 @@ typedef struct sp_ecc_verify_256_ctx { union { sp_256_ecc_mulmod_8_ctx mulmod_ctx; sp_256_mont_inv_order_8_ctx mont_inv_order_ctx; - sp_256_proj_point_dbl_8_ctx dbl_ctx; - sp_256_proj_point_add_8_ctx add_ctx; }; sp_digit u1[2*8]; sp_digit u2[2*8]; @@ -46786,14 +46386,12 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_256_iszero_8(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_256_proj_point_add_8_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_256_proj_point_add_8(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -46848,6 +46446,9 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_256_ctx)); + } return err; } @@ -51826,151 +51427,6 @@ static void sp_384_proj_point_dbl_12(sp_point_384* r, const sp_point_384* p, sp_384_mont_sub_12(y, y, t2, p384_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_dbl_12_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_dbl_12_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_dbl_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_dbl_12_ctx* ctx = (sp_384_proj_point_dbl_12_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_dbl_12_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*12; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_384_mont_sqr_12(ctx->t1, p->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_384_mont_mul_12(ctx->z, p->y, p->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_384_mont_dbl_12(ctx->z, ctx->z, p384_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_384_mont_sub_12(ctx->t2, p->x, ctx->t1, p384_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_384_mont_add_12(ctx->t1, p->x, ctx->t1, p384_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_384_mont_mul_12(ctx->t2, ctx->t1, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_384_mont_tpl_12(ctx->t1, ctx->t2, p384_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_384_mont_dbl_12(ctx->y, p->y, p384_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_384_mont_sqr_12(ctx->y, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_384_mont_sqr_12(ctx->t2, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_384_mont_div2_12(ctx->t2, ctx->t2, p384_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_384_mont_mul_12(ctx->y, ctx->y, p->x, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_384_mont_sqr_12(ctx->x, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_384_mont_mul_12(ctx->y, ctx->y, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->t2, p384_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -52087,214 +51543,6 @@ static void sp_384_proj_point_add_12(sp_point_384* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_add_12_ctx { - int state; - sp_384_proj_point_dbl_12_ctx dbl_ctx; - const sp_point_384* ap[2]; - sp_point_384* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_add_12_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_add_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, const sp_point_384* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_add_12_ctx* ctx = (sp_384_proj_point_add_12_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_add_12_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_384* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*12; - ctx->t2 = t + 4*12; - ctx->t3 = t + 6*12; - ctx->t4 = t + 8*12; - ctx->t5 = t + 10*12; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_384_mont_sqr_12(ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - sp_384_mont_mul_12(ctx->t3, ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - sp_384_mont_mul_12(ctx->t1, ctx->t1, p->x, p384_mod, p384_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_384_mont_sqr_12(ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 5; - break; - case 5: - sp_384_mont_mul_12(ctx->t4, ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 6; - break; - case 6: - sp_384_mont_mul_12(ctx->t2, ctx->t2, q->x, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_384_mont_mul_12(ctx->t3, ctx->t3, p->y, p384_mod, p384_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_384_mont_mul_12(ctx->t4, ctx->t4, q->y, p384_mod, p384_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_384_cmp_equal_12(ctx->t2, ctx->t1) & - sp_384_cmp_equal_12(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_384_proj_point_dbl_12(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_384_mont_sub_12(ctx->t2, ctx->t2, ctx->t1, p384_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_384_mont_sub_12(ctx->t4, ctx->t4, ctx->t3, p384_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_384_mont_sqr_12(ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - sp_384_mont_mul_12(ctx->y, ctx->t1, ctx->t5, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - sp_384_mont_mul_12(ctx->t5, ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_384_mont_mul_12(ctx->z, p->z, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 16; - break; - case 16: - sp_384_mont_mul_12(ctx->z, ctx->z, q->z, p384_mod, p384_mp_mod); - ctx->state = 17; - break; - case 17: - sp_384_mont_sqr_12(ctx->x, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->t5, p384_mod); - ctx->state = 19; - break; - case 19: - sp_384_mont_mul_12(ctx->t5, ctx->t5, ctx->t3, p384_mod, p384_mp_mod); - ctx->state = 20; - break; - case 20: - sp_384_mont_dbl_12(ctx->t3, ctx->y, p384_mod); - sp_384_mont_sub_12(ctx->x, ctx->x, ctx->t3, p384_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 22; - break; - case 22: - sp_384_mont_mul_12(ctx->y, ctx->y, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 23; - break; - case 23: - sp_384_mont_sub_12(ctx->y, ctx->y, ctx->t5, p384_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 12; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 12; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 12; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -53589,10 +52837,6 @@ static int sp_384_ecc_mulmod_12(sp_point_384* r, const sp_point_384* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_12_ctx { int state; - union { - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; - }; sp_point_384 t[3]; sp_digit tmp[2 * 12 * 6]; sp_digit n; @@ -53667,27 +52911,22 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } ctx->y = (ctx->n >> 31) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_384)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_12(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_384)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_384)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); - ctx->state = 4; - ctx->c--; - } + sp_384_proj_point_dbl_12(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_384)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -53879,17 +53118,12 @@ static void sp_384_get_point_33_12(sp_point_384* r, const sp_point_384* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_384_ecc_mulmod_12_ctx { int state; - union { - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_384 t[33 + 2]; sp_digit tmp[2 * 12 * 6]; ecc_recode_384 v[65]; int i; - int j; } sp_384_ecc_mulmod_12_ctx; /* Multiply the point by the scalar and return the result. @@ -53915,6 +53149,7 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_384_ecc_mulmod_12_ctx* ctx = (sp_384_ecc_mulmod_12_ctx*)sp_ctx->data; sp_point_384* rt = &ctx->t[33]; sp_point_384* p = &ctx->t[33 + 1]; @@ -53944,29 +53179,20 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, err = sp_384_mod_mul_norm_12(ctx->t[1].z, g->z, p384_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_384_proj_point_dbl_12(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_384_proj_point_add_12(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -53983,19 +53209,13 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_384_proj_point_dbl_12(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -54011,22 +53231,16 @@ static int sp_384_ecc_mulmod_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMSET(negy, 0, sizeof(sp_digit) * 12); sp_384_mont_sub_12(negy, negy, p->y, p384_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 12); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_12(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -55603,10 +54817,6 @@ static int sp_384_ecc_mulmod_base_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_base_12_ctx { int state; - union { - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; - }; sp_point_384 rt; sp_point_384 p; sp_digit tmp[2 * 12 * 6]; @@ -55672,15 +54882,11 @@ static int sp_384_ecc_mulmod_base_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->y; ctx->i = 46; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_384_proj_point_dbl_12_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_384_proj_point_dbl_12(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -55700,21 +54906,16 @@ static int sp_384_ecc_mulmod_base_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMCPY(p->y, p384_table[ctx->y].y, sizeof(p->y[0]) * 12); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; - break; - case 3: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + break; + case 3: /* ADD */ + sp_384_proj_point_add_qz1_12(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -56936,7 +56137,8 @@ typedef struct sp_384_mont_inv_order_12_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -56947,6 +56149,7 @@ static int sp_384_mont_inv_order_12_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_384_mont_inv_order_12_ctx* ctx = (sp_384_mont_inv_order_12_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_384_mont_inv_order_12_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -56959,17 +56162,17 @@ static int sp_384_mont_inv_order_12_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const ctx->state = 1; break; case 1: - sp_384_mont_sqr_order_12(t, t); - ctx->state = 2; - break; - case 2: - if ((p384_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_384_mont_mul_order_12(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_384_mont_sqr_order_12(t, t); + if ((p384_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_384_mont_mul_order_12(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 12U); err = MP_OKAY; break; @@ -58180,8 +57383,6 @@ typedef struct sp_ecc_verify_384_ctx { union { sp_384_ecc_mulmod_12_ctx mulmod_ctx; sp_384_mont_inv_order_12_ctx mont_inv_order_ctx; - sp_384_proj_point_dbl_12_ctx dbl_ctx; - sp_384_proj_point_add_12_ctx add_ctx; }; sp_digit u1[2*12]; sp_digit u2[2*12]; @@ -58283,14 +57484,12 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_384_iszero_12(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_384_proj_point_add_12_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_384_proj_point_add_12(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -58345,6 +57544,9 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_384_ctx)); + } return err; } @@ -65097,151 +64299,6 @@ static void sp_521_proj_point_dbl_17(sp_point_521* r, const sp_point_521* p, sp_521_mont_sub_17(y, y, t2, p521_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_dbl_17_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_dbl_17_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_dbl_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_dbl_17_ctx* ctx = (sp_521_proj_point_dbl_17_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_dbl_17_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*17; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_521_mont_sqr_17(ctx->t1, p->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_521_mont_mul_17(ctx->z, p->y, p->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_521_mont_dbl_17(ctx->z, ctx->z, p521_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_521_mont_sub_17(ctx->t2, p->x, ctx->t1, p521_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_521_mont_add_17(ctx->t1, p->x, ctx->t1, p521_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_521_mont_mul_17(ctx->t2, ctx->t1, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_521_mont_tpl_17(ctx->t1, ctx->t2, p521_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_521_mont_dbl_17(ctx->y, p->y, p521_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_521_mont_sqr_17(ctx->y, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_521_mont_sqr_17(ctx->t2, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_521_mont_div2_17(ctx->t2, ctx->t2, p521_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_521_mont_mul_17(ctx->y, ctx->y, p->x, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_521_mont_sqr_17(ctx->x, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_521_mont_mul_17(ctx->y, ctx->y, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->t2, p521_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -65361,214 +64418,6 @@ static void sp_521_proj_point_add_17(sp_point_521* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_add_17_ctx { - int state; - sp_521_proj_point_dbl_17_ctx dbl_ctx; - const sp_point_521* ap[2]; - sp_point_521* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_add_17_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_add_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, const sp_point_521* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_add_17_ctx* ctx = (sp_521_proj_point_add_17_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_add_17_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_521* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*17; - ctx->t2 = t + 4*17; - ctx->t3 = t + 6*17; - ctx->t4 = t + 8*17; - ctx->t5 = t + 10*17; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_521_mont_sqr_17(ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - sp_521_mont_mul_17(ctx->t3, ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - sp_521_mont_mul_17(ctx->t1, ctx->t1, p->x, p521_mod, p521_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_521_mont_sqr_17(ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 5; - break; - case 5: - sp_521_mont_mul_17(ctx->t4, ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 6; - break; - case 6: - sp_521_mont_mul_17(ctx->t2, ctx->t2, q->x, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_521_mont_mul_17(ctx->t3, ctx->t3, p->y, p521_mod, p521_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_521_mont_mul_17(ctx->t4, ctx->t4, q->y, p521_mod, p521_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_521_cmp_equal_17(ctx->t2, ctx->t1) & - sp_521_cmp_equal_17(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_521_proj_point_dbl_17(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_521_mont_sub_17(ctx->t2, ctx->t2, ctx->t1, p521_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_521_mont_sub_17(ctx->t4, ctx->t4, ctx->t3, p521_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_521_mont_sqr_17(ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - sp_521_mont_mul_17(ctx->y, ctx->t1, ctx->t5, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - sp_521_mont_mul_17(ctx->t5, ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_521_mont_mul_17(ctx->z, p->z, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 16; - break; - case 16: - sp_521_mont_mul_17(ctx->z, ctx->z, q->z, p521_mod, p521_mp_mod); - ctx->state = 17; - break; - case 17: - sp_521_mont_sqr_17(ctx->x, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->t5, p521_mod); - ctx->state = 19; - break; - case 19: - sp_521_mont_mul_17(ctx->t5, ctx->t5, ctx->t3, p521_mod, p521_mp_mod); - ctx->state = 20; - break; - case 20: - sp_521_mont_dbl_17(ctx->t3, ctx->y, p521_mod); - sp_521_mont_sub_17(ctx->x, ctx->x, ctx->t3, p521_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 22; - break; - case 22: - sp_521_mont_mul_17(ctx->y, ctx->y, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 23; - break; - case 23: - sp_521_mont_sub_17(ctx->y, ctx->y, ctx->t5, p521_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 17; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 17; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 17; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -66947,10 +65796,6 @@ static int sp_521_ecc_mulmod_17(sp_point_521* r, const sp_point_521* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_17_ctx { int state; - union { - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; - }; sp_point_521 t[3]; sp_digit tmp[2 * 17 * 6]; sp_digit n; @@ -67025,27 +65870,22 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } ctx->y = (ctx->n >> 31) & 1; ctx->n = (sp_uint32)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_521)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_17(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_521)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_521)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); - ctx->state = 4; - ctx->c--; - } + sp_521_proj_point_dbl_17(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_521)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -67267,17 +66107,12 @@ static void sp_521_get_point_33_17(sp_point_521* r, const sp_point_521* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_521_ecc_mulmod_17_ctx { int state; - union { - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_521 t[33 + 2]; sp_digit tmp[2 * 17 * 6]; ecc_recode_521 v[87]; int i; - int j; } sp_521_ecc_mulmod_17_ctx; /* Multiply the point by the scalar and return the result. @@ -67303,6 +66138,7 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_521_ecc_mulmod_17_ctx* ctx = (sp_521_ecc_mulmod_17_ctx*)sp_ctx->data; sp_point_521* rt = &ctx->t[33]; sp_point_521* p = &ctx->t[33 + 1]; @@ -67332,29 +66168,20 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, err = sp_521_mod_mul_norm_17(ctx->t[1].z, g->z, p521_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_521_proj_point_dbl_17(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_521_proj_point_add_17(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -67371,19 +66198,13 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_521_proj_point_dbl_17(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -67399,22 +66220,16 @@ static int sp_521_ecc_mulmod_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMSET(negy, 0, sizeof(sp_digit) * 17); sp_521_mont_sub_17(negy, negy, p->y, p521_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 17); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_17(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -69535,10 +68350,6 @@ static int sp_521_ecc_mulmod_base_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_base_17_ctx { int state; - union { - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; - }; sp_point_521 rt; sp_point_521 p; sp_digit tmp[2 * 17 * 6]; @@ -69604,15 +68415,11 @@ static int sp_521_ecc_mulmod_base_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->y; ctx->i = 64; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_521_proj_point_dbl_17_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_521_proj_point_dbl_17(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -69632,21 +68439,16 @@ static int sp_521_ecc_mulmod_base_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMCPY(p->y, p521_table[ctx->y].y, sizeof(p->y[0]) * 17); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_521_proj_point_add_qz1_17(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -71472,7 +70274,8 @@ typedef struct sp_521_mont_inv_order_17_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -71483,6 +70286,7 @@ static int sp_521_mont_inv_order_17_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_521_mont_inv_order_17_ctx* ctx = (sp_521_mont_inv_order_17_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_521_mont_inv_order_17_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -71495,17 +70299,17 @@ static int sp_521_mont_inv_order_17_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const ctx->state = 1; break; case 1: - sp_521_mont_sqr_order_17(t, t); - ctx->state = 2; - break; - case 2: - if ((p521_order_minus_2[ctx->i / 32] & ((sp_int_digit)1 << (ctx->i % 32))) != 0) { - sp_521_mont_mul_order_17(t, t, a); + for (j = 0; (j < 32) && (ctx->i >= 0); j++) { + sp_521_mont_sqr_order_17(t, t); + if ((p521_order_minus_2[ctx->i / 32] & + ((sp_int_digit)1 << (ctx->i % 32))) != 0) { + sp_521_mont_mul_order_17(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 17U); err = MP_OKAY; break; @@ -73078,8 +71882,6 @@ typedef struct sp_ecc_verify_521_ctx { union { sp_521_ecc_mulmod_17_ctx mulmod_ctx; sp_521_mont_inv_order_17_ctx mont_inv_order_ctx; - sp_521_proj_point_dbl_17_ctx dbl_ctx; - sp_521_proj_point_add_17_ctx add_ctx; }; sp_digit u1[2*17]; sp_digit u2[2*17]; @@ -73184,14 +71986,12 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_521_iszero_17(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_521_proj_point_add_17_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_521_proj_point_add_17(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -73246,6 +72046,9 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_521_ctx)); + } return err; } diff --git a/wolfcrypt/src/sp_riscv64.c b/wolfcrypt/src/sp_riscv64.c index a4b1f4f85e1..780c570fbed 100644 --- a/wolfcrypt/src/sp_riscv64.c +++ b/wolfcrypt/src/sp_riscv64.c @@ -39497,151 +39497,6 @@ static void sp_256_proj_point_dbl_4(sp_point_256* r, const sp_point_256* p, sp_256_mont_sub_4(y, y, t2, p256_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_dbl_4_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_dbl_4_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_dbl_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_dbl_4_ctx* ctx = (sp_256_proj_point_dbl_4_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_dbl_4_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*4; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_256_mont_sqr_4(ctx->t1, p->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_256_mont_mul_4(ctx->z, p->y, p->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_256_mont_dbl_4(ctx->z, ctx->z, p256_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_256_mont_sub_4(ctx->t2, p->x, ctx->t1, p256_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_256_mont_add_4(ctx->t1, p->x, ctx->t1, p256_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_256_mont_mul_4(ctx->t2, ctx->t1, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_256_mont_tpl_4(ctx->t1, ctx->t2, p256_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_256_mont_dbl_4(ctx->y, p->y, p256_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_256_mont_sqr_4(ctx->y, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_256_mont_sqr_4(ctx->t2, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_256_mont_div2_4(ctx->t2, ctx->t2, p256_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_256_mont_mul_4(ctx->y, ctx->y, p->x, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_256_mont_sqr_4(ctx->x, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_256_mont_sub_4(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_256_mont_sub_4(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_256_mont_sub_4(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_256_mont_mul_4(ctx->y, ctx->y, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_256_mont_sub_4(ctx->y, ctx->y, ctx->t2, p256_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -39755,214 +39610,6 @@ static void sp_256_proj_point_add_4(sp_point_256* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_add_4_ctx { - int state; - sp_256_proj_point_dbl_4_ctx dbl_ctx; - const sp_point_256* ap[2]; - sp_point_256* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_add_4_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_add_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, const sp_point_256* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_add_4_ctx* ctx = (sp_256_proj_point_add_4_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_add_4_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_256* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*4; - ctx->t2 = t + 4*4; - ctx->t3 = t + 6*4; - ctx->t4 = t + 8*4; - ctx->t5 = t + 10*4; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_256_mont_sqr_4(ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - sp_256_mont_mul_4(ctx->t3, ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - sp_256_mont_mul_4(ctx->t1, ctx->t1, p->x, p256_mod, p256_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_256_mont_sqr_4(ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 5; - break; - case 5: - sp_256_mont_mul_4(ctx->t4, ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 6; - break; - case 6: - sp_256_mont_mul_4(ctx->t2, ctx->t2, q->x, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_256_mont_mul_4(ctx->t3, ctx->t3, p->y, p256_mod, p256_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_256_mont_mul_4(ctx->t4, ctx->t4, q->y, p256_mod, p256_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_256_cmp_equal_4(ctx->t2, ctx->t1) & - sp_256_cmp_equal_4(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_256_proj_point_dbl_4(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_256_mont_sub_4(ctx->t2, ctx->t2, ctx->t1, p256_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_256_mont_sub_4(ctx->t4, ctx->t4, ctx->t3, p256_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_256_mont_sqr_4(ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - sp_256_mont_mul_4(ctx->y, ctx->t1, ctx->t5, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - sp_256_mont_mul_4(ctx->t5, ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_256_mont_mul_4(ctx->z, p->z, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 16; - break; - case 16: - sp_256_mont_mul_4(ctx->z, ctx->z, q->z, p256_mod, p256_mp_mod); - ctx->state = 17; - break; - case 17: - sp_256_mont_sqr_4(ctx->x, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - sp_256_mont_sub_4(ctx->x, ctx->x, ctx->t5, p256_mod); - ctx->state = 19; - break; - case 19: - sp_256_mont_mul_4(ctx->t5, ctx->t5, ctx->t3, p256_mod, p256_mp_mod); - ctx->state = 20; - break; - case 20: - sp_256_mont_dbl_4(ctx->t3, ctx->y, p256_mod); - sp_256_mont_sub_4(ctx->x, ctx->x, ctx->t3, p256_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_256_mont_sub_4(ctx->y, ctx->y, ctx->x, p256_mod); - ctx->state = 22; - break; - case 22: - sp_256_mont_mul_4(ctx->y, ctx->y, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 23; - break; - case 23: - sp_256_mont_sub_4(ctx->y, ctx->y, ctx->t5, p256_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 4; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 4; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 4; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -41145,10 +40792,6 @@ static int sp_256_ecc_mulmod_4(sp_point_256* r, const sp_point_256* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_4_ctx { int state; - union { - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; - }; sp_point_256 t[3]; sp_digit tmp[2 * 4 * 6]; sp_digit n; @@ -41223,27 +40866,22 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } ctx->y = (ctx->n >> 63) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_256)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_4(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_256)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_4_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_256)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); - ctx->state = 4; - ctx->c--; - } + sp_256_proj_point_dbl_4(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_256)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -41387,17 +41025,12 @@ static void sp_256_get_point_33_4(sp_point_256* r, const sp_point_256* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_256_ecc_mulmod_4_ctx { int state; - union { - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_256 t[33 + 2]; sp_digit tmp[2 * 4 * 6]; ecc_recode_256 v[43]; int i; - int j; } sp_256_ecc_mulmod_4_ctx; /* Multiply the point by the scalar and return the result. @@ -41423,6 +41056,7 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_256_ecc_mulmod_4_ctx* ctx = (sp_256_ecc_mulmod_4_ctx*)sp_ctx->data; sp_point_256* rt = &ctx->t[33]; sp_point_256* p = &ctx->t[33 + 1]; @@ -41452,29 +41086,20 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, err = sp_256_mod_mul_norm_4(ctx->t[1].z, g->z, p256_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_256_proj_point_dbl_4_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_256_proj_point_dbl_4(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_256_proj_point_add_4(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -41491,19 +41116,13 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_4_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_256_proj_point_dbl_4(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -41519,22 +41138,16 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMSET(negy, 0, sizeof(sp_digit) * 4); sp_256_mont_sub_4(negy, negy, p->y, p256_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 4); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_4(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -43111,10 +42724,6 @@ static int sp_256_ecc_mulmod_base_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_base_4_ctx { int state; - union { - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; - }; sp_point_256 rt; sp_point_256 p; sp_digit tmp[2 * 4 * 6]; @@ -43180,15 +42789,11 @@ static int sp_256_ecc_mulmod_base_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->y; ctx->i = 30; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_256_proj_point_dbl_4_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_256_proj_point_dbl_4(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -43208,21 +42813,16 @@ static int sp_256_ecc_mulmod_base_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMCPY(p->y, p256_table[ctx->y].y, sizeof(p->y[0]) * 4); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_256_proj_point_add_qz1_4(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -44036,7 +43636,8 @@ typedef struct sp_256_mont_inv_order_4_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -44047,6 +43648,7 @@ static int sp_256_mont_inv_order_4_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_256_mont_inv_order_4_ctx* ctx = (sp_256_mont_inv_order_4_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_256_mont_inv_order_4_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -44059,17 +43661,17 @@ static int sp_256_mont_inv_order_4_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_256_mont_sqr_order_4(t, t); - ctx->state = 2; - break; - case 2: - if ((p256_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_256_mont_mul_order_4(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_256_mont_sqr_order_4(t, t); + if ((p256_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_256_mont_mul_order_4(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 4U); err = MP_OKAY; break; @@ -44881,8 +44483,6 @@ typedef struct sp_ecc_verify_256_ctx { union { sp_256_ecc_mulmod_4_ctx mulmod_ctx; sp_256_mont_inv_order_4_ctx mont_inv_order_ctx; - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; }; sp_digit u1[2*4]; sp_digit u2[2*4]; @@ -44984,14 +44584,12 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_256_iszero_4(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_256_proj_point_add_4(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -45046,6 +44644,9 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_256_ctx)); + } return err; } @@ -50150,151 +49751,6 @@ static void sp_384_proj_point_dbl_6(sp_point_384* r, const sp_point_384* p, sp_384_mont_sub_6(y, y, t2, p384_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_dbl_6_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_dbl_6_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_dbl_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_dbl_6_ctx* ctx = (sp_384_proj_point_dbl_6_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_dbl_6_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*6; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_384_mont_sqr_6(ctx->t1, p->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_384_mont_mul_6(ctx->z, p->y, p->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_384_mont_dbl_6(ctx->z, ctx->z, p384_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_384_mont_sub_6(ctx->t2, p->x, ctx->t1, p384_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_384_mont_add_6(ctx->t1, p->x, ctx->t1, p384_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_384_mont_mul_6(ctx->t2, ctx->t1, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_384_mont_tpl_6(ctx->t1, ctx->t2, p384_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_384_mont_dbl_6(ctx->y, p->y, p384_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_384_mont_sqr_6(ctx->y, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_384_mont_sqr_6(ctx->t2, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_384_mont_div2_6(ctx->t2, ctx->t2, p384_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_384_mont_mul_6(ctx->y, ctx->y, p->x, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_384_mont_sqr_6(ctx->x, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_384_mont_mul_6(ctx->y, ctx->y, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->t2, p384_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -50408,214 +49864,6 @@ static void sp_384_proj_point_add_6(sp_point_384* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_add_6_ctx { - int state; - sp_384_proj_point_dbl_6_ctx dbl_ctx; - const sp_point_384* ap[2]; - sp_point_384* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_add_6_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_add_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, const sp_point_384* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_add_6_ctx* ctx = (sp_384_proj_point_add_6_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_add_6_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_384* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*6; - ctx->t2 = t + 4*6; - ctx->t3 = t + 6*6; - ctx->t4 = t + 8*6; - ctx->t5 = t + 10*6; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_384_mont_sqr_6(ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - sp_384_mont_mul_6(ctx->t3, ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - sp_384_mont_mul_6(ctx->t1, ctx->t1, p->x, p384_mod, p384_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_384_mont_sqr_6(ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 5; - break; - case 5: - sp_384_mont_mul_6(ctx->t4, ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 6; - break; - case 6: - sp_384_mont_mul_6(ctx->t2, ctx->t2, q->x, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_384_mont_mul_6(ctx->t3, ctx->t3, p->y, p384_mod, p384_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_384_mont_mul_6(ctx->t4, ctx->t4, q->y, p384_mod, p384_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_384_cmp_equal_6(ctx->t2, ctx->t1) & - sp_384_cmp_equal_6(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_384_proj_point_dbl_6(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_384_mont_sub_6(ctx->t2, ctx->t2, ctx->t1, p384_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_384_mont_sub_6(ctx->t4, ctx->t4, ctx->t3, p384_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_384_mont_sqr_6(ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - sp_384_mont_mul_6(ctx->y, ctx->t1, ctx->t5, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - sp_384_mont_mul_6(ctx->t5, ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_384_mont_mul_6(ctx->z, p->z, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 16; - break; - case 16: - sp_384_mont_mul_6(ctx->z, ctx->z, q->z, p384_mod, p384_mp_mod); - ctx->state = 17; - break; - case 17: - sp_384_mont_sqr_6(ctx->x, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->t5, p384_mod); - ctx->state = 19; - break; - case 19: - sp_384_mont_mul_6(ctx->t5, ctx->t5, ctx->t3, p384_mod, p384_mp_mod); - ctx->state = 20; - break; - case 20: - sp_384_mont_dbl_6(ctx->t3, ctx->y, p384_mod); - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->t3, p384_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 22; - break; - case 22: - sp_384_mont_mul_6(ctx->y, ctx->y, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 23; - break; - case 23: - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->t5, p384_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 6; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 6; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 6; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -51826,10 +51074,6 @@ static int sp_384_ecc_mulmod_6(sp_point_384* r, const sp_point_384* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_6_ctx { int state; - union { - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; - }; sp_point_384 t[3]; sp_digit tmp[2 * 6 * 6]; sp_digit n; @@ -51904,27 +51148,22 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } ctx->y = (ctx->n >> 63) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_384)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_6(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_384)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_6_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_384)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); - ctx->state = 4; - ctx->c--; - } + sp_384_proj_point_dbl_6(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_384)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -52080,17 +51319,12 @@ static void sp_384_get_point_33_6(sp_point_384* r, const sp_point_384* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_384_ecc_mulmod_6_ctx { int state; - union { - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_384 t[33 + 2]; sp_digit tmp[2 * 6 * 6]; ecc_recode_384 v[65]; int i; - int j; } sp_384_ecc_mulmod_6_ctx; /* Multiply the point by the scalar and return the result. @@ -52116,6 +51350,7 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_384_ecc_mulmod_6_ctx* ctx = (sp_384_ecc_mulmod_6_ctx*)sp_ctx->data; sp_point_384* rt = &ctx->t[33]; sp_point_384* p = &ctx->t[33 + 1]; @@ -52145,29 +51380,20 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, err = sp_384_mod_mul_norm_6(ctx->t[1].z, g->z, p384_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_384_proj_point_dbl_6_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_384_proj_point_dbl_6(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_384_proj_point_add_6(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -52184,19 +51410,13 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_6_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_384_proj_point_dbl_6(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -52212,22 +51432,16 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMSET(negy, 0, sizeof(sp_digit) * 6); sp_384_mont_sub_6(negy, negy, p->y, p384_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 6); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_6(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -53804,10 +53018,6 @@ static int sp_384_ecc_mulmod_base_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_base_6_ctx { int state; - union { - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; - }; sp_point_384 rt; sp_point_384 p; sp_digit tmp[2 * 6 * 6]; @@ -53873,15 +53083,11 @@ static int sp_384_ecc_mulmod_base_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->y; ctx->i = 46; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_384_proj_point_dbl_6_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_384_proj_point_dbl_6(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -53901,21 +53107,16 @@ static int sp_384_ecc_mulmod_base_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMCPY(p->y, p384_table[ctx->y].y, sizeof(p->y[0]) * 6); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; - break; - case 3: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + break; + case 3: /* ADD */ + sp_384_proj_point_add_qz1_6(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -54771,7 +53972,8 @@ typedef struct sp_384_mont_inv_order_6_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -54782,6 +53984,7 @@ static int sp_384_mont_inv_order_6_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_384_mont_inv_order_6_ctx* ctx = (sp_384_mont_inv_order_6_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_384_mont_inv_order_6_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -54794,17 +53997,17 @@ static int sp_384_mont_inv_order_6_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_384_mont_sqr_order_6(t, t); - ctx->state = 2; - break; - case 2: - if ((p384_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_384_mont_mul_order_6(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_384_mont_sqr_order_6(t, t); + if ((p384_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_384_mont_mul_order_6(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 6U); err = MP_OKAY; break; @@ -55585,8 +54788,6 @@ typedef struct sp_ecc_verify_384_ctx { union { sp_384_ecc_mulmod_6_ctx mulmod_ctx; sp_384_mont_inv_order_6_ctx mont_inv_order_ctx; - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; }; sp_digit u1[2*6]; sp_digit u2[2*6]; @@ -55688,14 +54889,12 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_384_iszero_6(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_384_proj_point_add_6(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -55750,6 +54949,9 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_384_ctx)); + } return err; } @@ -60755,151 +59957,6 @@ static void sp_521_proj_point_dbl_9(sp_point_521* r, const sp_point_521* p, sp_521_mont_sub_9(y, y, t2, p521_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_dbl_9_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_dbl_9_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_dbl_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_dbl_9_ctx* ctx = (sp_521_proj_point_dbl_9_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_dbl_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*9; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_521_mont_sqr_9(ctx->t1, p->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_521_mont_mul_9(ctx->z, p->y, p->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_521_mont_dbl_9(ctx->z, ctx->z, p521_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_521_mont_sub_9(ctx->t2, p->x, ctx->t1, p521_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_521_mont_add_9(ctx->t1, p->x, ctx->t1, p521_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_521_mont_mul_9(ctx->t2, ctx->t1, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_521_mont_tpl_9(ctx->t1, ctx->t2, p521_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_521_mont_dbl_9(ctx->y, p->y, p521_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_521_mont_sqr_9(ctx->y, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_521_mont_sqr_9(ctx->t2, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_521_mont_div2_9(ctx->t2, ctx->t2, p521_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_521_mont_mul_9(ctx->y, ctx->y, p->x, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_521_mont_sqr_9(ctx->x, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_521_mont_mul_9(ctx->y, ctx->y, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->t2, p521_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Compare two numbers to determine if they are equal. * Constant time implementation. * @@ -61015,214 +60072,6 @@ static void sp_521_proj_point_add_9(sp_point_521* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_add_9_ctx { - int state; - sp_521_proj_point_dbl_9_ctx dbl_ctx; - const sp_point_521* ap[2]; - sp_point_521* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_add_9_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_add_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, const sp_point_521* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_add_9_ctx* ctx = (sp_521_proj_point_add_9_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_add_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_521* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*9; - ctx->t2 = t + 4*9; - ctx->t3 = t + 6*9; - ctx->t4 = t + 8*9; - ctx->t5 = t + 10*9; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_521_mont_sqr_9(ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - sp_521_mont_mul_9(ctx->t3, ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - sp_521_mont_mul_9(ctx->t1, ctx->t1, p->x, p521_mod, p521_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_521_mont_sqr_9(ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 5; - break; - case 5: - sp_521_mont_mul_9(ctx->t4, ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 6; - break; - case 6: - sp_521_mont_mul_9(ctx->t2, ctx->t2, q->x, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_521_mont_mul_9(ctx->t3, ctx->t3, p->y, p521_mod, p521_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_521_mont_mul_9(ctx->t4, ctx->t4, q->y, p521_mod, p521_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_521_cmp_equal_9(ctx->t2, ctx->t1) & - sp_521_cmp_equal_9(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_521_proj_point_dbl_9(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_521_mont_sub_9(ctx->t2, ctx->t2, ctx->t1, p521_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_521_mont_sub_9(ctx->t4, ctx->t4, ctx->t3, p521_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_521_mont_sqr_9(ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - sp_521_mont_mul_9(ctx->y, ctx->t1, ctx->t5, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - sp_521_mont_mul_9(ctx->t5, ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_521_mont_mul_9(ctx->z, p->z, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 16; - break; - case 16: - sp_521_mont_mul_9(ctx->z, ctx->z, q->z, p521_mod, p521_mp_mod); - ctx->state = 17; - break; - case 17: - sp_521_mont_sqr_9(ctx->x, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->t5, p521_mod); - ctx->state = 19; - break; - case 19: - sp_521_mont_mul_9(ctx->t5, ctx->t5, ctx->t3, p521_mod, p521_mp_mod); - ctx->state = 20; - break; - case 20: - sp_521_mont_dbl_9(ctx->t3, ctx->y, p521_mod); - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->t3, p521_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 22; - break; - case 22: - sp_521_mont_mul_9(ctx->y, ctx->y, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 23; - break; - case 23: - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->t5, p521_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 9; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 9; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 9; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - #ifndef WC_NO_CACHE_RESISTANT /* Touch each possible point that could be being copied. * @@ -62489,10 +61338,6 @@ static int sp_521_ecc_mulmod_9(sp_point_521* r, const sp_point_521* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; sp_point_521 t[3]; sp_digit tmp[2 * 9 * 6]; sp_digit n; @@ -62567,27 +61412,22 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } ctx->y = (ctx->n >> 63) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_521)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_9(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_521)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_521)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); - ctx->state = 4; - ctx->c--; - } + sp_521_proj_point_dbl_9(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_521)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -62761,17 +61601,12 @@ static void sp_521_get_point_33_9(sp_point_521* r, const sp_point_521* table, #endif /* !WC_NO_CACHE_RESISTANT */ typedef struct sp_521_ecc_mulmod_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_521 t[33 + 2]; sp_digit tmp[2 * 9 * 6]; ecc_recode_521 v[87]; int i; - int j; } sp_521_ecc_mulmod_9_ctx; /* Multiply the point by the scalar and return the result. @@ -62797,6 +61632,7 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_521_ecc_mulmod_9_ctx* ctx = (sp_521_ecc_mulmod_9_ctx*)sp_ctx->data; sp_point_521* rt = &ctx->t[33]; sp_point_521* p = &ctx->t[33 + 1]; @@ -62826,29 +61662,20 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, err = sp_521_mod_mul_norm_9(ctx->t[1].z, g->z, p521_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_521_proj_point_dbl_9(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_521_proj_point_add_9(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -62865,19 +61692,13 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_521_proj_point_dbl_9(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -62893,22 +61714,16 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMSET(negy, 0, sizeof(sp_digit) * 9); sp_521_mont_sub_9(negy, negy, p->y, p521_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 9); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_9(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -65025,10 +63840,6 @@ static int sp_521_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_base_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; sp_point_521 rt; sp_point_521 p; sp_digit tmp[2 * 9 * 6]; @@ -65094,15 +63905,11 @@ static int sp_521_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->y; ctx->i = 64; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 1; break; case 1: /* DBL */ - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - ctx->state = 2; - } + sp_521_proj_point_dbl_9(rt, rt, ctx->tmp); + ctx->state = 2; break; case 2: /* GETENTRY */ ctx->y = 0; @@ -65122,21 +63929,16 @@ static int sp_521_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMCPY(p->y, p521_table[ctx->y].y, sizeof(p->y[0]) * 9); } p->infinity = !ctx->y; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 1; - } + sp_521_proj_point_add_qz1_9(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 1; } break; case 4: /* MAP */ @@ -65728,7 +64530,8 @@ typedef struct sp_521_mont_inv_order_9_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -65739,6 +64542,7 @@ static int sp_521_mont_inv_order_9_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_521_mont_inv_order_9_ctx* ctx = (sp_521_mont_inv_order_9_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_521_mont_inv_order_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -65751,17 +64555,17 @@ static int sp_521_mont_inv_order_9_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_521_mont_sqr_order_9(t, t); - ctx->state = 2; - break; - case 2: - if ((p521_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_521_mont_mul_order_9(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_521_mont_sqr_order_9(t, t); + if ((p521_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_521_mont_mul_order_9(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 9U); err = MP_OKAY; break; @@ -66570,8 +65374,6 @@ typedef struct sp_ecc_verify_521_ctx { union { sp_521_ecc_mulmod_9_ctx mulmod_ctx; sp_521_mont_inv_order_9_ctx mont_inv_order_ctx; - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; }; sp_digit u1[2*9]; sp_digit u2[2*9]; @@ -66676,14 +65478,12 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_521_iszero_9(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_521_proj_point_add_9(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -66738,6 +65538,9 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_521_ctx)); + } return err; } diff --git a/wolfcrypt/src/sp_x86_64.c b/wolfcrypt/src/sp_x86_64.c index 55aee80c519..c8dd323a95f 100644 --- a/wolfcrypt/src/sp_x86_64.c +++ b/wolfcrypt/src/sp_x86_64.c @@ -8594,148 +8594,6 @@ static void sp_256_proj_point_dbl_4(sp_point_256* r, const sp_point_256* p, sp_256_mont_sub_4(y, y, t2, p256_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_dbl_4_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_dbl_4_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_dbl_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_dbl_4_ctx* ctx = (sp_256_proj_point_dbl_4_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_dbl_4_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*4; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_256_mont_sqr_4(ctx->t1, p->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_256_mont_mul_4(ctx->z, p->y, p->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_256_mont_dbl_4(ctx->z, ctx->z, p256_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_256_mont_sub_4(ctx->t2, p->x, ctx->t1, p256_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_256_mont_add_4(ctx->t1, p->x, ctx->t1, p256_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_256_mont_mul_4(ctx->t2, ctx->t1, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_256_mont_tpl_4(ctx->t1, ctx->t2, p256_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_256_mont_dbl_4(ctx->y, p->y, p256_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_256_mont_sqr_4(ctx->y, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_256_mont_sqr_4(ctx->t2, ctx->y, p256_mod, p256_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_256_mont_div2_4(ctx->t2, ctx->t2, p256_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_256_mont_mul_4(ctx->y, ctx->y, p->x, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_256_mont_sqr_4(ctx->x, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - 2*Y */ - /* Y = Y - X */ - sp_256_mont_rsb_sub_dbl_4(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 15; - break; - case 15: - ctx->state = 16; - break; - case 16: - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_256_mont_mul_4(ctx->y, ctx->y, ctx->t1, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_256_mont_sub_4(ctx->y, ctx->y, ctx->t2, p256_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Double the Montgomery form projective point p a number of times. * * @param [in, out] p Point to double and result. @@ -8933,212 +8791,6 @@ static void sp_256_proj_point_add_4(sp_point_256* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_256_proj_point_add_4_ctx { - int state; - sp_256_proj_point_dbl_4_ctx dbl_ctx; - const sp_point_256* ap[2]; - sp_point_256* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_256_proj_point_add_4_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_256_proj_point_add_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, - const sp_point_256* p, const sp_point_256* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_256_proj_point_add_4_ctx* ctx = (sp_256_proj_point_add_4_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_256_proj_point_add_4_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_256* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*4; - ctx->t2 = t + 4*4; - ctx->t3 = t + 6*4; - ctx->t4 = t + 8*4; - ctx->t5 = t + 10*4; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_256_mont_sqr_4(ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 2; - break; - case 2: - sp_256_mont_mul_4(ctx->t3, ctx->t1, q->z, p256_mod, p256_mp_mod); - ctx->state = 3; - break; - case 3: - sp_256_mont_mul_4(ctx->t1, ctx->t1, p->x, p256_mod, p256_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_256_mont_sqr_4(ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 5; - break; - case 5: - sp_256_mont_mul_4(ctx->t4, ctx->t2, p->z, p256_mod, p256_mp_mod); - ctx->state = 6; - break; - case 6: - sp_256_mont_mul_4(ctx->t2, ctx->t2, q->x, p256_mod, p256_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_256_mont_mul_4(ctx->t3, ctx->t3, p->y, p256_mod, p256_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_256_mont_mul_4(ctx->t4, ctx->t4, q->y, p256_mod, p256_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_256_cmp_equal_4(ctx->t2, ctx->t1) & - sp_256_cmp_equal_4(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_256_proj_point_dbl_4(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_256_mont_sub_4(ctx->t2, ctx->t2, ctx->t1, p256_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_256_mont_sub_4(ctx->t4, ctx->t4, ctx->t3, p256_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_256_mont_sqr_4(ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 13; - break; - case 13: - sp_256_mont_mul_4(ctx->y, ctx->t1, ctx->t5, p256_mod, p256_mp_mod); - ctx->state = 14; - break; - case 14: - sp_256_mont_mul_4(ctx->t5, ctx->t5, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_256_mont_mul_4(ctx->z, p->z, ctx->t2, p256_mod, p256_mp_mod); - ctx->state = 16; - break; - case 16: - sp_256_mont_mul_4(ctx->z, ctx->z, q->z, p256_mod, p256_mp_mod); - ctx->state = 17; - break; - case 17: - sp_256_mont_sqr_4(ctx->x, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 18; - break; - case 18: - sp_256_mont_sub_4(ctx->x, ctx->x, ctx->t5, p256_mod); - ctx->state = 19; - break; - case 19: - sp_256_mont_mul_4(ctx->t5, ctx->t5, ctx->t3, p256_mod, p256_mp_mod); - ctx->state = 20; - break; - case 20: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_256_mont_rsb_sub_dbl_4(ctx->x, ctx->x, ctx->y, p256_mod); - ctx->state = 21; - break; - case 21: - ctx->state = 22; - break; - case 22: - sp_256_mont_mul_4(ctx->y, ctx->y, ctx->t4, p256_mod, p256_mp_mod); - ctx->state = 23; - break; - case 23: - sp_256_mont_sub_4(ctx->y, ctx->y, ctx->t5, p256_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 4; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 4; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 4; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Double the Montgomery form projective point p a number of times. * * @param [out] r Result of repeated doubling of point. @@ -11052,10 +10704,6 @@ static int sp_256_ecc_mulmod_avx2_4(sp_point_256* r, const sp_point_256* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_4_ctx { int state; - union { - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; - }; sp_point_256 t[3]; sp_digit tmp[2 * 4 * 6]; sp_digit n; @@ -11130,27 +10778,22 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } ctx->y = (ctx->n >> 63) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_256)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_4(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_256)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_4_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_256)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); - ctx->state = 4; - ctx->c--; - } + sp_256_proj_point_dbl_4(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_256)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_256)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -11181,17 +10824,12 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_4_ctx { int state; - union { - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_256 t[33 + 2]; sp_digit tmp[2 * 4 * 6]; ecc_recode_256 v[43]; int i; - int j; } sp_256_ecc_mulmod_4_ctx; /* Multiply the point by the scalar and return the result. @@ -11217,6 +10855,7 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_256_ecc_mulmod_4_ctx* ctx = (sp_256_ecc_mulmod_4_ctx*)sp_ctx->data; sp_point_256* rt = &ctx->t[33]; sp_point_256* p = &ctx->t[33 + 1]; @@ -11246,29 +10885,20 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, err = sp_256_mod_mul_norm_4(ctx->t[1].z, g->z, p256_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_256_proj_point_dbl_4_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_256_proj_point_dbl_4(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_256_proj_point_add_4(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -11290,19 +10920,13 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_256_proj_point_dbl_4_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_256_proj_point_dbl_4(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -11323,22 +10947,16 @@ static int sp_256_ecc_mulmod_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, XMEMSET(negy, 0, sizeof(sp_digit) * 4); sp_256_mont_sub_4(negy, negy, p->y, p256_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 4); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_256_proj_point_add_4(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -24198,10 +23816,6 @@ static int sp_256_ecc_mulmod_base_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_256_ecc_mulmod_base_4_ctx { int state; - union { - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; - }; sp_point_256 rt; sp_point_256 p; sp_digit tmp[2 * 4 * 6]; @@ -24292,20 +23906,16 @@ static int sp_256_ecc_mulmod_base_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r, sp_256_sub_4(negy, p256_mod, p->y); sp_256_norm_4(negy); sp_256_cond_copy_4(p->y, negy, (sp_digit)(0 - v[ctx->i].neg)); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - ctx->state = 2; - } + sp_256_proj_point_add_qz1_4(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 2; } break; case 4: /* MAP */ @@ -25074,7 +24684,8 @@ typedef struct sp_256_mont_inv_order_4_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -25085,6 +24696,7 @@ static int sp_256_mont_inv_order_4_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_256_mont_inv_order_4_ctx* ctx = (sp_256_mont_inv_order_4_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_256_mont_inv_order_4_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -25097,17 +24709,17 @@ static int sp_256_mont_inv_order_4_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_256_mont_sqr_order_4(t, t); - ctx->state = 2; - break; - case 2: - if ((p256_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_256_mont_mul_order_4(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_256_mont_sqr_order_4(t, t); + if ((p256_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_256_mont_mul_order_4(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 4U); err = MP_OKAY; break; @@ -26164,8 +25776,6 @@ typedef struct sp_ecc_verify_256_ctx { union { sp_256_ecc_mulmod_4_ctx mulmod_ctx; sp_256_mont_inv_order_4_ctx mont_inv_order_ctx; - sp_256_proj_point_dbl_4_ctx dbl_ctx; - sp_256_proj_point_add_4_ctx add_ctx; }; sp_digit u1[2*4]; sp_digit u2[2*4]; @@ -26267,14 +25877,12 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_256_iszero_4(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_256_proj_point_add_4_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_256_proj_point_add_4(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -26329,6 +25937,9 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_256_ctx)); + } return err; } @@ -27672,151 +27283,6 @@ static void sp_384_proj_point_dbl_6(sp_point_384* r, const sp_point_384* p, sp_384_mont_sub_6(y, y, t2, p384_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_dbl_6_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_dbl_6_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_dbl_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_dbl_6_ctx* ctx = (sp_384_proj_point_dbl_6_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_dbl_6_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*6; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_384_mont_sqr_6(ctx->t1, p->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_384_mont_mul_6(ctx->z, p->y, p->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_384_mont_dbl_6(ctx->z, ctx->z, p384_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_384_mont_sub_6(ctx->t2, p->x, ctx->t1, p384_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_384_mont_add_6(ctx->t1, p->x, ctx->t1, p384_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_384_mont_mul_6(ctx->t2, ctx->t1, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_384_mont_tpl_6(ctx->t1, ctx->t2, p384_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_384_mont_dbl_6(ctx->y, p->y, p384_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_384_mont_sqr_6(ctx->y, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_384_mont_sqr_6(ctx->t2, ctx->y, p384_mod, p384_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_384_mont_div2_6(ctx->t2, ctx->t2, p384_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_384_mont_mul_6(ctx->y, ctx->y, p->x, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_384_mont_sqr_6(ctx->x, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->y, p384_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_384_mont_mul_6(ctx->y, ctx->y, ctx->t1, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->t2, p384_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Double the Montgomery form projective point p a number of times. * * @param [in, out] p Point to double and result. @@ -28021,214 +27487,6 @@ static void sp_384_proj_point_add_6(sp_point_384* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_384_proj_point_add_6_ctx { - int state; - sp_384_proj_point_dbl_6_ctx dbl_ctx; - const sp_point_384* ap[2]; - sp_point_384* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_384_proj_point_add_6_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_384_proj_point_add_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, - const sp_point_384* p, const sp_point_384* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_384_proj_point_add_6_ctx* ctx = (sp_384_proj_point_add_6_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_384_proj_point_add_6_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_384* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*6; - ctx->t2 = t + 4*6; - ctx->t3 = t + 6*6; - ctx->t4 = t + 8*6; - ctx->t5 = t + 10*6; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_384_mont_sqr_6(ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 2; - break; - case 2: - sp_384_mont_mul_6(ctx->t3, ctx->t1, q->z, p384_mod, p384_mp_mod); - ctx->state = 3; - break; - case 3: - sp_384_mont_mul_6(ctx->t1, ctx->t1, p->x, p384_mod, p384_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_384_mont_sqr_6(ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 5; - break; - case 5: - sp_384_mont_mul_6(ctx->t4, ctx->t2, p->z, p384_mod, p384_mp_mod); - ctx->state = 6; - break; - case 6: - sp_384_mont_mul_6(ctx->t2, ctx->t2, q->x, p384_mod, p384_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_384_mont_mul_6(ctx->t3, ctx->t3, p->y, p384_mod, p384_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_384_mont_mul_6(ctx->t4, ctx->t4, q->y, p384_mod, p384_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_384_cmp_equal_6(ctx->t2, ctx->t1) & - sp_384_cmp_equal_6(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_384_proj_point_dbl_6(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_384_mont_sub_6(ctx->t2, ctx->t2, ctx->t1, p384_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_384_mont_sub_6(ctx->t4, ctx->t4, ctx->t3, p384_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_384_mont_sqr_6(ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 13; - break; - case 13: - sp_384_mont_mul_6(ctx->y, ctx->t1, ctx->t5, p384_mod, p384_mp_mod); - ctx->state = 14; - break; - case 14: - sp_384_mont_mul_6(ctx->t5, ctx->t5, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_384_mont_mul_6(ctx->z, p->z, ctx->t2, p384_mod, p384_mp_mod); - ctx->state = 16; - break; - case 16: - sp_384_mont_mul_6(ctx->z, ctx->z, q->z, p384_mod, p384_mp_mod); - ctx->state = 17; - break; - case 17: - sp_384_mont_sqr_6(ctx->x, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 18; - break; - case 18: - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->t5, p384_mod); - ctx->state = 19; - break; - case 19: - sp_384_mont_mul_6(ctx->t5, ctx->t5, ctx->t3, p384_mod, p384_mp_mod); - ctx->state = 20; - break; - case 20: - sp_384_mont_dbl_6(ctx->t3, ctx->y, p384_mod); - sp_384_mont_sub_6(ctx->x, ctx->x, ctx->t3, p384_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->x, p384_mod); - ctx->state = 22; - break; - case 22: - sp_384_mont_mul_6(ctx->y, ctx->y, ctx->t4, p384_mod, p384_mp_mod); - ctx->state = 23; - break; - case 23: - sp_384_mont_sub_6(ctx->y, ctx->y, ctx->t5, p384_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 6; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 6; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 6; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Double the Montgomery form projective point p a number of times. * * @param [out] r Result of repeated doubling of point. @@ -30201,10 +29459,6 @@ static int sp_384_ecc_mulmod_avx2_6(sp_point_384* r, const sp_point_384* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_6_ctx { int state; - union { - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; - }; sp_point_384 t[3]; sp_digit tmp[2 * 6 * 6]; sp_digit n; @@ -30279,27 +29533,22 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } ctx->y = (ctx->n >> 63) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_384)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_6(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_384)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_6_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_384)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); - ctx->state = 4; - ctx->c--; - } + sp_384_proj_point_dbl_6(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_384)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_384)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -30330,17 +29579,12 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_6_ctx { int state; - union { - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_384 t[33 + 2]; sp_digit tmp[2 * 6 * 6]; ecc_recode_384 v[65]; int i; - int j; } sp_384_ecc_mulmod_6_ctx; /* Multiply the point by the scalar and return the result. @@ -30366,6 +29610,7 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_384_ecc_mulmod_6_ctx* ctx = (sp_384_ecc_mulmod_6_ctx*)sp_ctx->data; sp_point_384* rt = &ctx->t[33]; sp_point_384* p = &ctx->t[33 + 1]; @@ -30395,29 +29640,20 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, err = sp_384_mod_mul_norm_6(ctx->t[1].z, g->z, p384_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_384_proj_point_dbl_6_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_384_proj_point_dbl_6(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_384_proj_point_add_6(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -30439,19 +29675,13 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_384_proj_point_dbl_6_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_384_proj_point_dbl_6(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -30472,22 +29702,16 @@ static int sp_384_ecc_mulmod_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, XMEMSET(negy, 0, sizeof(sp_digit) * 6); sp_384_mont_sub_6(negy, negy, p->y, p384_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 6); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_384_proj_point_add_6(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -49161,10 +48385,6 @@ static int sp_384_ecc_mulmod_base_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_384_ecc_mulmod_base_6_ctx { int state; - union { - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; - }; sp_point_384 rt; sp_point_384 p; sp_digit tmp[2 * 6 * 6]; @@ -49255,20 +48475,16 @@ static int sp_384_ecc_mulmod_base_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r, sp_384_sub_6(negy, p384_mod, p->y); sp_384_norm_6(negy); sp_384_cond_copy_6(p->y, negy, (sp_digit)(0 - v[ctx->i].neg)); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - ctx->state = 2; - } + sp_384_proj_point_add_qz1_6(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 2; } break; case 4: /* MAP */ @@ -50039,7 +49255,8 @@ typedef struct sp_384_mont_inv_order_6_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -50050,6 +49267,7 @@ static int sp_384_mont_inv_order_6_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_384_mont_inv_order_6_ctx* ctx = (sp_384_mont_inv_order_6_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_384_mont_inv_order_6_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -50062,17 +49280,17 @@ static int sp_384_mont_inv_order_6_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_384_mont_sqr_order_6(t, t); - ctx->state = 2; - break; - case 2: - if ((p384_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_384_mont_mul_order_6(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_384_mont_sqr_order_6(t, t); + if ((p384_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_384_mont_mul_order_6(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 6U); err = MP_OKAY; break; @@ -51094,8 +50312,6 @@ typedef struct sp_ecc_verify_384_ctx { union { sp_384_ecc_mulmod_6_ctx mulmod_ctx; sp_384_mont_inv_order_6_ctx mont_inv_order_ctx; - sp_384_proj_point_dbl_6_ctx dbl_ctx; - sp_384_proj_point_add_6_ctx add_ctx; }; sp_digit u1[2*6]; sp_digit u2[2*6]; @@ -51197,14 +50413,12 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_384_iszero_6(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_384_proj_point_add_6_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_384_proj_point_add_6(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -51259,6 +50473,9 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_384_ctx)); + } return err; } @@ -52570,151 +51787,6 @@ static void sp_521_proj_point_dbl_9(sp_point_521* r, const sp_point_521* p, sp_521_mont_sub_9(y, y, t2, p521_mod); } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_dbl_9_ctx { - int state; - sp_digit* t1; - sp_digit* t2; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_dbl_9_ctx; - -/* Double the Montgomery form projective point p. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of doubling point. - * @param [in] p Point to double. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_dbl_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_dbl_9_ctx* ctx = (sp_521_proj_point_dbl_9_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_dbl_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - switch (ctx->state) { - case 0: - ctx->t1 = t; - ctx->t2 = t + 2*9; - ctx->x = r->x; - ctx->y = r->y; - ctx->z = r->z; - - /* Put infinity into result. */ - if (r != p) { - r->infinity = p->infinity; - } - ctx->state = 1; - break; - case 1: - /* T1 = Z * Z */ - sp_521_mont_sqr_9(ctx->t1, p->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - /* Z = Y * Z */ - sp_521_mont_mul_9(ctx->z, p->y, p->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - /* Z = 2Z */ - sp_521_mont_dbl_9(ctx->z, ctx->z, p521_mod); - ctx->state = 4; - break; - case 4: - /* T2 = X - T1 */ - sp_521_mont_sub_9(ctx->t2, p->x, ctx->t1, p521_mod); - ctx->state = 5; - break; - case 5: - /* T1 = X + T1 */ - sp_521_mont_add_9(ctx->t1, p->x, ctx->t1, p521_mod); - ctx->state = 6; - break; - case 6: - /* T2 = T1 * T2 */ - sp_521_mont_mul_9(ctx->t2, ctx->t1, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* T1 = 3T2 */ - sp_521_mont_tpl_9(ctx->t1, ctx->t2, p521_mod); - ctx->state = 8; - break; - case 8: - /* Y = 2Y */ - sp_521_mont_dbl_9(ctx->y, p->y, p521_mod); - ctx->state = 9; - break; - case 9: - /* Y = Y * Y */ - sp_521_mont_sqr_9(ctx->y, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 10; - break; - case 10: - /* T2 = Y * Y */ - sp_521_mont_sqr_9(ctx->t2, ctx->y, p521_mod, p521_mp_mod); - ctx->state = 11; - break; - case 11: - /* T2 = T2/2 */ - sp_521_mont_div2_9(ctx->t2, ctx->t2, p521_mod); - ctx->state = 12; - break; - case 12: - /* Y = Y * X */ - sp_521_mont_mul_9(ctx->y, ctx->y, p->x, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - /* X = T1 * T1 */ - sp_521_mont_sqr_9(ctx->x, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - /* X = X - Y */ - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 15; - break; - case 15: - /* X = X - Y */ - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->y, p521_mod); - ctx->state = 16; - break; - case 16: - /* Y = Y - X */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 17; - break; - case 17: - /* Y = Y * T1 */ - sp_521_mont_mul_9(ctx->y, ctx->y, ctx->t1, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - /* Y = Y - T2 */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->t2, p521_mod); - ctx->state = 19; - FALL_THROUGH; - case 19: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 19) { - err = FP_WOULDBLOCK; - } - - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ /* Double the Montgomery form projective point p a number of times. * * @param [in, out] p Point to double and result. @@ -52921,214 +51993,6 @@ static void sp_521_proj_point_add_9(sp_point_521* r, } } -#ifdef WOLFSSL_SP_NONBLOCK -typedef struct sp_521_proj_point_add_9_ctx { - int state; - sp_521_proj_point_dbl_9_ctx dbl_ctx; - const sp_point_521* ap[2]; - sp_point_521* rp[2]; - sp_digit* t1; - sp_digit* t2; - sp_digit* t3; - sp_digit* t4; - sp_digit* t5; - sp_digit* t6; - sp_digit* x; - sp_digit* y; - sp_digit* z; -} sp_521_proj_point_add_9_ctx; - -/* Add two Montgomery form projective points. - * - * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. - * - * @param [in, out] sp_ctx Context to save state in for non-blocking calls. - * @param [out] r Result of addition. - * @param [in] p First point to add. - * @param [in] q Second point to add. - * @param [out] t Temporary ordinate data. - */ -static int sp_521_proj_point_add_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, - const sp_point_521* p, const sp_point_521* q, sp_digit* t) -{ - int err = FP_WOULDBLOCK; - sp_521_proj_point_add_9_ctx* ctx = (sp_521_proj_point_add_9_ctx*)sp_ctx->data; - - typedef char ctx_size_test[sizeof(sp_521_proj_point_add_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; - (void)sizeof(ctx_size_test); - - /* Ensure only the first point is the same as the result. */ - if (q == r) { - const sp_point_521* a = p; - p = q; - q = a; - } - - switch (ctx->state) { - case 0: /* INIT */ - ctx->t6 = t; - ctx->t1 = t + 2*9; - ctx->t2 = t + 4*9; - ctx->t3 = t + 6*9; - ctx->t4 = t + 8*9; - ctx->t5 = t + 10*9; - ctx->x = ctx->t6; - ctx->y = ctx->t1; - ctx->z = ctx->t2; - - ctx->state = 1; - break; - case 1: - /* U1 = X1*Z2^2 */ - sp_521_mont_sqr_9(ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 2; - break; - case 2: - sp_521_mont_mul_9(ctx->t3, ctx->t1, q->z, p521_mod, p521_mp_mod); - ctx->state = 3; - break; - case 3: - sp_521_mont_mul_9(ctx->t1, ctx->t1, p->x, p521_mod, p521_mp_mod); - ctx->state = 4; - break; - case 4: - /* U2 = X2*Z1^2 */ - sp_521_mont_sqr_9(ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 5; - break; - case 5: - sp_521_mont_mul_9(ctx->t4, ctx->t2, p->z, p521_mod, p521_mp_mod); - ctx->state = 6; - break; - case 6: - sp_521_mont_mul_9(ctx->t2, ctx->t2, q->x, p521_mod, p521_mp_mod); - ctx->state = 7; - break; - case 7: - /* S1 = Y1*Z2^3 */ - sp_521_mont_mul_9(ctx->t3, ctx->t3, p->y, p521_mod, p521_mp_mod); - ctx->state = 8; - break; - case 8: - /* S2 = Y2*Z1^3 */ - sp_521_mont_mul_9(ctx->t4, ctx->t4, q->y, p521_mod, p521_mp_mod); - ctx->state = 9; - break; - case 9: - /* Check double */ - if ((~p->infinity) & (~q->infinity) & - sp_521_cmp_equal_9(ctx->t2, ctx->t1) & - sp_521_cmp_equal_9(ctx->t4, ctx->t3)) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - sp_521_proj_point_dbl_9(r, p, t); - ctx->state = 25; - } - else { - ctx->state = 10; - } - break; - case 10: - /* H = U2 - U1 */ - sp_521_mont_sub_9(ctx->t2, ctx->t2, ctx->t1, p521_mod); - ctx->state = 11; - break; - case 11: - /* R = S2 - S1 */ - sp_521_mont_sub_9(ctx->t4, ctx->t4, ctx->t3, p521_mod); - ctx->state = 12; - break; - case 12: - /* X3 = R^2 - H^3 - 2*U1*H^2 */ - sp_521_mont_sqr_9(ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 13; - break; - case 13: - sp_521_mont_mul_9(ctx->y, ctx->t1, ctx->t5, p521_mod, p521_mp_mod); - ctx->state = 14; - break; - case 14: - sp_521_mont_mul_9(ctx->t5, ctx->t5, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 15; - break; - case 15: - /* Z3 = H*Z1*Z2 */ - sp_521_mont_mul_9(ctx->z, p->z, ctx->t2, p521_mod, p521_mp_mod); - ctx->state = 16; - break; - case 16: - sp_521_mont_mul_9(ctx->z, ctx->z, q->z, p521_mod, p521_mp_mod); - ctx->state = 17; - break; - case 17: - sp_521_mont_sqr_9(ctx->x, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 18; - break; - case 18: - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->t5, p521_mod); - ctx->state = 19; - break; - case 19: - sp_521_mont_mul_9(ctx->t5, ctx->t5, ctx->t3, p521_mod, p521_mp_mod); - ctx->state = 20; - break; - case 20: - sp_521_mont_dbl_9(ctx->t3, ctx->y, p521_mod); - sp_521_mont_sub_9(ctx->x, ctx->x, ctx->t3, p521_mod); - ctx->state = 21; - break; - case 21: - /* Y3 = R*(U1*H^2 - X3) - S1*H^3 */ - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->x, p521_mod); - ctx->state = 22; - break; - case 22: - sp_521_mont_mul_9(ctx->y, ctx->y, ctx->t4, p521_mod, p521_mp_mod); - ctx->state = 23; - break; - case 23: - sp_521_mont_sub_9(ctx->y, ctx->y, ctx->t5, p521_mod); - ctx->state = 24; - break; - case 24: - { - { - int i; - sp_digit maskp = (sp_digit)(0 - (q->infinity & (!p->infinity))); - sp_digit maskq = (sp_digit)(0 - (p->infinity & (!q->infinity))); - sp_digit maskt = ~(maskp | maskq); - sp_digit inf = (sp_digit)(p->infinity & q->infinity); - - for (i = 0; i < 9; i++) { - r->x[i] = (p->x[i] & maskp) | (q->x[i] & maskq) | - (ctx->x[i] & maskt); - } - for (i = 0; i < 9; i++) { - r->y[i] = (p->y[i] & maskp) | (q->y[i] & maskq) | - (ctx->y[i] & maskt); - } - for (i = 0; i < 9; i++) { - r->z[i] = (p->z[i] & maskp) | (q->z[i] & maskq) | - (ctx->z[i] & maskt); - } - r->z[0] |= inf; - r->infinity = (int)inf; - } - ctx->state = 25; - break; - } - case 25: - err = MP_OKAY; - break; - } - - if (err == MP_OKAY && ctx->state != 25) { - err = FP_WOULDBLOCK; - } - return err; -} -#endif /* WOLFSSL_SP_NONBLOCK */ - /* Double the Montgomery form projective point p a number of times. * * @param [out] r Result of repeated doubling of point. @@ -55076,10 +53940,6 @@ static int sp_521_ecc_mulmod_avx2_9(sp_point_521* r, const sp_point_521* g, #if defined(WOLFSSL_SP_NONBLOCK) && defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; sp_point_521 t[3]; sp_digit tmp[2 * 9 * 6]; sp_digit n; @@ -55154,27 +54014,22 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } ctx->y = (ctx->n >> 63) & 1; ctx->n = (sp_uint64)ctx->n << 1; - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 5; break; case 5: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), sizeof(sp_point_521)); - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_9(&ctx->t[ctx->y^1], &ctx->t[0], &ctx->t[1], + ctx->tmp); + sp_cond_select(&ctx->t[2], &ctx->t[0], &ctx->t[1], (ctx->y), + sizeof(sp_point_521)); + ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, &ctx->t[2], - &ctx->t[2], ctx->tmp); - if (err == MP_OKAY) { - sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, sizeof(sp_point_521)); - sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); - ctx->state = 4; - ctx->c--; - } + sp_521_proj_point_dbl_9(&ctx->t[2], &ctx->t[2], ctx->tmp); + sp_cond_memcpy(&ctx->t[0], &ctx->t[2], (ctx->y)^1, + sizeof(sp_point_521)); + sp_cond_memcpy(&ctx->t[1], &ctx->t[2], (ctx->y), sizeof(sp_point_521)); + ctx->state = 4; + ctx->c--; break; case 7: /* MAP */ if (map != 0) { @@ -55205,17 +54060,12 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; /* Table of 0..32 times the point, then the result and the point * to add. */ sp_point_521 t[33 + 2]; sp_digit tmp[2 * 9 * 6]; ecc_recode_521 v[87]; int i; - int j; } sp_521_ecc_mulmod_9_ctx; /* Multiply the point by the scalar and return the result. @@ -55241,6 +54091,7 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, { int err = FP_WOULDBLOCK; int done = 0; + int j; sp_521_ecc_mulmod_9_ctx* ctx = (sp_521_ecc_mulmod_9_ctx*)sp_ctx->data; sp_point_521* rt = &ctx->t[33]; sp_point_521* p = &ctx->t[33 + 1]; @@ -55270,29 +54121,20 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, err = sp_521_mod_mul_norm_9(ctx->t[1].z, g->z, p521_mod); ctx->t[1].infinity = 0; ctx->i = 2; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 4; break; case 4: /* TABLE: t[i] = 2 * t[i/2] or t[i-1] + t[1] */ if ((ctx->i & 1) == 0) { - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i / 2], ctx->tmp); + sp_521_proj_point_dbl_9(&ctx->t[ctx->i], &ctx->t[ctx->i / 2], + ctx->tmp); } else { - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, - &ctx->t[ctx->i], &ctx->t[ctx->i - 1], &ctx->t[1], ctx->tmp); + sp_521_proj_point_add_9(&ctx->t[ctx->i], &ctx->t[ctx->i - 1], + &ctx->t[1], ctx->tmp); } - if (err == MP_OKAY) { - ctx->i++; - if ((ctx->i & 1) == 0) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - } - else { - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); - } - if (ctx->i == 33) { - ctx->state = 5; - } + ctx->i++; + if (ctx->i == 33) { + ctx->state = 5; } break; case 5: /* RECODE */ @@ -55314,19 +54156,13 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, } rt->infinity = !ctx->v[ctx->i].i; ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); ctx->state = 6; break; case 6: /* DBL */ - err = sp_521_proj_point_dbl_9_nb((sp_ecc_ctx_t*)&ctx->dbl_ctx, rt, rt, - ctx->tmp); - if (err == MP_OKAY) { - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - if (++ctx->j == 6) { - ctx->state = 7; - } + for (j = 0; j < 6; j++) { + sp_521_proj_point_dbl_9(rt, rt, ctx->tmp); } + ctx->state = 7; break; case 7: /* GETPOINT */ #ifndef WC_NO_CACHE_RESISTANT @@ -55347,22 +54183,16 @@ static int sp_521_ecc_mulmod_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, XMEMSET(negy, 0, sizeof(sp_digit) * 9); sp_521_mont_sub_9(negy, negy, p->y, p521_mod); sp_cond_memcpy(p->y, negy, ctx->v[ctx->i].neg, sizeof(sp_digit) * 9); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; break; case 8: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 9; - } - else { - ctx->i--; - ctx->j = 0; - XMEMSET(&ctx->dbl_ctx, 0, sizeof(ctx->dbl_ctx)); - ctx->state = 6; - } + sp_521_proj_point_add_9(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 9; + } + else { + ctx->i--; + ctx->state = 6; } break; case 9: /* MAP */ @@ -90222,10 +89052,6 @@ static int sp_521_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, #if defined(WOLFSSL_SP_NONBLOCK) && !defined(WOLFSSL_SP_SMALL) typedef struct sp_521_ecc_mulmod_base_9_ctx { int state; - union { - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; - }; sp_point_521 rt; sp_point_521 p; sp_digit tmp[2 * 9 * 6]; @@ -90316,20 +89142,16 @@ static int sp_521_ecc_mulmod_base_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r, sp_521_sub_9(negy, p521_mod, p->y); sp_521_norm_9(negy); sp_521_cond_copy_9(p->y, negy, (sp_digit)(0 - v[ctx->i].neg)); - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 3; break; case 3: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, rt, rt, p, - ctx->tmp); - if (err == MP_OKAY) { - if (ctx->i == 0) { - ctx->state = 4; - } - else { - ctx->i--; - ctx->state = 2; - } + sp_521_proj_point_add_qz1_9(rt, rt, p, ctx->tmp); + if (ctx->i == 0) { + ctx->state = 4; + } + else { + ctx->i--; + ctx->state = 2; } break; case 4: /* MAP */ @@ -91130,7 +89952,8 @@ typedef struct sp_521_mont_inv_order_9_ctx { * (r = 1 / a mod order) * * Non-blocking version. Call repeatedly until it does not return - * FP_WOULDBLOCK. State is saved and restored through sp_ctx. + * FP_WOULDBLOCK. State is saved and restored through sp_ctx. Each call + * processes one digit of exponent bits. * * @param [in, out] sp_ctx Context to save state in for non-blocking calls. * @param [out] r Inverse result. @@ -91141,6 +89964,7 @@ static int sp_521_mont_inv_order_9_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s sp_digit* t) { int err = FP_WOULDBLOCK; + int j; sp_521_mont_inv_order_9_ctx* ctx = (sp_521_mont_inv_order_9_ctx*)sp_ctx; typedef char ctx_size_test[sizeof(sp_521_mont_inv_order_9_ctx) >= sizeof(*sp_ctx) ? -1 : 1]; @@ -91153,17 +89977,17 @@ static int sp_521_mont_inv_order_9_nb(sp_ecc_ctx_t* sp_ctx, sp_digit* r, const s ctx->state = 1; break; case 1: - sp_521_mont_sqr_order_9(t, t); - ctx->state = 2; - break; - case 2: - if ((p521_order_minus_2[ctx->i / 64] & ((sp_int_digit)1 << (ctx->i % 64))) != 0) { - sp_521_mont_mul_order_9(t, t, a); + for (j = 0; (j < 64) && (ctx->i >= 0); j++) { + sp_521_mont_sqr_order_9(t, t); + if ((p521_order_minus_2[ctx->i / 64] & + ((sp_int_digit)1 << (ctx->i % 64))) != 0) { + sp_521_mont_mul_order_9(t, t, a); + } + ctx->i--; } - ctx->i--; - ctx->state = (ctx->i >= 0) ? 1 : 3; + ctx->state = (ctx->i >= 0) ? 1 : 2; break; - case 3: + case 2: XMEMCPY(r, t, sizeof(sp_digit) * 9U); err = MP_OKAY; break; @@ -92226,8 +91050,6 @@ typedef struct sp_ecc_verify_521_ctx { union { sp_521_ecc_mulmod_9_ctx mulmod_ctx; sp_521_mont_inv_order_9_ctx mont_inv_order_ctx; - sp_521_proj_point_dbl_9_ctx dbl_ctx; - sp_521_proj_point_add_9_ctx add_ctx; }; sp_digit u1[2*9]; sp_digit u2[2*9]; @@ -92332,14 +91154,12 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (sp_521_iszero_9(ctx->p2.z)) { ctx->p2.infinity = 1; } - XMEMSET(&ctx->add_ctx, 0, sizeof(ctx->add_ctx)); ctx->state = 8; } break; case 8: /* ADD */ - err = sp_521_proj_point_add_9_nb((sp_ecc_ctx_t*)&ctx->add_ctx, &ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); - if (err == MP_OKAY) - ctx->state = 9; + sp_521_proj_point_add_9(&ctx->p1, &ctx->p1, &ctx->p2, ctx->tmp); + ctx->state = 9; break; case 9: /* MONT */ /* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */ @@ -92394,6 +91214,9 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, if (err == MP_OKAY && ctx->state != 12) { err = FP_WOULDBLOCK; } + if (err != FP_WOULDBLOCK) { + ForceZero(ctx, sizeof(sp_ecc_verify_521_ctx)); + } return err; } diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index f36e7096961..10cc76a4bb3 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -57678,6 +57678,76 @@ static wc_test_ret_t ecc_test_nonblock_dhe(int curveId, word32 curveSz, #endif /* HAVE_ECC_DHE && !WOLFSSL_VALIDATE_ECC_KEYGEN */ #if defined(HAVE_ECC_SIGN) && defined(HAVE_ECC_VERIFY) +/* Two verifies through one key and non-blocking context: the second must start + * from a clean state and reject a corrupted signature. */ +static wc_test_ret_t crypto_ecc_verify_reuse(const byte *key, + const byte *hash, word32 hashSz, const byte *sig, word32 sigSz, + word32 curveSz, int curveId) +{ + wc_test_ret_t ret; + int i; + int verify_res; + mp_int r, s; + ecc_key ecc; + ecc_nb_ctx_t nb_ctx; + byte badSig[MAX_ECC_BYTES * 2]; + + if (sigSz > sizeof(badSig)) { + return WC_TEST_RET_ENC_NC; + } + XMEMCPY(badSig, sig, sigSz); + badSig[sigSz - 1] ^= 0x01; + + ret = wc_ecc_init(&ecc); + if (ret < 0) { + return WC_TEST_RET_ENC_EC(ret); + } + ret = mp_init(&r); + if (ret != MP_OKAY) { + wc_ecc_free(&ecc); + return WC_TEST_RET_ENC_EC(ret); + } + ret = mp_init(&s); + if (ret != MP_OKAY) { + mp_clear(&r); + wc_ecc_free(&ecc); + return WC_TEST_RET_ENC_EC(ret); + } + + ret = wc_ecc_set_nonblock(&ecc, &nb_ctx); + if (ret == 0) { + ret = wc_ecc_import_unsigned(&ecc, (byte*)key, (byte*)(key + curveSz), + NULL, curveId); + } + for (i = 0; ret == 0 && i < 2; i++) { + const byte* cur = (i == 0) ? sig : badSig; + + ret = mp_read_unsigned_bin(&r, cur, curveSz); + if (ret == 0) { + ret = mp_read_unsigned_bin(&s, cur + curveSz, curveSz); + } + if (ret == 0) { + verify_res = 0; + do { + ret = wc_ecc_verify_hash_ex(&r, &s, hash, hashSz, &verify_res, + &ecc); + } while (ret == FP_WOULDBLOCK); + } + if (ret < 0) { + ret = WC_TEST_RET_ENC_EC(ret); + } + else if (verify_res != (i == 0)) { + ret = WC_TEST_RET_ENC_NC; + } + } + + mp_clear(&r); + mp_clear(&s); + wc_ecc_free(&ecc); + + return ret; +} + static wc_test_ret_t ecc_test_nonblock_ecdsa(int curveId, word32 curveSz, const byte* privKey, word32 privKeySz, const byte* pubKey, word32 pubKeySz, WC_RNG* rng) @@ -57708,6 +57778,10 @@ static wc_test_ret_t ecc_test_nonblock_ecdsa(int curveId, word32 curveSz, ret = crypto_ecc_verify(pubKey, pubKeySz, hash, sizeof(hash), sig, sigSz, curveSz, curveId); } + if (ret == 0) { + ret = crypto_ecc_verify_reuse(pubKey, hash, sizeof(hash), sig, sigSz, + curveSz, curveId); + } XFREE(sig, HEAP_HINT, DYNAMIC_TYPE_SIGNATURE);