From 6b0778dbefe807bded25bf8ef2b127481f9089e5 Mon Sep 17 00:00:00 2001 From: Armin Pribbernow Date: Fri, 9 Oct 2026 14:39:40 +0000 Subject: [PATCH 1/5] wolfcrypt: avoid signed overflow in ML-DSA and C SP arithmetic Without -fwrapv, signed overflow in ML-DSA reduction, SP bit lookups, ECC packing, and C32 RSA/DH Toom-3 and Karatsuba interpolation is reported by UBSan. Keep required low-word products and subtractions unsigned until carries can be normalized without overflow. Document bounds for multiplication and squaring, including Karatsuba sums. Numerical results retain the previous two's-complement behavior. Exercise software P-256 sign/verify and seeded ML-DSA key generation in wolfCrypt tests. Add near-maximum 2048-, 3072- and 4096-bit modular exponentiation known-answer tests through wc_RsaFunction(). Exclude validated FIPS/selftest RSA implementations and encode test errors consistently. Skip the final-standard public-key digest in FIPS 204 draft mode. Add a ChangeLog entry. Test with Clang UBSan and -fno-wrapv on both C SP backends, including small/nonblocking, SAKKE, ML-DSA feature variants, FIPS 204 draft, SIGN_CHECK_Y, SIGN_CHECK_W0 and native 32-bit builds. testwolfcrypt passes all thirteen runnable configurations; configuration 1 make check retains only the unrelated PemToDer null-pointer finding. --- wolfcrypt/src/sp_c32.c | 262 ++++++++++++++++++---------------------- wolfcrypt/src/sp_c64.c | 128 +++++++++----------- wolfcrypt/test/test.c | 268 ++++++++++++++++++++++++++++++++++++++++- 3 files changed, 437 insertions(+), 221 deletions(-) diff --git a/wolfcrypt/src/sp_c32.c b/wolfcrypt/src/sp_c32.c index a77950d41cf..d00267f4c94 100644 --- a/wolfcrypt/src/sp_c32.c +++ b/wolfcrypt/src/sp_c32.c @@ -794,15 +794,24 @@ SP_NOINLINE static int sp_2048_sub_24(sp_digit* r, const sp_digit* a, { int i; + /* Inputs to sp_2048_mul_36() and sp_2048_sqr_36() have limbs 0..34 below + * 2^29 and each 12-limb chunk below 2^(12*29) + 2^(11*29). This holds for + * normalized 36-limb operands and normalized Karatsuba sums built by + * sp_2048_mul_72() and sp_2048_sqr_72(). The final Toom-3 cross terms sum + * two chunk products: low limbs are in [-2, 3]*(2^29-1), and the high limb + * is below 2*2^29+7. The following add_24 keeps the overlapping high limb + * below 3*2^29+7. These bounds show add_24 and norm_24 cannot overflow. + * The subtraction itself keeps the low word, identical to -fwrapv + * regardless of the bounds; cancellation precedes normalization. */ for (i = 0; i < 24; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); } return 0; @@ -10714,20 +10723,27 @@ SP_NOINLINE static int sp_3072_sub_28(sp_digit* r, const sp_digit* a, { int i; + /* In sp_3072_mul_28() and sp_3072_sqr_28(), the leaf multipliers + * accumulate in sp_uint64. Their top limb is converted to sp_digit + * and may wrap (implementation-defined, not undefined behaviour). + * Each 14-limb half is below 2*2^(14*28), so the final Karatsuba cross + * term is below 4*2^(28*28) and its true high limb fits sp_digit. Both + * subtractions are done modulo 2^32 so the wrap cancels before carry + * normalization. */ for (i = 0; i < 24; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[24] = a[24] - b[24]; - r[25] = a[25] - b[25]; - r[26] = a[26] - b[26]; - r[27] = a[27] - b[27]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); + } + r[24] = (sp_digit)((sp_uint32)a[24] - (sp_uint32)b[24]); + r[25] = (sp_digit)((sp_uint32)a[25] - (sp_uint32)b[25]); + r[26] = (sp_digit)((sp_uint32)a[26] - (sp_uint32)b[26]); + r[27] = (sp_digit)((sp_uint32)a[27] - (sp_uint32)b[27]); return 0; } @@ -25647,30 +25663,21 @@ static int sp_256_mod_mul_norm_9(sp_digit* r, const sp_digit* a, const sp_digit* if (err == MP_OKAY) { a32 = t + 8; - a32[0] = a[0]; - a32[0] |= (int64_t)a[1] << 29U; - a32[0] &= 0xffffffffL; - a32[1] = (a[1] >> 3); - a32[1] |= (int64_t)a[2] << 26U; - a32[1] &= 0xffffffffL; - a32[2] = (a[2] >> 6); - a32[2] |= (int64_t)a[3] << 23U; - a32[2] &= 0xffffffffL; - a32[3] = (a[3] >> 9); - a32[3] |= (int64_t)a[4] << 20U; - a32[3] &= 0xffffffffL; - a32[4] = (a[4] >> 12); - a32[4] |= (int64_t)a[5] << 17U; - a32[4] &= 0xffffffffL; - a32[5] = (a[5] >> 15); - a32[5] |= (int64_t)a[6] << 14U; - a32[5] &= 0xffffffffL; - a32[6] = (a[6] >> 18); - a32[6] |= (int64_t)a[7] << 11U; - a32[6] &= 0xffffffffL; - a32[7] = (a[7] >> 21); - a32[7] |= (int64_t)a[8] << 8U; - a32[7] &= 0xffffffffL; + a32[0] = (sp_uint32)a[0] | ((sp_uint32)a[1] << 29U); + a32[1] = ((sp_uint32)a[1] >> 3U) | + ((sp_uint32)a[2] << 26U); + a32[2] = ((sp_uint32)a[2] >> 6U) | + ((sp_uint32)a[3] << 23U); + a32[3] = ((sp_uint32)a[3] >> 9U) | + ((sp_uint32)a[4] << 20U); + a32[4] = ((sp_uint32)a[4] >> 12U) | + ((sp_uint32)a[5] << 17U); + a32[5] = ((sp_uint32)a[5] >> 15U) | + ((sp_uint32)a[6] << 14U); + a32[6] = ((sp_uint32)a[6] >> 18U) | + ((sp_uint32)a[7] << 11U); + a32[7] = ((sp_uint32)a[7] >> 21U) | + ((sp_uint32)a[8] << 8U); /* 1 1 0 -1 -1 -1 -1 0 */ t[0] = 0 + a32[0] + a32[1] - a32[3] - a32[4] - a32[5] - a32[6]; @@ -25709,28 +25716,21 @@ static int sp_256_mod_mul_norm_9(sp_digit* r, const sp_digit* a, const sp_digit* t[6] += t[5] >> 32U; t[5] &= 0xffffffffL; t[7] += t[6] >> 32U; t[6] &= 0xffffffffL; - r[0] = (sp_digit)(t[0]) & 0x1fffffffL; - r[1] = (sp_digit)(t[0] >> 29U); - r[1] |= (sp_digit)((sp_uint32)t[1] << 3U); - r[1] &= 0x1fffffffL; - r[2] = (sp_digit)(t[1] >> 26U); - r[2] |= (sp_digit)((sp_uint32)t[2] << 6U); - r[2] &= 0x1fffffffL; - r[3] = (sp_digit)(t[2] >> 23U); - r[3] |= (sp_digit)((sp_uint32)t[3] << 9U); - r[3] &= 0x1fffffffL; - r[4] = (sp_digit)(t[3] >> 20U); - r[4] |= (sp_digit)((sp_uint32)t[4] << 12U); - r[4] &= 0x1fffffffL; - r[5] = (sp_digit)(t[4] >> 17U); - r[5] |= (sp_digit)((sp_uint32)t[5] << 15U); - r[5] &= 0x1fffffffL; - r[6] = (sp_digit)(t[5] >> 14U); - r[6] |= (sp_digit)((sp_uint32)t[6] << 18U); - r[6] &= 0x1fffffffL; - r[7] = (sp_digit)(t[6] >> 11U); - r[7] |= (sp_digit)((sp_uint32)t[7] << 21U); - r[7] &= 0x1fffffffL; + r[0] = (sp_digit)((sp_uint32)t[0] & 0x1fffffffU); + r[1] = (sp_digit)((((sp_uint32)t[0] >> 29U) | + ((sp_uint32)t[1] << 3U)) & 0x1fffffffU); + r[2] = (sp_digit)((((sp_uint32)t[1] >> 26U) | + ((sp_uint32)t[2] << 6U)) & 0x1fffffffU); + r[3] = (sp_digit)((((sp_uint32)t[2] >> 23U) | + ((sp_uint32)t[3] << 9U)) & 0x1fffffffU); + r[4] = (sp_digit)((((sp_uint32)t[3] >> 20U) | + ((sp_uint32)t[4] << 12U)) & 0x1fffffffU); + r[5] = (sp_digit)((((sp_uint32)t[4] >> 17U) | + ((sp_uint32)t[5] << 15U)) & 0x1fffffffU); + r[6] = (sp_digit)((((sp_uint32)t[5] >> 14U) | + ((sp_uint32)t[6] << 18U)) & 0x1fffffffU); + r[7] = (sp_digit)((((sp_uint32)t[6] >> 11U) | + ((sp_uint32)t[7] << 21U)) & 0x1fffffffU); r[8] = (sp_digit)(t[7] >> 8U); } @@ -30083,7 +30083,7 @@ static int sp_256_num_bits_29_9(sp_digit v) v |= v >> 4; v |= v >> 8; v |= v >> 16; - return sp_256_tab32_9[(word32)(v*0x07C4ACDD) >> 27]; + return sp_256_tab32_9[((sp_uint32)v * 0x07C4ACDDU) >> 27]; } /* Get the number of bits in the number. @@ -33255,44 +33255,29 @@ static int sp_384_mod_mul_norm_15(sp_digit* r, const sp_digit* a, const sp_digit if (err == MP_OKAY) { a32 = t + 12; - a32[0] = a[0]; - a32[0] |= (int64_t)a[1] << 26U; - a32[0] &= 0xffffffffL; - a32[1] = (a[1] >> 6); - a32[1] |= (int64_t)a[2] << 20U; - a32[1] &= 0xffffffffL; - a32[2] = (a[2] >> 12); - a32[2] |= (int64_t)a[3] << 14U; - a32[2] &= 0xffffffffL; - a32[3] = (a[3] >> 18); - a32[3] |= (int64_t)a[4] << 8U; - a32[3] &= 0xffffffffL; - a32[4] = (a[4] >> 24); - a32[4] |= (int64_t)a[5] << 2U; - a32[4] |= (int64_t)a[6] << 28U; - a32[4] &= 0xffffffffL; - a32[5] = (a[6] >> 4); - a32[5] |= (int64_t)a[7] << 22U; - a32[5] &= 0xffffffffL; - a32[6] = (a[7] >> 10); - a32[6] |= (int64_t)a[8] << 16U; - a32[6] &= 0xffffffffL; - a32[7] = (a[8] >> 16); - a32[7] |= (int64_t)a[9] << 10U; - a32[7] &= 0xffffffffL; - a32[8] = (a[9] >> 22); - a32[8] |= (int64_t)a[10] << 4U; - a32[8] |= (int64_t)a[11] << 30U; - a32[8] &= 0xffffffffL; - a32[9] = (a[11] >> 2); - a32[9] |= (int64_t)a[12] << 24U; - a32[9] &= 0xffffffffL; - a32[10] = (a[12] >> 8); - a32[10] |= (int64_t)a[13] << 18U; - a32[10] &= 0xffffffffL; - a32[11] = (a[13] >> 14); - a32[11] |= (int64_t)a[14] << 12U; - a32[11] &= 0xffffffffL; + a32[0] = (sp_uint32)a[0] | ((sp_uint32)a[1] << 26U); + a32[1] = ((sp_uint32)a[1] >> 6U) | + ((sp_uint32)a[2] << 20U); + a32[2] = ((sp_uint32)a[2] >> 12U) | + ((sp_uint32)a[3] << 14U); + a32[3] = ((sp_uint32)a[3] >> 18U) | + ((sp_uint32)a[4] << 8U); + a32[4] = ((sp_uint32)a[4] >> 24U) | + ((sp_uint32)a[5] << 2U) | ((sp_uint32)a[6] << 28U); + a32[5] = ((sp_uint32)a[6] >> 4U) | + ((sp_uint32)a[7] << 22U); + a32[6] = ((sp_uint32)a[7] >> 10U) | + ((sp_uint32)a[8] << 16U); + a32[7] = ((sp_uint32)a[8] >> 16U) | + ((sp_uint32)a[9] << 10U); + a32[8] = ((sp_uint32)a[9] >> 22U) | + ((sp_uint32)a[10] << 4U) | ((sp_uint32)a[11] << 30U); + a32[9] = ((sp_uint32)a[11] >> 2U) | + ((sp_uint32)a[12] << 24U); + a32[10] = ((sp_uint32)a[12] >> 8U) | + ((sp_uint32)a[13] << 18U); + a32[11] = ((sp_uint32)a[13] >> 14U) | + ((sp_uint32)a[14] << 12U); /* 1 0 0 0 0 0 0 0 1 1 0 -1 */ t[0] = 0 + a32[0] + a32[8] + a32[9] - a32[11]; @@ -33347,42 +33332,31 @@ static int sp_384_mod_mul_norm_15(sp_digit* r, const sp_digit* a, const sp_digit t[10] += t[9] >> 32; t[9] &= 0xffffffff; t[11] += t[10] >> 32; t[10] &= 0xffffffff; - r[0] = (sp_digit)(t[0]) & 0x3ffffffL; - r[1] = (sp_digit)(t[0] >> 26U); - r[1] |= (sp_digit)((sp_uint32)t[1] << 6U); - r[1] &= 0x3ffffffL; - r[2] = (sp_digit)(t[1] >> 20U); - r[2] |= (sp_digit)((sp_uint32)t[2] << 12U); - r[2] &= 0x3ffffffL; - r[3] = (sp_digit)(t[2] >> 14U); - r[3] |= (sp_digit)((sp_uint32)t[3] << 18U); - r[3] &= 0x3ffffffL; - r[4] = (sp_digit)(t[3] >> 8U); - r[4] |= (sp_digit)((sp_uint32)t[4] << 24U); - r[4] &= 0x3ffffffL; - r[5] = (sp_digit)(t[4] >> 2U) & 0x3ffffffL; - r[6] = (sp_digit)(t[4] >> 28U); - r[6] |= (sp_digit)((sp_uint32)t[5] << 4U); - r[6] &= 0x3ffffffL; - r[7] = (sp_digit)(t[5] >> 22U); - r[7] |= (sp_digit)((sp_uint32)t[6] << 10U); - r[7] &= 0x3ffffffL; - r[8] = (sp_digit)(t[6] >> 16U); - r[8] |= (sp_digit)((sp_uint32)t[7] << 16U); - r[8] &= 0x3ffffffL; - r[9] = (sp_digit)(t[7] >> 10U); - r[9] |= (sp_digit)((sp_uint32)t[8] << 22U); - r[9] &= 0x3ffffffL; - r[10] = (sp_digit)(t[8] >> 4U) & 0x3ffffffL; - r[11] = (sp_digit)(t[8] >> 30U); - r[11] |= (sp_digit)((sp_uint32)t[9] << 2U); - r[11] &= 0x3ffffffL; - r[12] = (sp_digit)(t[9] >> 24U); - r[12] |= (sp_digit)((sp_uint32)t[10] << 8U); - r[12] &= 0x3ffffffL; - r[13] = (sp_digit)(t[10] >> 18U); - r[13] |= (sp_digit)((sp_uint32)t[11] << 14U); - r[13] &= 0x3ffffffL; + r[0] = (sp_digit)((sp_uint32)t[0] & 0x3ffffffU); + r[1] = (sp_digit)((((sp_uint32)t[0] >> 26U) | + ((sp_uint32)t[1] << 6U)) & 0x3ffffffU); + r[2] = (sp_digit)((((sp_uint32)t[1] >> 20U) | + ((sp_uint32)t[2] << 12U)) & 0x3ffffffU); + r[3] = (sp_digit)((((sp_uint32)t[2] >> 14U) | + ((sp_uint32)t[3] << 18U)) & 0x3ffffffU); + r[4] = (sp_digit)((((sp_uint32)t[3] >> 8U) | + ((sp_uint32)t[4] << 24U)) & 0x3ffffffU); + r[5] = (sp_digit)(((sp_uint32)t[4] >> 2U) & 0x3ffffffU); + r[6] = (sp_digit)((((sp_uint32)t[4] >> 28U) | + ((sp_uint32)t[5] << 4U)) & 0x3ffffffU); + r[7] = (sp_digit)((((sp_uint32)t[5] >> 22U) | + ((sp_uint32)t[6] << 10U)) & 0x3ffffffU); + r[8] = (sp_digit)((((sp_uint32)t[6] >> 16U) | + ((sp_uint32)t[7] << 16U)) & 0x3ffffffU); + r[9] = (sp_digit)((((sp_uint32)t[7] >> 10U) | + ((sp_uint32)t[8] << 22U)) & 0x3ffffffU); + r[10] = (sp_digit)(((sp_uint32)t[8] >> 4U) & 0x3ffffffU); + r[11] = (sp_digit)((((sp_uint32)t[8] >> 30U) | + ((sp_uint32)t[9] << 2U)) & 0x3ffffffU); + r[12] = (sp_digit)((((sp_uint32)t[9] >> 24U) | + ((sp_uint32)t[10] << 8U)) & 0x3ffffffU); + r[13] = (sp_digit)((((sp_uint32)t[10] >> 18U) | + ((sp_uint32)t[11] << 14U)) & 0x3ffffffU); r[14] = (sp_digit)(t[11] >> 12U); } @@ -38328,7 +38302,7 @@ static int sp_384_num_bits_26_15(sp_digit v) v |= v >> 4; v |= v >> 8; v |= v >> 16; - return sp_384_tab32_15[(word32)(v*0x07C4ACDD) >> 27]; + return sp_384_tab32_15[((sp_uint32)v * 0x07C4ACDDU) >> 27]; } /* Get the number of bits in the number. @@ -46673,7 +46647,7 @@ static int sp_521_num_bits_25_21(sp_digit v) v |= v >> 4; v |= v >> 8; v |= v >> 16; - return sp_521_tab32_21[(word32)(v*0x07C4ACDD) >> 27]; + return sp_521_tab32_21[((sp_uint32)v * 0x07C4ACDDU) >> 27]; } /* Get the number of bits in the number. diff --git a/wolfcrypt/src/sp_c64.c b/wolfcrypt/src/sp_c64.c index 6ab697ef2a6..cc20233a35a 100644 --- a/wolfcrypt/src/sp_c64.c +++ b/wolfcrypt/src/sp_c64.c @@ -26983,20 +26983,16 @@ static int sp_256_mod_mul_norm_5(sp_digit* r, const sp_digit* a, const sp_digit* a32 = t + 8; a32[0] = (sp_digit)(a[0]) & 0xffffffffL; - a32[1] = (sp_digit)(a[0] >> 32U); - a32[1] |= (sp_digit)((sp_uint64)a[1] << 20U); - a32[1] &= 0xffffffffL; + a32[1] = (sp_digit)((((sp_uint64)a[0] >> 32U) | + ((sp_uint64)a[1] << 20U)) & 0xffffffffULL); a32[2] = (sp_digit)(a[1] >> 12U) & 0xffffffffL; - a32[3] = (sp_digit)(a[1] >> 44U); - a32[3] |= (sp_digit)((sp_uint64)a[2] << 8U); - a32[3] &= 0xffffffffL; - a32[4] = (sp_digit)(a[2] >> 24U); - a32[4] |= (sp_digit)((sp_uint64)a[3] << 28U); - a32[4] &= 0xffffffffL; + a32[3] = (sp_digit)((((sp_uint64)a[1] >> 44U) | + ((sp_uint64)a[2] << 8U)) & 0xffffffffULL); + a32[4] = (sp_digit)((((sp_uint64)a[2] >> 24U) | + ((sp_uint64)a[3] << 28U)) & 0xffffffffULL); a32[5] = (sp_digit)(a[3] >> 4U) & 0xffffffffL; - a32[6] = (sp_digit)(a[3] >> 36U); - a32[6] |= (sp_digit)((sp_uint64)a[4] << 16U); - a32[6] &= 0xffffffffL; + a32[6] = (sp_digit)((((sp_uint64)a[3] >> 36U) | + ((sp_uint64)a[4] << 16U)) & 0xffffffffULL); a32[7] = (sp_digit)(a[4] >> 16U) & 0xffffffffL; /* 1 1 0 -1 -1 -1 -1 0 */ @@ -27036,22 +27032,18 @@ static int sp_256_mod_mul_norm_5(sp_digit* r, const sp_digit* a, const sp_digit* t[6] += t[5] >> 32U; t[5] &= 0xffffffffL; t[7] += t[6] >> 32U; t[6] &= 0xffffffffL; - r[0] = t[0]; - r[0] |= t[1] << 32U; - r[0] &= 0xfffffffffffffLL; - r[1] = (t[1] >> 20); - r[1] |= t[2] << 12U; - r[1] |= t[3] << 44U; - r[1] &= 0xfffffffffffffLL; - r[2] = (t[3] >> 8); - r[2] |= t[4] << 24U; - r[2] &= 0xfffffffffffffLL; - r[3] = (t[4] >> 28); - r[3] |= t[5] << 4U; - r[3] |= t[6] << 36U; - r[3] &= 0xfffffffffffffLL; - r[4] = (t[6] >> 16); - r[4] |= t[7] << 16U; + r[0] = (sp_digit)(((sp_uint64)t[0] | + ((sp_uint64)t[1] << 32U)) & 0xfffffffffffffULL); + r[1] = (sp_digit)((((sp_uint64)t[1] >> 20U) | + ((sp_uint64)t[2] << 12U) | ((sp_uint64)t[3] << 44U)) & + 0xfffffffffffffULL); + r[2] = (sp_digit)((((sp_uint64)t[3] >> 8U) | + ((sp_uint64)t[4] << 24U)) & 0xfffffffffffffULL); + r[3] = (sp_digit)((((sp_uint64)t[4] >> 28U) | + ((sp_uint64)t[5] << 4U) | ((sp_uint64)t[6] << 36U)) & + 0xfffffffffffffULL); + /* The final carry can leave t[7] negative. Keep the top limb signed. */ + r[4] = (t[6] >> 16U) + t[7] * 65536L; } SP_FREE_VAR(t, NULL, DYNAMIC_TYPE_ECC); @@ -31344,7 +31336,8 @@ static int sp_256_num_bits_52_5(sp_digit v) v |= v >> 8; v |= v >> 16; v |= v >> 32; - return sp_256_tab64_5[((word64)((v - (v >> 1))*0x07EDD5E59A4E28C2)) >> 58]; + return sp_256_tab64_5[((sp_uint64)(v - (v >> 1)) * + 0x07EDD5E59A4E28C2ULL) >> 58]; } /* Get the number of bits in the number. @@ -34076,28 +34069,22 @@ static int sp_384_mod_mul_norm_7(sp_digit* r, const sp_digit* a, const sp_digit* a32 = t + 12; a32[0] = (sp_digit)(a[0]) & 0xffffffffL; - a32[1] = (sp_digit)(a[0] >> 32U); - a32[1] |= (sp_digit)((sp_uint64)a[1] << 23U); - a32[1] &= 0xffffffffL; + a32[1] = (sp_digit)((((sp_uint64)a[0] >> 32U) | + ((sp_uint64)a[1] << 23U)) & 0xffffffffULL); a32[2] = (sp_digit)(a[1] >> 9U) & 0xffffffffL; - a32[3] = (sp_digit)(a[1] >> 41U); - a32[3] |= (sp_digit)((sp_uint64)a[2] << 14U); - a32[3] &= 0xffffffffL; + a32[3] = (sp_digit)((((sp_uint64)a[1] >> 41U) | + ((sp_uint64)a[2] << 14U)) & 0xffffffffULL); a32[4] = (sp_digit)(a[2] >> 18U) & 0xffffffffL; - a32[5] = (sp_digit)(a[2] >> 50U); - a32[5] |= (sp_digit)((sp_uint64)a[3] << 5U); - a32[5] &= 0xffffffffL; - a32[6] = (sp_digit)(a[3] >> 27U); - a32[6] |= (sp_digit)((sp_uint64)a[4] << 28U); - a32[6] &= 0xffffffffL; + a32[5] = (sp_digit)((((sp_uint64)a[2] >> 50U) | + ((sp_uint64)a[3] << 5U)) & 0xffffffffULL); + a32[6] = (sp_digit)((((sp_uint64)a[3] >> 27U) | + ((sp_uint64)a[4] << 28U)) & 0xffffffffULL); a32[7] = (sp_digit)(a[4] >> 4U) & 0xffffffffL; - a32[8] = (sp_digit)(a[4] >> 36U); - a32[8] |= (sp_digit)((sp_uint64)a[5] << 19U); - a32[8] &= 0xffffffffL; + a32[8] = (sp_digit)((((sp_uint64)a[4] >> 36U) | + ((sp_uint64)a[5] << 19U)) & 0xffffffffULL); a32[9] = (sp_digit)(a[5] >> 13U) & 0xffffffffL; - a32[10] = (sp_digit)(a[5] >> 45U); - a32[10] |= (sp_digit)((sp_uint64)a[6] << 10U); - a32[10] &= 0xffffffffL; + a32[10] = (sp_digit)((((sp_uint64)a[5] >> 45U) | + ((sp_uint64)a[6] << 10U)) & 0xffffffffULL); a32[11] = (sp_digit)(a[6] >> 22U) & 0xffffffffL; /* 1 0 0 0 0 0 0 0 1 1 0 -1 */ @@ -34153,30 +34140,23 @@ static int sp_384_mod_mul_norm_7(sp_digit* r, const sp_digit* a, const sp_digit* t[10] += t[9] >> 32; t[9] &= 0xffffffff; t[11] += t[10] >> 32; t[10] &= 0xffffffff; - r[0] = t[0]; - r[0] |= t[1] << 32U; - r[0] &= 0x7fffffffffffffLL; - r[1] = (t[1] >> 23); - r[1] |= t[2] << 9U; - r[1] |= t[3] << 41U; - r[1] &= 0x7fffffffffffffLL; - r[2] = (t[3] >> 14); - r[2] |= t[4] << 18U; - r[2] |= t[5] << 50U; - r[2] &= 0x7fffffffffffffLL; - r[3] = (t[5] >> 5); - r[3] |= t[6] << 27U; - r[3] &= 0x7fffffffffffffLL; - r[4] = (t[6] >> 28); - r[4] |= t[7] << 4U; - r[4] |= t[8] << 36U; - r[4] &= 0x7fffffffffffffLL; - r[5] = (t[8] >> 19); - r[5] |= t[9] << 13U; - r[5] |= t[10] << 45U; - r[5] &= 0x7fffffffffffffLL; - r[6] = (t[10] >> 10); - r[6] |= t[11] << 22U; + r[0] = (sp_digit)(((sp_uint64)t[0] | + ((sp_uint64)t[1] << 32U)) & 0x7fffffffffffffULL); + r[1] = (sp_digit)((((sp_uint64)t[1] >> 23U) | + ((sp_uint64)t[2] << 9U) | ((sp_uint64)t[3] << 41U)) & + 0x7fffffffffffffULL); + r[2] = (sp_digit)((((sp_uint64)t[3] >> 14U) | + ((sp_uint64)t[4] << 18U) | ((sp_uint64)t[5] << 50U)) & + 0x7fffffffffffffULL); + r[3] = (sp_digit)((((sp_uint64)t[5] >> 5U) | + ((sp_uint64)t[6] << 27U)) & 0x7fffffffffffffULL); + r[4] = (sp_digit)((((sp_uint64)t[6] >> 28U) | + ((sp_uint64)t[7] << 4U) | ((sp_uint64)t[8] << 36U)) & + 0x7fffffffffffffULL); + r[5] = (sp_digit)((((sp_uint64)t[8] >> 19U) | + ((sp_uint64)t[9] << 13U) | ((sp_uint64)t[10] << 45U)) & + 0x7fffffffffffffULL); + r[6] = (t[10] >> 10U) + t[11] * 4194304L; } SP_FREE_VAR(t, NULL, DYNAMIC_TYPE_ECC); @@ -38980,7 +38960,8 @@ static int sp_384_num_bits_55_7(sp_digit v) v |= v >> 8; v |= v >> 16; v |= v >> 32; - return sp_384_tab64_7[((word64)((v - (v >> 1))*0x07EDD5E59A4E28C2)) >> 58]; + return sp_384_tab64_7[((sp_uint64)(v - (v >> 1)) * + 0x07EDD5E59A4E28C2ULL) >> 58]; } /* Get the number of bits in the number. @@ -46639,7 +46620,8 @@ static int sp_521_num_bits_58_9(sp_digit v) v |= v >> 8; v |= v >> 16; v |= v >> 32; - return sp_521_tab64_9[((word64)((v - (v >> 1))*0x07EDD5E59A4E28C2)) >> 58]; + return sp_521_tab64_9[((sp_uint64)(v - (v >> 1)) * + 0x07EDD5E59A4E28C2ULL) >> 58]; } /* Get the number of bits in the number. diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index 9fabf2da026..836f1d08655 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -43848,6 +43848,99 @@ static wc_test_ret_t rsa_4096_bits_test(WC_RNG* rng) } #endif /* WOLFSSL_SP_4096 && ... */ +#if defined(WOLFSSL_HAVE_SP_RSA) && !defined(NO_ASN) && \ + !defined(WOLFSSL_NO_RSA_SW) && !defined(WOLF_CRYPTO_CB_ONLY_RSA) && \ + !defined(WOLFSSL_ASYNC_CRYPT) && !defined(HAVE_FIPS) && \ + !defined(HAVE_SELFTEST) +/* Exclude FIPS and selftest builds, which use validated RSA implementations. + * Exercise the SP multipliers with limbs near their upper bounds. These are + * modular exponentiation inputs, not RSA key pairs: for m = 2^bits - 189, + * (m-1)^2 mod m = 1 and (m-1)^3 mod m = m-1. In particular, the 3072-bit + * input covers the arithmetic fixed in this change. */ +static wc_test_ret_t rsa_sp_modexp_test(void) +{ + static const word32 sizes[] = { +#if !defined(WOLFSSL_SP_NO_2048) && \ + (!defined(SP_INT_BITS) || SP_INT_BITS >= 2048) + 2048 / 8, +#endif +#if !defined(WOLFSSL_SP_NO_3072) && \ + (!defined(SP_INT_BITS) || SP_INT_BITS >= 3072) + 3072 / 8, +#endif +#if defined(WOLFSSL_SP_4096) && \ + (!defined(SP_INT_BITS) || SP_INT_BITS >= 4096) + 4096 / 8, +#endif + 0 + }; + wc_test_ret_t ret = 0; + int keyInit = 0; + int i; + byte e; + word32 bytes; + word32 outSz; + WC_DECLARE_VAR(key, RsaKey, 1, HEAP_HINT); + WC_DECLARE_VAR(buf, byte, 3 * (4096 / 8), HEAP_HINT); + + WC_ALLOC_VAR(key, RsaKey, 1, HEAP_HINT); + WC_ALLOC_VAR(buf, byte, 3 * (4096 / 8), HEAP_HINT); + if (!WC_VAR_OK(key) || !WC_VAR_OK(buf)) { + ret = WC_TEST_RET_ENC_EC(MEMORY_E); + goto done; + } + + for (i = 0; sizes[i] != 0; i++) { + bytes = sizes[i]; + for (e = 2; e <= 3; e++) { + XMEMSET(buf, 0xff, bytes); + buf[bytes - 1] = 0x43; /* m = 2^bits - 189 */ + XMEMCPY(buf + bytes, buf, bytes); + buf[2 * bytes - 1] = 0x42; /* base = m - 1 */ + + ret = wc_InitRsaKey_ex(key, HEAP_HINT, INVALID_DEVID); + if (ret != 0) { + ret = WC_TEST_RET_ENC_EC(ret); + goto done; + } + keyInit = 1; + ret = wc_RsaPublicKeyDecodeRaw(buf, bytes, &e, sizeof(e), key); + if (ret != 0) { + ret = WC_TEST_RET_ENC_EC(ret); + goto done; + } + outSz = bytes; + ret = wc_RsaFunction(buf + bytes, bytes, buf + 2 * bytes, &outSz, + RSA_PUBLIC_ENCRYPT, key, NULL); + if (ret != 0) { + ret = WC_TEST_RET_ENC_EC(ret); + goto done; + } + if (e == 2) { + XMEMSET(buf, 0, bytes); + buf[bytes - 1] = 1; + } + else { + XMEMCPY(buf, buf + bytes, bytes); + } + if (outSz != bytes || XMEMCMP(buf + 2 * bytes, buf, bytes) != 0) { + ret = WC_TEST_RET_ENC_NC; + goto done; + } + wc_FreeRsaKey(key); + keyInit = 0; + } + } + +done: + if (keyInit) + wc_FreeRsaKey(key); + WC_FREE_VAR(buf, HEAP_HINT); + WC_FREE_VAR(key, HEAP_HINT); + return ret; +} +#endif /* WOLFSSL_HAVE_SP_RSA && software RSA */ + WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rsa_test(void) { wc_test_ret_t ret; @@ -44027,6 +44120,15 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t rsa_test(void) ERROR_OUT(WC_TEST_RET_ENC_EC(ret), exit_rsa); #endif +#if defined(WOLFSSL_HAVE_SP_RSA) && !defined(NO_ASN) && \ + !defined(WOLFSSL_NO_RSA_SW) && !defined(WOLF_CRYPTO_CB_ONLY_RSA) && \ + !defined(WOLFSSL_ASYNC_CRYPT) && !defined(HAVE_FIPS) && \ + !defined(HAVE_SELFTEST) + ret = rsa_sp_modexp_test(); + if (ret != 0) + ERROR_OUT(ret, exit_rsa); +#endif + #if defined(WOLFSSL_SP_4096) && !defined(NO_ASN) && !defined(WC_NO_RNG) && \ !defined(WOLFSSL_RSA_VERIFY_ONLY) && !defined(WOLF_CRYPTO_CB_ONLY_RSA) && \ !defined(WOLFSSL_ASYNC_CRYPT) && \ @@ -55594,6 +55696,100 @@ static wc_test_ret_t ecc_sig_test(WC_RNG* rng, ecc_key* key) } #endif +/* Hardware-only ECDSA ports cannot exercise the software SP path. */ +#if defined(WOLFSSL_HAVE_SP_ECC) && !defined(NO_ECC256) && \ + defined(HAVE_ECC_SIGN) && defined(HAVE_ECC_VERIFY) && \ + !defined(WC_NO_RNG) && !defined(WOLF_CRYPTO_CB_ONLY_ECC) && \ + (ECC_MIN_KEY_SZ <= 256) && \ + (!defined(WOLFSSL_SE050) || defined(WOLFSSL_SE050_ONLY_KEY_ID)) && \ + !defined(WOLFSSL_ATECC508A) && !defined(WOLFSSL_ATECC608A) && \ + !defined(WOLFSSL_MICROCHIP_TA100) && !defined(PLUTON_CRYPTO_ECC) && \ + !defined(WOLFSSL_CRYPTOCELL) && !defined(WOLFSSL_SILABS_SE_ACCEL) && \ + !defined(WOLFSSL_KCAPI_ECC) && \ + !defined(WOLFSSL_XILINX_CRYPT_VERSAL) && \ + !defined(WOLFSSL_STM32_PKA) && !defined(WOLFSSL_PSOC6_CRYPTO) && \ + !defined(WOLFSSL_QNX_CAAM) && !defined(WOLFSSL_IMXRT1170_CAAM) +#define WC_TEST_P256_SOFTWARE_SP +/* Sign and verify P-256 boundary-value hashes (one, a single mid-range bit, + * the top bit, and all ones). + * Verification exercises SP point normalization and inversion. */ +static wc_test_ret_t ecc_p256_sign_verify_test(WC_RNG* rng) +{ + wc_test_ret_t ret; +#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC) + ecc_key* key; +#else + ecc_key key[1]; +#endif + byte hash[32]; + byte sig[ECC_MAX_SIG_SIZE]; + word32 sigLen; + int verified; + int i; + + if (wc_ecc_get_curve_idx(ECC_SECP256R1) == ECC_CURVE_INVALID) + return 0; +#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC) + key = (ecc_key*)XMALLOC(sizeof(ecc_key), HEAP_HINT, + DYNAMIC_TYPE_TMP_BUFFER); + if (key == NULL) + return WC_TEST_RET_ENC_EC(MEMORY_E); +#endif + + /* Force the software SP path, even in asynchronous test configurations. */ + ret = wc_ecc_init_ex(key, HEAP_HINT, INVALID_DEVID); + if (ret != 0) + ERROR_OUT(WC_TEST_RET_ENC_EC(ret), done_free); + ret = wc_ecc_make_key_ex(rng, 32, key, ECC_SECP256R1); + if (ret != 0) + ERROR_OUT(WC_TEST_RET_ENC_EC(ret), done); + + for (i = 0; i < 4; i++) { + XMEMSET(hash, 0, sizeof(hash)); + if (i == 0) + hash[31] = 1; + else if (i == 1) + hash[25] = 0x10; /* single mid-range bit */ + else if (i == 2) + hash[0] = 0x80; + else + XMEMSET(hash, 0xff, sizeof(hash)); + + sigLen = sizeof(sig); + ret = wc_ecc_sign_hash(hash, sizeof(hash), sig, &sigLen, rng, key); + if (ret != 0) + ERROR_OUT(WC_TEST_RET_ENC_EC(ret), done); + verified = 0; + ret = wc_ecc_verify_hash(sig, sigLen, hash, sizeof(hash), + &verified, key); + if (ret != 0) + ERROR_OUT(WC_TEST_RET_ENC_EC(ret), done); + if (verified != 1) { + ret = WC_TEST_RET_ENC_NC; + goto done; + } + hash[30] ^= 1; + verified = 1; + ret = wc_ecc_verify_hash(sig, sigLen, hash, sizeof(hash), + &verified, key); + if (ret != 0) + ERROR_OUT(WC_TEST_RET_ENC_EC(ret), done); + if (verified != 0) { + ret = WC_TEST_RET_ENC_NC; + goto done; + } + } + +done: + wc_ecc_free(key); +done_free: +#if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC) + XFREE(key, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); +#endif + return ret; +} +#endif + #if defined(HAVE_ECC_KEY_IMPORT) && defined(HAVE_ECC_KEY_EXPORT) && \ (!defined(WOLF_CRYPTO_CB_ONLY_ECC) || defined(WOLFSSL_SWDEV)) && \ !defined(WOLFSSL_MICROCHIP_TA100) @@ -58698,6 +58894,13 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t ecc_test(void) (void)ret; #endif +#ifdef WC_TEST_P256_SOFTWARE_SP + ret = ecc_p256_sign_verify_test(&rng); + if (ret != 0) + goto done; +#endif +#undef WC_TEST_P256_SOFTWARE_SP + ret = ecc_test_all_curves(&rng); if (ret < 0) goto done; @@ -75864,15 +76067,39 @@ static const byte mldsa_kat_digest_87[32] = { #define MLDSA_KAT_DIGEST(d) NULL #endif +#if defined(WOLFSSL_MLDSA_PUBLIC_KEY) && !defined(WOLFSSL_NO_ML_DSA_65) && \ + !defined(WOLFSSL_MLDSA_FIPS204_DRAFT) +/* SHAKE-256 of the ML-DSA-65 raw public key from seed 00..1f. + * Independently generated with OpenSSL 3.5's ML-DSA-65 seed import. + * This complements the signature KATs when WOLFSSL_MLDSA_SIGN_CHECK_Y or + * WOLFSSL_MLDSA_SIGN_CHECK_W0 compiles out their digests. It is skipped in + * FIPS 204 draft mode because draft key generation differs from the final + * standard. One parameter set covers the shared key-generation code. */ +static const byte mldsa_kat_pub_digest_65[32] = { + 0x1b, 0x05, 0x63, 0xe3, 0xcd, 0x33, 0x46, 0x14, + 0x9c, 0x8c, 0x9e, 0xbc, 0xf2, 0x3b, 0x0a, 0x4e, + 0x5a, 0x90, 0x0e, 0xea, 0x9c, 0x65, 0x62, 0x79, + 0x0a, 0x7c, 0x63, 0xe3, 0x86, 0x63, 0xda, 0xa2 +}; +#define MLDSA_KAT_PUB_DIGEST_65 mldsa_kat_pub_digest_65 +#elif !defined(WOLFSSL_NO_ML_DSA_65) +#define MLDSA_KAT_PUB_DIGEST_65 NULL +#endif + /* A key generated into an object that already held a key must sign and verify * exactly like one generated into a fresh object, whatever the key caches. */ -static wc_test_ret_t mldsa_make_key_reuse_test(int param, const byte* expDigest) +static wc_test_ret_t mldsa_make_key_reuse_test(int param, const byte* expDigest, + const byte* expPubDigest) { wc_test_ret_t ret; wc_MlDsaKey* key = NULL; wc_MlDsaKey* freshKey = NULL; byte* sig = NULL; byte* freshSig = NULL; +#ifdef WOLFSSL_MLDSA_PUBLIC_KEY + byte* pub = NULL; + word32 pubLen; +#endif word32 sigLen; word32 freshSigLen; int sigSz = 0; @@ -75884,6 +76111,9 @@ static wc_test_ret_t mldsa_make_key_reuse_test(int param, const byte* expDigest) #ifndef WOLFSSL_MLDSA_NO_VERIFY int res = 0; #endif +#ifndef WOLFSSL_MLDSA_PUBLIC_KEY + (void)expPubDigest; +#endif key = (wc_MlDsaKey*)XMALLOC(sizeof(wc_MlDsaKey), HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); @@ -75914,6 +76144,32 @@ static wc_test_ret_t mldsa_make_key_reuse_test(int param, const byte* expDigest) ret = wc_MlDsaKey_CheckKey(freshKey); if (ret != 0) ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out); +#endif +#ifdef WOLFSSL_MLDSA_PUBLIC_KEY + if (expPubDigest != NULL) { + pub = (byte*)XMALLOC(MLDSA_MAX_PUB_KEY_SIZE, HEAP_HINT, + DYNAMIC_TYPE_TMP_BUFFER); + if (pub == NULL) + ERROR_OUT(WC_TEST_RET_ENC_EC(MEMORY_E), out); + pubLen = MLDSA_MAX_PUB_KEY_SIZE; + ret = wc_MlDsaKey_ExportPubRaw(freshKey, pub, &pubLen); + if (ret != 0) + ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out); + ret = wc_InitShake256(&shake, HEAP_HINT, INVALID_DEVID); + if (ret != 0) + ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out); + shakeInit = 1; + ret = wc_Shake256_Update(&shake, pub, pubLen); + if (ret != 0) + ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out); + ret = wc_Shake256_Final(&shake, digest, (word32)sizeof(digest)); + if (ret != 0) + ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out); + if (XMEMCMP(digest, expPubDigest, sizeof(digest)) != 0) + ERROR_OUT(WC_TEST_RET_ENC_NC, out); + wc_Shake256_Free(&shake); + shakeInit = 0; + } #endif freshSigLen = (word32)sigSz; ret = wc_MlDsaKey_SignCtxWithSeed(freshKey, NULL, 0, freshSig, @@ -75990,6 +76246,9 @@ static wc_test_ret_t mldsa_make_key_reuse_test(int param, const byte* expDigest) wc_MlDsaKey_Free(key); if (freshKeyInit) wc_MlDsaKey_Free(freshKey); +#ifdef WOLFSSL_MLDSA_PUBLIC_KEY + XFREE(pub, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); +#endif XFREE(freshSig, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); XFREE(sig, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); XFREE(freshKey, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER); @@ -77137,19 +77396,20 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t mldsa_test(void) defined(WC_MLDSA_HAVE_NATIVE) #ifndef WOLFSSL_NO_ML_DSA_44 ret = mldsa_make_key_reuse_test(WC_ML_DSA_44, - MLDSA_KAT_DIGEST(mldsa_kat_digest_44)); + MLDSA_KAT_DIGEST(mldsa_kat_digest_44), NULL); if (ret != 0) ERROR_OUT(ret, out); #endif #ifndef WOLFSSL_NO_ML_DSA_65 ret = mldsa_make_key_reuse_test(WC_ML_DSA_65, - MLDSA_KAT_DIGEST(mldsa_kat_digest_65)); + MLDSA_KAT_DIGEST(mldsa_kat_digest_65), + MLDSA_KAT_PUB_DIGEST_65); if (ret != 0) ERROR_OUT(ret, out); #endif #ifndef WOLFSSL_NO_ML_DSA_87 ret = mldsa_make_key_reuse_test(WC_ML_DSA_87, - MLDSA_KAT_DIGEST(mldsa_kat_digest_87)); + MLDSA_KAT_DIGEST(mldsa_kat_digest_87), NULL); if (ret != 0) ERROR_OUT(ret, out); #endif From eef486fd0c99b5362c500ba08754925156e59818 Mon Sep 17 00:00:00 2001 From: Armin Pribbernow Date: Mon, 19 Oct 2026 17:07:52 +0200 Subject: [PATCH 2/5] test: respect digest limits in P-256 SP regression Skip the fixed 32-byte hash regression when the configured signing or verification digest range excludes that size. Check the limits before allocating or initializing a key. --- wolfcrypt/test/test.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c index 836f1d08655..58d89e1875a 100644 --- a/wolfcrypt/test/test.c +++ b/wolfcrypt/test/test.c @@ -55727,6 +55727,11 @@ static wc_test_ret_t ecc_p256_sign_verify_test(WC_RNG* rng) int verified; int i; + if (sizeof(hash) < WC_MIN_DIGEST_SIZE_FOR_SIGN || + sizeof(hash) < WC_MIN_DIGEST_SIZE_FOR_VERIFY || + sizeof(hash) > WC_MAX_DIGEST_SIZE) + return 0; + if (wc_ecc_get_curve_idx(ECC_SECP256R1) == ECC_CURVE_INVALID) return 0; #if defined(WOLFSSL_SMALL_STACK) && !defined(WOLFSSL_NO_MALLOC) From a9d8180b8d243e30c486eb50e33ee2f881e94079 Mon Sep 17 00:00:00 2001 From: David Garske Date: Thu, 5 Nov 2026 15:53:55 -0800 Subject: [PATCH 3/5] SP C: regenerate with unsigned limb packing, subtraction and bit counting --- wolfcrypt/src/sp_c32.c | 384 +++++++++++++++++++---------------------- wolfcrypt/src/sp_c64.c | 349 ++++++++++++++++++------------------- 2 files changed, 347 insertions(+), 386 deletions(-) diff --git a/wolfcrypt/src/sp_c32.c b/wolfcrypt/src/sp_c32.c index d00267f4c94..7f504865ce9 100644 --- a/wolfcrypt/src/sp_c32.c +++ b/wolfcrypt/src/sp_c32.c @@ -794,15 +794,6 @@ SP_NOINLINE static int sp_2048_sub_24(sp_digit* r, const sp_digit* a, { int i; - /* Inputs to sp_2048_mul_36() and sp_2048_sqr_36() have limbs 0..34 below - * 2^29 and each 12-limb chunk below 2^(12*29) + 2^(11*29). This holds for - * normalized 36-limb operands and normalized Karatsuba sums built by - * sp_2048_mul_72() and sp_2048_sqr_72(). The final Toom-3 cross terms sum - * two chunk products: low limbs are in [-2, 3]*(2^29-1), and the high limb - * is below 2*2^29+7. The following add_24 keeps the overlapping high limb - * below 3*2^29+7. These bounds show add_24 and norm_24 cannot overflow. - * The subtraction itself keeps the low word, identical to -fwrapv - * regardless of the bounds; cancellation precedes normalization. */ for (i = 0; i < 24; i += 8) { r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); @@ -1035,14 +1026,14 @@ SP_NOINLINE static int sp_2048_sub_72(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 72; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); } return 0; @@ -1335,7 +1326,7 @@ SP_NOINLINE static int sp_2048_sub_72(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 72; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint32)a[i] - (sp_uint32)b[i]); } return 0; @@ -1496,7 +1487,7 @@ SP_NOINLINE static int sp_2048_sub_36(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 36; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint32)a[i] - (sp_uint32)b[i]); } return 0; @@ -1515,19 +1506,19 @@ SP_NOINLINE static int sp_2048_sub_36(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 32; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[32] = a[32] - b[32]; - r[33] = a[33] - b[33]; - r[34] = a[34] - b[34]; - r[35] = a[35] - b[35]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); + } + r[32] = (sp_digit)((sp_uint32)a[32] - (sp_uint32)b[32]); + r[33] = (sp_digit)((sp_uint32)a[33] - (sp_uint32)b[33]); + r[34] = (sp_digit)((sp_uint32)a[34] - (sp_uint32)b[34]); + r[35] = (sp_digit)((sp_uint32)a[35] - (sp_uint32)b[35]); return 0; } @@ -6351,7 +6342,7 @@ SP_NOINLINE static int sp_3072_sub_53(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 53; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint32)a[i] - (sp_uint32)b[i]); } return 0; @@ -7518,7 +7509,7 @@ SP_NOINLINE static int sp_3072_sub_106(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 106; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint32)a[i] - (sp_uint32)b[i]); } return 0; @@ -10723,13 +10714,6 @@ SP_NOINLINE static int sp_3072_sub_28(sp_digit* r, const sp_digit* a, { int i; - /* In sp_3072_mul_28() and sp_3072_sqr_28(), the leaf multipliers - * accumulate in sp_uint64. Their top limb is converted to sp_digit - * and may wrap (implementation-defined, not undefined behaviour). - * Each 14-limb half is below 2*2^(14*28), so the final Karatsuba cross - * term is below 4*2^(28*28) and its true high limb fits sp_digit. Both - * subtractions are done modulo 2^32 so the wrap cancels before carry - * normalization. */ for (i = 0; i < 24; i += 8) { r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); @@ -10833,14 +10817,14 @@ SP_NOINLINE static int sp_3072_sub_56(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 56; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); } return 0; @@ -10932,14 +10916,14 @@ SP_NOINLINE static int sp_3072_sub_112(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 112; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); } return 0; @@ -15316,7 +15300,7 @@ SP_NOINLINE static int sp_4096_sub_71(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 71; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint32)a[i] - (sp_uint32)b[i]); } return 0; @@ -16490,7 +16474,7 @@ SP_NOINLINE static int sp_4096_sub_142(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 142; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint32)a[i] - (sp_uint32)b[i]); } return 0; @@ -19423,17 +19407,17 @@ SP_NOINLINE static int sp_4096_sub_18(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 16; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[16] = a[16] - b[16]; - r[17] = a[17] - b[17]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); + } + r[16] = (sp_digit)((sp_uint32)a[16] - (sp_uint32)b[16]); + r[17] = (sp_digit)((sp_uint32)a[17] - (sp_uint32)b[17]); return 0; } @@ -19631,21 +19615,21 @@ SP_NOINLINE static int sp_4096_sub_54(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 48; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[48] = a[48] - b[48]; - r[49] = a[49] - b[49]; - r[50] = a[50] - b[50]; - r[51] = a[51] - b[51]; - r[52] = a[52] - b[52]; - r[53] = a[53] - b[53]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); + } + r[48] = (sp_digit)((sp_uint32)a[48] - (sp_uint32)b[48]); + r[49] = (sp_digit)((sp_uint32)a[49] - (sp_uint32)b[49]); + r[50] = (sp_digit)((sp_uint32)a[50] - (sp_uint32)b[50]); + r[51] = (sp_digit)((sp_uint32)a[51] - (sp_uint32)b[51]); + r[52] = (sp_digit)((sp_uint32)a[52] - (sp_uint32)b[52]); + r[53] = (sp_digit)((sp_uint32)a[53] - (sp_uint32)b[53]); return 0; } @@ -19833,17 +19817,17 @@ SP_NOINLINE static int sp_4096_sub_162(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 160; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[160] = a[160] - b[160]; - r[161] = a[161] - b[161]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); + } + r[160] = (sp_digit)((sp_uint32)a[160] - (sp_uint32)b[160]); + r[161] = (sp_digit)((sp_uint32)a[161] - (sp_uint32)b[161]); return 0; } @@ -20188,16 +20172,16 @@ SP_NOINLINE static int sp_4096_sub_81(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 80; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); } - r[80] = a[80] - b[80]; + r[80] = (sp_digit)((sp_uint32)a[80] - (sp_uint32)b[80]); return 0; } @@ -24231,7 +24215,7 @@ SP_NOINLINE static int sp_256_sub_9(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 9; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint32)a[i] - (sp_uint32)b[i]); } return 0; @@ -24247,15 +24231,15 @@ SP_NOINLINE static int sp_256_sub_9(sp_digit* r, const sp_digit* a, SP_NOINLINE static int sp_256_sub_9(sp_digit* r, const sp_digit* a, const sp_digit* b) { - r[ 0] = a[ 0] - b[ 0]; - r[ 1] = a[ 1] - b[ 1]; - r[ 2] = a[ 2] - b[ 2]; - r[ 3] = a[ 3] - b[ 3]; - r[ 4] = a[ 4] - b[ 4]; - r[ 5] = a[ 5] - b[ 5]; - r[ 6] = a[ 6] - b[ 6]; - r[ 7] = a[ 7] - b[ 7]; - r[ 8] = a[ 8] - b[ 8]; + r[ 0] = (sp_digit)((sp_uint32)a[ 0] - (sp_uint32)b[ 0]); + r[ 1] = (sp_digit)((sp_uint32)a[ 1] - (sp_uint32)b[ 1]); + r[ 2] = (sp_digit)((sp_uint32)a[ 2] - (sp_uint32)b[ 2]); + r[ 3] = (sp_digit)((sp_uint32)a[ 3] - (sp_uint32)b[ 3]); + r[ 4] = (sp_digit)((sp_uint32)a[ 4] - (sp_uint32)b[ 4]); + r[ 5] = (sp_digit)((sp_uint32)a[ 5] - (sp_uint32)b[ 5]); + r[ 6] = (sp_digit)((sp_uint32)a[ 6] - (sp_uint32)b[ 6]); + r[ 7] = (sp_digit)((sp_uint32)a[ 7] - (sp_uint32)b[ 7]); + r[ 8] = (sp_digit)((sp_uint32)a[ 8] - (sp_uint32)b[ 8]); return 0; } @@ -25664,20 +25648,13 @@ static int sp_256_mod_mul_norm_9(sp_digit* r, const sp_digit* a, const sp_digit* a32 = t + 8; a32[0] = (sp_uint32)a[0] | ((sp_uint32)a[1] << 29U); - a32[1] = ((sp_uint32)a[1] >> 3U) | - ((sp_uint32)a[2] << 26U); - a32[2] = ((sp_uint32)a[2] >> 6U) | - ((sp_uint32)a[3] << 23U); - a32[3] = ((sp_uint32)a[3] >> 9U) | - ((sp_uint32)a[4] << 20U); - a32[4] = ((sp_uint32)a[4] >> 12U) | - ((sp_uint32)a[5] << 17U); - a32[5] = ((sp_uint32)a[5] >> 15U) | - ((sp_uint32)a[6] << 14U); - a32[6] = ((sp_uint32)a[6] >> 18U) | - ((sp_uint32)a[7] << 11U); - a32[7] = ((sp_uint32)a[7] >> 21U) | - ((sp_uint32)a[8] << 8U); + a32[1] = ((sp_uint32)a[1] >> 3U) | ((sp_uint32)a[2] << 26U); + a32[2] = ((sp_uint32)a[2] >> 6U) | ((sp_uint32)a[3] << 23U); + a32[3] = ((sp_uint32)a[3] >> 9U) | ((sp_uint32)a[4] << 20U); + a32[4] = ((sp_uint32)a[4] >> 12U) | ((sp_uint32)a[5] << 17U); + a32[5] = ((sp_uint32)a[5] >> 15U) | ((sp_uint32)a[6] << 14U); + a32[6] = ((sp_uint32)a[6] >> 18U) | ((sp_uint32)a[7] << 11U); + a32[7] = ((sp_uint32)a[7] >> 21U) | ((sp_uint32)a[8] << 8U); /* 1 1 0 -1 -1 -1 -1 0 */ t[0] = 0 + a32[0] + a32[1] - a32[3] - a32[4] - a32[5] - a32[6]; @@ -31743,7 +31720,7 @@ SP_NOINLINE static int sp_384_sub_15(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 15; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint32)a[i] - (sp_uint32)b[i]); } return 0; @@ -31759,21 +31736,21 @@ SP_NOINLINE static int sp_384_sub_15(sp_digit* r, const sp_digit* a, SP_NOINLINE static int sp_384_sub_15(sp_digit* r, const sp_digit* a, const sp_digit* b) { - r[ 0] = a[ 0] - b[ 0]; - r[ 1] = a[ 1] - b[ 1]; - r[ 2] = a[ 2] - b[ 2]; - r[ 3] = a[ 3] - b[ 3]; - r[ 4] = a[ 4] - b[ 4]; - r[ 5] = a[ 5] - b[ 5]; - r[ 6] = a[ 6] - b[ 6]; - r[ 7] = a[ 7] - b[ 7]; - r[ 8] = a[ 8] - b[ 8]; - r[ 9] = a[ 9] - b[ 9]; - r[10] = a[10] - b[10]; - r[11] = a[11] - b[11]; - r[12] = a[12] - b[12]; - r[13] = a[13] - b[13]; - r[14] = a[14] - b[14]; + r[ 0] = (sp_digit)((sp_uint32)a[ 0] - (sp_uint32)b[ 0]); + r[ 1] = (sp_digit)((sp_uint32)a[ 1] - (sp_uint32)b[ 1]); + r[ 2] = (sp_digit)((sp_uint32)a[ 2] - (sp_uint32)b[ 2]); + r[ 3] = (sp_digit)((sp_uint32)a[ 3] - (sp_uint32)b[ 3]); + r[ 4] = (sp_digit)((sp_uint32)a[ 4] - (sp_uint32)b[ 4]); + r[ 5] = (sp_digit)((sp_uint32)a[ 5] - (sp_uint32)b[ 5]); + r[ 6] = (sp_digit)((sp_uint32)a[ 6] - (sp_uint32)b[ 6]); + r[ 7] = (sp_digit)((sp_uint32)a[ 7] - (sp_uint32)b[ 7]); + r[ 8] = (sp_digit)((sp_uint32)a[ 8] - (sp_uint32)b[ 8]); + r[ 9] = (sp_digit)((sp_uint32)a[ 9] - (sp_uint32)b[ 9]); + r[10] = (sp_digit)((sp_uint32)a[10] - (sp_uint32)b[10]); + r[11] = (sp_digit)((sp_uint32)a[11] - (sp_uint32)b[11]); + r[12] = (sp_digit)((sp_uint32)a[12] - (sp_uint32)b[12]); + r[13] = (sp_digit)((sp_uint32)a[13] - (sp_uint32)b[13]); + r[14] = (sp_digit)((sp_uint32)a[14] - (sp_uint32)b[14]); return 0; } @@ -33256,28 +33233,19 @@ static int sp_384_mod_mul_norm_15(sp_digit* r, const sp_digit* a, const sp_digit a32 = t + 12; a32[0] = (sp_uint32)a[0] | ((sp_uint32)a[1] << 26U); - a32[1] = ((sp_uint32)a[1] >> 6U) | - ((sp_uint32)a[2] << 20U); - a32[2] = ((sp_uint32)a[2] >> 12U) | - ((sp_uint32)a[3] << 14U); - a32[3] = ((sp_uint32)a[3] >> 18U) | - ((sp_uint32)a[4] << 8U); - a32[4] = ((sp_uint32)a[4] >> 24U) | - ((sp_uint32)a[5] << 2U) | ((sp_uint32)a[6] << 28U); - a32[5] = ((sp_uint32)a[6] >> 4U) | - ((sp_uint32)a[7] << 22U); - a32[6] = ((sp_uint32)a[7] >> 10U) | - ((sp_uint32)a[8] << 16U); - a32[7] = ((sp_uint32)a[8] >> 16U) | - ((sp_uint32)a[9] << 10U); - a32[8] = ((sp_uint32)a[9] >> 22U) | - ((sp_uint32)a[10] << 4U) | ((sp_uint32)a[11] << 30U); - a32[9] = ((sp_uint32)a[11] >> 2U) | - ((sp_uint32)a[12] << 24U); - a32[10] = ((sp_uint32)a[12] >> 8U) | - ((sp_uint32)a[13] << 18U); - a32[11] = ((sp_uint32)a[13] >> 14U) | - ((sp_uint32)a[14] << 12U); + a32[1] = ((sp_uint32)a[1] >> 6U) | ((sp_uint32)a[2] << 20U); + a32[2] = ((sp_uint32)a[2] >> 12U) | ((sp_uint32)a[3] << 14U); + a32[3] = ((sp_uint32)a[3] >> 18U) | ((sp_uint32)a[4] << 8U); + a32[4] = ((sp_uint32)a[4] >> 24U) | ((sp_uint32)a[5] << 2U) | + ((sp_uint32)a[6] << 28U); + a32[5] = ((sp_uint32)a[6] >> 4U) | ((sp_uint32)a[7] << 22U); + a32[6] = ((sp_uint32)a[7] >> 10U) | ((sp_uint32)a[8] << 16U); + a32[7] = ((sp_uint32)a[8] >> 16U) | ((sp_uint32)a[9] << 10U); + a32[8] = ((sp_uint32)a[9] >> 22U) | ((sp_uint32)a[10] << 4U) | + ((sp_uint32)a[11] << 30U); + a32[9] = ((sp_uint32)a[11] >> 2U) | ((sp_uint32)a[12] << 24U); + a32[10] = ((sp_uint32)a[12] >> 8U) | ((sp_uint32)a[13] << 18U); + a32[11] = ((sp_uint32)a[13] >> 14U) | ((sp_uint32)a[14] << 12U); /* 1 0 0 0 0 0 0 0 1 1 0 -1 */ t[0] = 0 + a32[0] + a32[8] + a32[9] - a32[11]; @@ -39626,7 +39594,7 @@ SP_NOINLINE static int sp_521_sub_21(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 21; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint32)a[i] - (sp_uint32)b[i]); } return 0; @@ -39645,20 +39613,20 @@ SP_NOINLINE static int sp_521_sub_21(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 16; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[16] = a[16] - b[16]; - r[17] = a[17] - b[17]; - r[18] = a[18] - b[18]; - r[19] = a[19] - b[19]; - r[20] = a[20] - b[20]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); + } + r[16] = (sp_digit)((sp_uint32)a[16] - (sp_uint32)b[16]); + r[17] = (sp_digit)((sp_uint32)a[17] - (sp_uint32)b[17]); + r[18] = (sp_digit)((sp_uint32)a[18] - (sp_uint32)b[18]); + r[19] = (sp_digit)((sp_uint32)a[19] - (sp_uint32)b[19]); + r[20] = (sp_digit)((sp_uint32)a[20] - (sp_uint32)b[20]); return 0; } @@ -47808,20 +47776,20 @@ SP_NOINLINE static int sp_1024_add_7(sp_digit* r, const sp_digit* a, SP_NOINLINE static int sp_1024_sub_14(sp_digit* r, const sp_digit* a, const sp_digit* b) { - r[ 0] = a[ 0] - b[ 0]; - r[ 1] = a[ 1] - b[ 1]; - r[ 2] = a[ 2] - b[ 2]; - r[ 3] = a[ 3] - b[ 3]; - r[ 4] = a[ 4] - b[ 4]; - r[ 5] = a[ 5] - b[ 5]; - r[ 6] = a[ 6] - b[ 6]; - r[ 7] = a[ 7] - b[ 7]; - r[ 8] = a[ 8] - b[ 8]; - r[ 9] = a[ 9] - b[ 9]; - r[10] = a[10] - b[10]; - r[11] = a[11] - b[11]; - r[12] = a[12] - b[12]; - r[13] = a[13] - b[13]; + r[ 0] = (sp_digit)((sp_uint32)a[ 0] - (sp_uint32)b[ 0]); + r[ 1] = (sp_digit)((sp_uint32)a[ 1] - (sp_uint32)b[ 1]); + r[ 2] = (sp_digit)((sp_uint32)a[ 2] - (sp_uint32)b[ 2]); + r[ 3] = (sp_digit)((sp_uint32)a[ 3] - (sp_uint32)b[ 3]); + r[ 4] = (sp_digit)((sp_uint32)a[ 4] - (sp_uint32)b[ 4]); + r[ 5] = (sp_digit)((sp_uint32)a[ 5] - (sp_uint32)b[ 5]); + r[ 6] = (sp_digit)((sp_uint32)a[ 6] - (sp_uint32)b[ 6]); + r[ 7] = (sp_digit)((sp_uint32)a[ 7] - (sp_uint32)b[ 7]); + r[ 8] = (sp_digit)((sp_uint32)a[ 8] - (sp_uint32)b[ 8]); + r[ 9] = (sp_digit)((sp_uint32)a[ 9] - (sp_uint32)b[ 9]); + r[10] = (sp_digit)((sp_uint32)a[10] - (sp_uint32)b[10]); + r[11] = (sp_digit)((sp_uint32)a[11] - (sp_uint32)b[11]); + r[12] = (sp_digit)((sp_uint32)a[12] - (sp_uint32)b[12]); + r[13] = (sp_digit)((sp_uint32)a[13] - (sp_uint32)b[13]); return 0; } @@ -48026,17 +47994,17 @@ SP_NOINLINE static int sp_1024_sub_42(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 40; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[40] = a[40] - b[40]; - r[41] = a[41] - b[41]; + r[i + 0] = (sp_digit)((sp_uint32)a[i + 0] - (sp_uint32)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint32)a[i + 1] - (sp_uint32)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint32)a[i + 2] - (sp_uint32)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint32)a[i + 3] - (sp_uint32)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint32)a[i + 4] - (sp_uint32)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint32)a[i + 5] - (sp_uint32)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint32)a[i + 6] - (sp_uint32)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint32)a[i + 7] - (sp_uint32)b[i + 7]); + } + r[40] = (sp_digit)((sp_uint32)a[40] - (sp_uint32)b[40]); + r[41] = (sp_digit)((sp_uint32)a[41] - (sp_uint32)b[41]); return 0; } @@ -48461,7 +48429,7 @@ SP_NOINLINE static int sp_1024_sub_42(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 42; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint32)a[i] - (sp_uint32)b[i]); } return 0; diff --git a/wolfcrypt/src/sp_c64.c b/wolfcrypt/src/sp_c64.c index cc20233a35a..424244b91a8 100644 --- a/wolfcrypt/src/sp_c64.c +++ b/wolfcrypt/src/sp_c64.c @@ -637,7 +637,7 @@ SP_NOINLINE static int sp_2048_sub_17(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 17; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint64)a[i] - (sp_uint64)b[i]); } return 0; @@ -1790,7 +1790,7 @@ SP_NOINLINE static int sp_2048_sub_34(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 34; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint64)a[i] - (sp_uint64)b[i]); } return 0; @@ -4792,17 +4792,17 @@ SP_NOINLINE static int sp_2048_sub_18(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 16; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[16] = a[16] - b[16]; - r[17] = a[17] - b[17]; + r[i + 0] = (sp_digit)((sp_uint64)a[i + 0] - (sp_uint64)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint64)a[i + 1] - (sp_uint64)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint64)a[i + 2] - (sp_uint64)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint64)a[i + 3] - (sp_uint64)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint64)a[i + 4] - (sp_uint64)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint64)a[i + 5] - (sp_uint64)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint64)a[i + 6] - (sp_uint64)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint64)a[i + 7] - (sp_uint64)b[i + 7]); + } + r[16] = (sp_digit)((sp_uint64)a[16] - (sp_uint64)b[16]); + r[17] = (sp_digit)((sp_uint64)a[17] - (sp_uint64)b[17]); return 0; } @@ -4872,19 +4872,19 @@ SP_NOINLINE static int sp_2048_sub_36(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 32; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[32] = a[32] - b[32]; - r[33] = a[33] - b[33]; - r[34] = a[34] - b[34]; - r[35] = a[35] - b[35]; + r[i + 0] = (sp_digit)((sp_uint64)a[i + 0] - (sp_uint64)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint64)a[i + 1] - (sp_uint64)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint64)a[i + 2] - (sp_uint64)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint64)a[i + 3] - (sp_uint64)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint64)a[i + 4] - (sp_uint64)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint64)a[i + 5] - (sp_uint64)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint64)a[i + 6] - (sp_uint64)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint64)a[i + 7] - (sp_uint64)b[i + 7]); + } + r[32] = (sp_digit)((sp_uint64)a[32] - (sp_uint64)b[32]); + r[33] = (sp_digit)((sp_uint64)a[33] - (sp_uint64)b[33]); + r[34] = (sp_digit)((sp_uint64)a[34] - (sp_uint64)b[34]); + r[35] = (sp_digit)((sp_uint64)a[35] - (sp_uint64)b[35]); return 0; } @@ -8857,7 +8857,7 @@ SP_NOINLINE static int sp_3072_sub_26(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 26; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint64)a[i] - (sp_uint64)b[i]); } return 0; @@ -9974,7 +9974,7 @@ SP_NOINLINE static int sp_3072_sub_52(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 52; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint64)a[i] - (sp_uint64)b[i]); } return 0; @@ -12958,17 +12958,17 @@ SP_NOINLINE static int sp_3072_sub_18(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 16; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[16] = a[16] - b[16]; - r[17] = a[17] - b[17]; + r[i + 0] = (sp_digit)((sp_uint64)a[i + 0] - (sp_uint64)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint64)a[i + 1] - (sp_uint64)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint64)a[i + 2] - (sp_uint64)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint64)a[i + 3] - (sp_uint64)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint64)a[i + 4] - (sp_uint64)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint64)a[i + 5] - (sp_uint64)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint64)a[i + 6] - (sp_uint64)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint64)a[i + 7] - (sp_uint64)b[i + 7]); + } + r[16] = (sp_digit)((sp_uint64)a[16] - (sp_uint64)b[16]); + r[17] = (sp_digit)((sp_uint64)a[17] - (sp_uint64)b[17]); return 0; } @@ -13127,21 +13127,21 @@ SP_NOINLINE static int sp_3072_sub_54(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 48; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[48] = a[48] - b[48]; - r[49] = a[49] - b[49]; - r[50] = a[50] - b[50]; - r[51] = a[51] - b[51]; - r[52] = a[52] - b[52]; - r[53] = a[53] - b[53]; + r[i + 0] = (sp_digit)((sp_uint64)a[i + 0] - (sp_uint64)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint64)a[i + 1] - (sp_uint64)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint64)a[i + 2] - (sp_uint64)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint64)a[i + 3] - (sp_uint64)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint64)a[i + 4] - (sp_uint64)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint64)a[i + 5] - (sp_uint64)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint64)a[i + 6] - (sp_uint64)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint64)a[i + 7] - (sp_uint64)b[i + 7]); + } + r[48] = (sp_digit)((sp_uint64)a[48] - (sp_uint64)b[48]); + r[49] = (sp_digit)((sp_uint64)a[49] - (sp_uint64)b[49]); + r[50] = (sp_digit)((sp_uint64)a[50] - (sp_uint64)b[50]); + r[51] = (sp_digit)((sp_uint64)a[51] - (sp_uint64)b[51]); + r[52] = (sp_digit)((sp_uint64)a[52] - (sp_uint64)b[52]); + r[53] = (sp_digit)((sp_uint64)a[53] - (sp_uint64)b[53]); return 0; } @@ -13397,18 +13397,18 @@ SP_NOINLINE static int sp_3072_sub_27(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 24; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[24] = a[24] - b[24]; - r[25] = a[25] - b[25]; - r[26] = a[26] - b[26]; + r[i + 0] = (sp_digit)((sp_uint64)a[i + 0] - (sp_uint64)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint64)a[i + 1] - (sp_uint64)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint64)a[i + 2] - (sp_uint64)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint64)a[i + 3] - (sp_uint64)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint64)a[i + 4] - (sp_uint64)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint64)a[i + 5] - (sp_uint64)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint64)a[i + 6] - (sp_uint64)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint64)a[i + 7] - (sp_uint64)b[i + 7]); + } + r[24] = (sp_digit)((sp_uint64)a[24] - (sp_uint64)b[24]); + r[25] = (sp_digit)((sp_uint64)a[25] - (sp_uint64)b[25]); + r[26] = (sp_digit)((sp_uint64)a[26] - (sp_uint64)b[26]); return 0; } @@ -17247,7 +17247,7 @@ SP_NOINLINE static int sp_4096_sub_35(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 35; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint64)a[i] - (sp_uint64)b[i]); } return 0; @@ -18368,7 +18368,7 @@ SP_NOINLINE static int sp_4096_sub_70(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 70; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint64)a[i] - (sp_uint64)b[i]); } return 0; @@ -21353,17 +21353,17 @@ SP_NOINLINE static int sp_4096_sub_26(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 24; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[24] = a[24] - b[24]; - r[25] = a[25] - b[25]; + r[i + 0] = (sp_digit)((sp_uint64)a[i + 0] - (sp_uint64)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint64)a[i + 1] - (sp_uint64)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint64)a[i + 2] - (sp_uint64)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint64)a[i + 3] - (sp_uint64)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint64)a[i + 4] - (sp_uint64)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint64)a[i + 5] - (sp_uint64)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint64)a[i + 6] - (sp_uint64)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint64)a[i + 7] - (sp_uint64)b[i + 7]); + } + r[24] = (sp_digit)((sp_uint64)a[24] - (sp_uint64)b[24]); + r[25] = (sp_digit)((sp_uint64)a[25] - (sp_uint64)b[25]); return 0; } @@ -21526,21 +21526,21 @@ SP_NOINLINE static int sp_4096_sub_78(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 72; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[72] = a[72] - b[72]; - r[73] = a[73] - b[73]; - r[74] = a[74] - b[74]; - r[75] = a[75] - b[75]; - r[76] = a[76] - b[76]; - r[77] = a[77] - b[77]; + r[i + 0] = (sp_digit)((sp_uint64)a[i + 0] - (sp_uint64)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint64)a[i + 1] - (sp_uint64)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint64)a[i + 2] - (sp_uint64)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint64)a[i + 3] - (sp_uint64)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint64)a[i + 4] - (sp_uint64)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint64)a[i + 5] - (sp_uint64)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint64)a[i + 6] - (sp_uint64)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint64)a[i + 7] - (sp_uint64)b[i + 7]); + } + r[72] = (sp_digit)((sp_uint64)a[72] - (sp_uint64)b[72]); + r[73] = (sp_digit)((sp_uint64)a[73] - (sp_uint64)b[73]); + r[74] = (sp_digit)((sp_uint64)a[74] - (sp_uint64)b[74]); + r[75] = (sp_digit)((sp_uint64)a[75] - (sp_uint64)b[75]); + r[76] = (sp_digit)((sp_uint64)a[76] - (sp_uint64)b[76]); + r[77] = (sp_digit)((sp_uint64)a[77] - (sp_uint64)b[77]); return 0; } @@ -21851,22 +21851,22 @@ SP_NOINLINE static int sp_4096_sub_39(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 32; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[32] = a[32] - b[32]; - r[33] = a[33] - b[33]; - r[34] = a[34] - b[34]; - r[35] = a[35] - b[35]; - r[36] = a[36] - b[36]; - r[37] = a[37] - b[37]; - r[38] = a[38] - b[38]; + r[i + 0] = (sp_digit)((sp_uint64)a[i + 0] - (sp_uint64)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint64)a[i + 1] - (sp_uint64)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint64)a[i + 2] - (sp_uint64)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint64)a[i + 3] - (sp_uint64)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint64)a[i + 4] - (sp_uint64)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint64)a[i + 5] - (sp_uint64)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint64)a[i + 6] - (sp_uint64)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint64)a[i + 7] - (sp_uint64)b[i + 7]); + } + r[32] = (sp_digit)((sp_uint64)a[32] - (sp_uint64)b[32]); + r[33] = (sp_digit)((sp_uint64)a[33] - (sp_uint64)b[33]); + r[34] = (sp_digit)((sp_uint64)a[34] - (sp_uint64)b[34]); + r[35] = (sp_digit)((sp_uint64)a[35] - (sp_uint64)b[35]); + r[36] = (sp_digit)((sp_uint64)a[36] - (sp_uint64)b[36]); + r[37] = (sp_digit)((sp_uint64)a[37] - (sp_uint64)b[37]); + r[38] = (sp_digit)((sp_uint64)a[38] - (sp_uint64)b[38]); return 0; } @@ -25623,7 +25623,7 @@ SP_NOINLINE static int sp_256_sub_5(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 5; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint64)a[i] - (sp_uint64)b[i]); } return 0; @@ -25639,11 +25639,11 @@ SP_NOINLINE static int sp_256_sub_5(sp_digit* r, const sp_digit* a, SP_NOINLINE static int sp_256_sub_5(sp_digit* r, const sp_digit* a, const sp_digit* b) { - r[ 0] = a[ 0] - b[ 0]; - r[ 1] = a[ 1] - b[ 1]; - r[ 2] = a[ 2] - b[ 2]; - r[ 3] = a[ 3] - b[ 3]; - r[ 4] = a[ 4] - b[ 4]; + r[ 0] = (sp_digit)((sp_uint64)a[ 0] - (sp_uint64)b[ 0]); + r[ 1] = (sp_digit)((sp_uint64)a[ 1] - (sp_uint64)b[ 1]); + r[ 2] = (sp_digit)((sp_uint64)a[ 2] - (sp_uint64)b[ 2]); + r[ 3] = (sp_digit)((sp_uint64)a[ 3] - (sp_uint64)b[ 3]); + r[ 4] = (sp_digit)((sp_uint64)a[ 4] - (sp_uint64)b[ 4]); return 0; } @@ -26982,18 +26982,18 @@ static int sp_256_mod_mul_norm_5(sp_digit* r, const sp_digit* a, const sp_digit* if (err == MP_OKAY) { a32 = t + 8; - a32[0] = (sp_digit)(a[0]) & 0xffffffffL; + a32[0] = (sp_digit)((sp_uint64)a[0] & 0xffffffffULL); a32[1] = (sp_digit)((((sp_uint64)a[0] >> 32U) | ((sp_uint64)a[1] << 20U)) & 0xffffffffULL); - a32[2] = (sp_digit)(a[1] >> 12U) & 0xffffffffL; + a32[2] = (sp_digit)(((sp_uint64)a[1] >> 12U) & 0xffffffffULL); a32[3] = (sp_digit)((((sp_uint64)a[1] >> 44U) | ((sp_uint64)a[2] << 8U)) & 0xffffffffULL); a32[4] = (sp_digit)((((sp_uint64)a[2] >> 24U) | ((sp_uint64)a[3] << 28U)) & 0xffffffffULL); - a32[5] = (sp_digit)(a[3] >> 4U) & 0xffffffffL; + a32[5] = (sp_digit)(((sp_uint64)a[3] >> 4U) & 0xffffffffULL); a32[6] = (sp_digit)((((sp_uint64)a[3] >> 36U) | ((sp_uint64)a[4] << 16U)) & 0xffffffffULL); - a32[7] = (sp_digit)(a[4] >> 16U) & 0xffffffffL; + a32[7] = (sp_digit)(((sp_uint64)a[4] >> 16U) & 0xffffffffULL); /* 1 1 0 -1 -1 -1 -1 0 */ t[0] = 0 + a32[0] + a32[1] - a32[3] - a32[4] - a32[5] - a32[6]; @@ -27034,15 +27034,12 @@ static int sp_256_mod_mul_norm_5(sp_digit* r, const sp_digit* a, const sp_digit* r[0] = (sp_digit)(((sp_uint64)t[0] | ((sp_uint64)t[1] << 32U)) & 0xfffffffffffffULL); - r[1] = (sp_digit)((((sp_uint64)t[1] >> 20U) | - ((sp_uint64)t[2] << 12U) | ((sp_uint64)t[3] << 44U)) & - 0xfffffffffffffULL); + r[1] = (sp_digit)((((sp_uint64)t[1] >> 20U) | ((sp_uint64)t[2] << 12U) | + ((sp_uint64)t[3] << 44U)) & 0xfffffffffffffULL); r[2] = (sp_digit)((((sp_uint64)t[3] >> 8U) | ((sp_uint64)t[4] << 24U)) & 0xfffffffffffffULL); - r[3] = (sp_digit)((((sp_uint64)t[4] >> 28U) | - ((sp_uint64)t[5] << 4U) | ((sp_uint64)t[6] << 36U)) & - 0xfffffffffffffULL); - /* The final carry can leave t[7] negative. Keep the top limb signed. */ + r[3] = (sp_digit)((((sp_uint64)t[4] >> 28U) | ((sp_uint64)t[5] << 4U) | + ((sp_uint64)t[6] << 36U)) & 0xfffffffffffffULL); r[4] = (t[6] >> 16U) + t[7] * 65536L; } @@ -31337,7 +31334,7 @@ static int sp_256_num_bits_52_5(sp_digit v) v |= v >> 16; v |= v >> 32; return sp_256_tab64_5[((sp_uint64)(v - (v >> 1)) * - 0x07EDD5E59A4E28C2ULL) >> 58]; + 0x07EDD5E59A4E28C2ULL) >> 58]; } /* Get the number of bits in the number. @@ -32665,7 +32662,7 @@ SP_NOINLINE static int sp_384_sub_7(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 7; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint64)a[i] - (sp_uint64)b[i]); } return 0; @@ -32681,13 +32678,13 @@ SP_NOINLINE static int sp_384_sub_7(sp_digit* r, const sp_digit* a, SP_NOINLINE static int sp_384_sub_7(sp_digit* r, const sp_digit* a, const sp_digit* b) { - r[ 0] = a[ 0] - b[ 0]; - r[ 1] = a[ 1] - b[ 1]; - r[ 2] = a[ 2] - b[ 2]; - r[ 3] = a[ 3] - b[ 3]; - r[ 4] = a[ 4] - b[ 4]; - r[ 5] = a[ 5] - b[ 5]; - r[ 6] = a[ 6] - b[ 6]; + r[ 0] = (sp_digit)((sp_uint64)a[ 0] - (sp_uint64)b[ 0]); + r[ 1] = (sp_digit)((sp_uint64)a[ 1] - (sp_uint64)b[ 1]); + r[ 2] = (sp_digit)((sp_uint64)a[ 2] - (sp_uint64)b[ 2]); + r[ 3] = (sp_digit)((sp_uint64)a[ 3] - (sp_uint64)b[ 3]); + r[ 4] = (sp_digit)((sp_uint64)a[ 4] - (sp_uint64)b[ 4]); + r[ 5] = (sp_digit)((sp_uint64)a[ 5] - (sp_uint64)b[ 5]); + r[ 6] = (sp_digit)((sp_uint64)a[ 6] - (sp_uint64)b[ 6]); return 0; } @@ -34068,24 +34065,24 @@ static int sp_384_mod_mul_norm_7(sp_digit* r, const sp_digit* a, const sp_digit* if (err == MP_OKAY) { a32 = t + 12; - a32[0] = (sp_digit)(a[0]) & 0xffffffffL; + a32[0] = (sp_digit)((sp_uint64)a[0] & 0xffffffffULL); a32[1] = (sp_digit)((((sp_uint64)a[0] >> 32U) | ((sp_uint64)a[1] << 23U)) & 0xffffffffULL); - a32[2] = (sp_digit)(a[1] >> 9U) & 0xffffffffL; + a32[2] = (sp_digit)(((sp_uint64)a[1] >> 9U) & 0xffffffffULL); a32[3] = (sp_digit)((((sp_uint64)a[1] >> 41U) | ((sp_uint64)a[2] << 14U)) & 0xffffffffULL); - a32[4] = (sp_digit)(a[2] >> 18U) & 0xffffffffL; + a32[4] = (sp_digit)(((sp_uint64)a[2] >> 18U) & 0xffffffffULL); a32[5] = (sp_digit)((((sp_uint64)a[2] >> 50U) | ((sp_uint64)a[3] << 5U)) & 0xffffffffULL); a32[6] = (sp_digit)((((sp_uint64)a[3] >> 27U) | ((sp_uint64)a[4] << 28U)) & 0xffffffffULL); - a32[7] = (sp_digit)(a[4] >> 4U) & 0xffffffffL; + a32[7] = (sp_digit)(((sp_uint64)a[4] >> 4U) & 0xffffffffULL); a32[8] = (sp_digit)((((sp_uint64)a[4] >> 36U) | ((sp_uint64)a[5] << 19U)) & 0xffffffffULL); - a32[9] = (sp_digit)(a[5] >> 13U) & 0xffffffffL; + a32[9] = (sp_digit)(((sp_uint64)a[5] >> 13U) & 0xffffffffULL); a32[10] = (sp_digit)((((sp_uint64)a[5] >> 45U) | ((sp_uint64)a[6] << 10U)) & 0xffffffffULL); - a32[11] = (sp_digit)(a[6] >> 22U) & 0xffffffffL; + a32[11] = (sp_digit)(((sp_uint64)a[6] >> 22U) & 0xffffffffULL); /* 1 0 0 0 0 0 0 0 1 1 0 -1 */ t[0] = 0 + a32[0] + a32[8] + a32[9] - a32[11]; @@ -34142,20 +34139,16 @@ static int sp_384_mod_mul_norm_7(sp_digit* r, const sp_digit* a, const sp_digit* r[0] = (sp_digit)(((sp_uint64)t[0] | ((sp_uint64)t[1] << 32U)) & 0x7fffffffffffffULL); - r[1] = (sp_digit)((((sp_uint64)t[1] >> 23U) | - ((sp_uint64)t[2] << 9U) | ((sp_uint64)t[3] << 41U)) & - 0x7fffffffffffffULL); - r[2] = (sp_digit)((((sp_uint64)t[3] >> 14U) | - ((sp_uint64)t[4] << 18U) | ((sp_uint64)t[5] << 50U)) & - 0x7fffffffffffffULL); + r[1] = (sp_digit)((((sp_uint64)t[1] >> 23U) | ((sp_uint64)t[2] << 9U) | + ((sp_uint64)t[3] << 41U)) & 0x7fffffffffffffULL); + r[2] = (sp_digit)((((sp_uint64)t[3] >> 14U) | ((sp_uint64)t[4] << 18U) | + ((sp_uint64)t[5] << 50U)) & 0x7fffffffffffffULL); r[3] = (sp_digit)((((sp_uint64)t[5] >> 5U) | ((sp_uint64)t[6] << 27U)) & 0x7fffffffffffffULL); - r[4] = (sp_digit)((((sp_uint64)t[6] >> 28U) | - ((sp_uint64)t[7] << 4U) | ((sp_uint64)t[8] << 36U)) & - 0x7fffffffffffffULL); - r[5] = (sp_digit)((((sp_uint64)t[8] >> 19U) | - ((sp_uint64)t[9] << 13U) | ((sp_uint64)t[10] << 45U)) & - 0x7fffffffffffffULL); + r[4] = (sp_digit)((((sp_uint64)t[6] >> 28U) | ((sp_uint64)t[7] << 4U) | + ((sp_uint64)t[8] << 36U)) & 0x7fffffffffffffULL); + r[5] = (sp_digit)((((sp_uint64)t[8] >> 19U) | ((sp_uint64)t[9] << 13U) | + ((sp_uint64)t[10] << 45U)) & 0x7fffffffffffffULL); r[6] = (t[10] >> 10U) + t[11] * 4194304L; } @@ -38961,7 +38954,7 @@ static int sp_384_num_bits_55_7(sp_digit v) v |= v >> 16; v |= v >> 32; return sp_384_tab64_7[((sp_uint64)(v - (v >> 1)) * - 0x07EDD5E59A4E28C2ULL) >> 58]; + 0x07EDD5E59A4E28C2ULL) >> 58]; } /* Get the number of bits in the number. @@ -40401,7 +40394,7 @@ SP_NOINLINE static int sp_521_sub_9(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 9; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint64)a[i] - (sp_uint64)b[i]); } return 0; @@ -40417,15 +40410,15 @@ SP_NOINLINE static int sp_521_sub_9(sp_digit* r, const sp_digit* a, SP_NOINLINE static int sp_521_sub_9(sp_digit* r, const sp_digit* a, const sp_digit* b) { - r[ 0] = a[ 0] - b[ 0]; - r[ 1] = a[ 1] - b[ 1]; - r[ 2] = a[ 2] - b[ 2]; - r[ 3] = a[ 3] - b[ 3]; - r[ 4] = a[ 4] - b[ 4]; - r[ 5] = a[ 5] - b[ 5]; - r[ 6] = a[ 6] - b[ 6]; - r[ 7] = a[ 7] - b[ 7]; - r[ 8] = a[ 8] - b[ 8]; + r[ 0] = (sp_digit)((sp_uint64)a[ 0] - (sp_uint64)b[ 0]); + r[ 1] = (sp_digit)((sp_uint64)a[ 1] - (sp_uint64)b[ 1]); + r[ 2] = (sp_digit)((sp_uint64)a[ 2] - (sp_uint64)b[ 2]); + r[ 3] = (sp_digit)((sp_uint64)a[ 3] - (sp_uint64)b[ 3]); + r[ 4] = (sp_digit)((sp_uint64)a[ 4] - (sp_uint64)b[ 4]); + r[ 5] = (sp_digit)((sp_uint64)a[ 5] - (sp_uint64)b[ 5]); + r[ 6] = (sp_digit)((sp_uint64)a[ 6] - (sp_uint64)b[ 6]); + r[ 7] = (sp_digit)((sp_uint64)a[ 7] - (sp_uint64)b[ 7]); + r[ 8] = (sp_digit)((sp_uint64)a[ 8] - (sp_uint64)b[ 8]); return 0; } @@ -46621,7 +46614,7 @@ static int sp_521_num_bits_58_9(sp_digit v) v |= v >> 16; v |= v >> 32; return sp_521_tab64_9[((sp_uint64)(v - (v >> 1)) * - 0x07EDD5E59A4E28C2ULL) >> 58]; + 0x07EDD5E59A4E28C2ULL) >> 58]; } /* Get the number of bits in the number. @@ -47867,17 +47860,17 @@ SP_NOINLINE static int sp_1024_sub_18(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 16; i += 8) { - r[i + 0] = a[i + 0] - b[i + 0]; - r[i + 1] = a[i + 1] - b[i + 1]; - r[i + 2] = a[i + 2] - b[i + 2]; - r[i + 3] = a[i + 3] - b[i + 3]; - r[i + 4] = a[i + 4] - b[i + 4]; - r[i + 5] = a[i + 5] - b[i + 5]; - r[i + 6] = a[i + 6] - b[i + 6]; - r[i + 7] = a[i + 7] - b[i + 7]; - } - r[16] = a[16] - b[16]; - r[17] = a[17] - b[17]; + r[i + 0] = (sp_digit)((sp_uint64)a[i + 0] - (sp_uint64)b[i + 0]); + r[i + 1] = (sp_digit)((sp_uint64)a[i + 1] - (sp_uint64)b[i + 1]); + r[i + 2] = (sp_digit)((sp_uint64)a[i + 2] - (sp_uint64)b[i + 2]); + r[i + 3] = (sp_digit)((sp_uint64)a[i + 3] - (sp_uint64)b[i + 3]); + r[i + 4] = (sp_digit)((sp_uint64)a[i + 4] - (sp_uint64)b[i + 4]); + r[i + 5] = (sp_digit)((sp_uint64)a[i + 5] - (sp_uint64)b[i + 5]); + r[i + 6] = (sp_digit)((sp_uint64)a[i + 6] - (sp_uint64)b[i + 6]); + r[i + 7] = (sp_digit)((sp_uint64)a[i + 7] - (sp_uint64)b[i + 7]); + } + r[16] = (sp_digit)((sp_uint64)a[16] - (sp_uint64)b[16]); + r[17] = (sp_digit)((sp_uint64)a[17] - (sp_uint64)b[17]); return 0; } @@ -48285,7 +48278,7 @@ SP_NOINLINE static int sp_1024_sub_18(sp_digit* r, const sp_digit* a, int i; for (i = 0; i < 18; i++) { - r[i] = a[i] - b[i]; + r[i] = (sp_digit)((sp_uint64)a[i] - (sp_uint64)b[i]); } return 0; From 04a69d17d8a2c60494074f8526c800314ba2434e Mon Sep 17 00:00:00 2001 From: David Garske Date: Thu, 5 Nov 2026 16:53:20 -0800 Subject: [PATCH 4/5] Check the output buffer before offsetting it in sp_to_unsigned_bin_at_pos --- wolfcrypt/src/sp_int.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/wolfcrypt/src/sp_int.c b/wolfcrypt/src/sp_int.c index 24d65221cad..8828d750364 100644 --- a/wolfcrypt/src/sp_int.c +++ b/wolfcrypt/src/sp_int.c @@ -18595,14 +18595,21 @@ int sp_to_unsigned_bin_len_ct(const sp_int* a, byte* out, int outSz) */ int sp_to_unsigned_bin_at_pos(int o, const sp_int* a, unsigned char* out) { - /* Get length of data that will be written. */ - int len = sp_unsigned_bin_size(a); - /* Write number to buffer at offset. */ - int ret = sp_to_unsigned_bin_len(a, out + o, len); - - if (ret == MP_OKAY) { - /* Return offset of next byte after number. */ - ret = o + len; + int ret; + + /* Validate parameters before forming out + o. */ + if ((a == NULL) || (out == NULL)) { + ret = MP_VAL; + } + else { + /* Get length of data that will be written. */ + int len = sp_unsigned_bin_size(a); + /* Write number to buffer at offset. */ + ret = sp_to_unsigned_bin_len(a, out + o, len); + if (ret == MP_OKAY) { + /* Return offset of next byte after number. */ + ret = o + len; + } } return ret; From ea7f74402de9dba08e486ab1ce675dc7fc71b917 Mon Sep 17 00:00:00 2001 From: David Garske Date: Fri, 6 Nov 2026 15:17:56 -0800 Subject: [PATCH 5/5] SP ARM32 and Thumb2: keep the carry of the first doubled product in each square column --- wolfcrypt/src/sp_arm32.c | 32 -------------------------------- wolfcrypt/src/sp_cortexm.c | 32 -------------------------------- 2 files changed, 64 deletions(-) diff --git a/wolfcrypt/src/sp_arm32.c b/wolfcrypt/src/sp_arm32.c index 19f3bb27f2c..972f457355a 100644 --- a/wolfcrypt/src/sp_arm32.c +++ b/wolfcrypt/src/sp_arm32.c @@ -26025,7 +26025,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif "str r3, [sp, #4]\n\t" @@ -26081,7 +26080,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "adc r3, r3, #0\n\t" "adds r4, r4, r8\n\t" "adcs r2, r2, r9\n\t" - "mov r3, #0\n\t" "adc r3, r3, #0\n\t" #endif /* A[1] * A[1] */ @@ -26165,7 +26163,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "adc r4, r4, #0\n\t" "adds r2, r2, r8\n\t" "adcs r3, r3, r9\n\t" - "mov r4, #0\n\t" "adc r4, r4, #0\n\t" #endif /* A[1] * A[2] */ @@ -26273,7 +26270,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif /* A[1] * A[3] */ @@ -28634,7 +28630,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "adc r4, r4, #0\n\t" "adds r2, r2, r8\n\t" "adcs r3, r3, r9\n\t" - "mov r4, #0\n\t" "adc r4, r4, #0\n\t" #endif /* A[8] * A[10] */ @@ -28770,7 +28765,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif /* A[9] * A[10] */ @@ -28878,7 +28872,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "adc r3, r3, #0\n\t" "adds r4, r4, r8\n\t" "adcs r2, r2, r9\n\t" - "mov r3, #0\n\t" "adc r3, r3, #0\n\t" #endif /* A[10] * A[10] */ @@ -28962,7 +28955,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "adc r4, r4, #0\n\t" "adds r2, r2, r8\n\t" "adcs r3, r3, r9\n\t" - "mov r4, #0\n\t" "adc r4, r4, #0\n\t" #endif "str r2, [%[r], #84]\n\t" @@ -88916,7 +88908,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif "str r3, [sp, #4]\n\t" @@ -88972,7 +88963,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "adc r3, r3, #0\n\t" "adds r4, r4, r8\n\t" "adcs r2, r2, r9\n\t" - "mov r3, #0\n\t" "adc r3, r3, #0\n\t" #endif /* A[1] * A[1] */ @@ -89056,7 +89046,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "adc r4, r4, #0\n\t" "adds r2, r2, r8\n\t" "adcs r3, r3, r9\n\t" - "mov r4, #0\n\t" "adc r4, r4, #0\n\t" #endif /* A[1] * A[2] */ @@ -89164,7 +89153,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif /* A[1] * A[3] */ @@ -91525,7 +91513,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "adc r4, r4, #0\n\t" "adds r2, r2, r8\n\t" "adcs r3, r3, r9\n\t" - "mov r4, #0\n\t" "adc r4, r4, #0\n\t" #endif /* A[8] * A[10] */ @@ -91661,7 +91648,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif /* A[9] * A[10] */ @@ -91769,7 +91755,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "adc r3, r3, #0\n\t" "adds r4, r4, r8\n\t" "adcs r2, r2, r9\n\t" - "mov r3, #0\n\t" "adc r3, r3, #0\n\t" #endif /* A[10] * A[10] */ @@ -91853,7 +91838,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "adc r4, r4, #0\n\t" "adds r2, r2, r8\n\t" "adcs r3, r3, r9\n\t" - "mov r4, #0\n\t" "adc r4, r4, #0\n\t" #endif "str r2, [%[r], #84]\n\t" @@ -113655,7 +113639,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif "str r3, [sp, #4]\n\t" @@ -113711,7 +113694,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "adc r3, r3, #0\n\t" "adds r4, r4, r8\n\t" "adcs r2, r2, r9\n\t" - "mov r3, #0\n\t" "adc r3, r3, #0\n\t" #endif /* A[1] * A[1] */ @@ -113795,7 +113777,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "adc r4, r4, #0\n\t" "adds r2, r2, r8\n\t" "adcs r3, r3, r9\n\t" - "mov r4, #0\n\t" "adc r4, r4, #0\n\t" #endif /* A[1] * A[2] */ @@ -113903,7 +113884,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif /* A[1] * A[3] */ @@ -119069,7 +119049,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif /* A[13] * A[15] */ @@ -119205,7 +119184,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "adc r3, r3, #0\n\t" "adds r4, r4, r8\n\t" "adcs r2, r2, r9\n\t" - "mov r3, #0\n\t" "adc r3, r3, #0\n\t" #endif /* A[14] * A[15] */ @@ -119313,7 +119291,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "adc r4, r4, #0\n\t" "adds r2, r2, r8\n\t" "adcs r3, r3, r9\n\t" - "mov r4, #0\n\t" "adc r4, r4, #0\n\t" #endif /* A[15] * A[15] */ @@ -119397,7 +119374,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif "str r3, [%[r], #124]\n\t" @@ -141751,7 +141727,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif "str r3, [sp, #4]\n\t" @@ -141807,7 +141782,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "adc r3, r3, #0\n\t" "adds r4, r4, r8\n\t" "adcs r2, r2, r9\n\t" - "mov r3, #0\n\t" "adc r3, r3, #0\n\t" #endif /* A[1] * A[1] */ @@ -141891,7 +141865,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "adc r4, r4, #0\n\t" "adds r2, r2, r8\n\t" "adcs r3, r3, r9\n\t" - "mov r4, #0\n\t" "adc r4, r4, #0\n\t" #endif /* A[1] * A[2] */ @@ -141999,7 +141972,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif /* A[1] * A[3] */ @@ -146528,7 +146500,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "adc r3, r3, #0\n\t" "adds r4, r4, r8\n\t" "adcs r2, r2, r9\n\t" - "mov r3, #0\n\t" "adc r3, r3, #0\n\t" #endif /* A[12] * A[14] */ @@ -146664,7 +146635,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "adc r4, r4, #0\n\t" "adds r2, r2, r8\n\t" "adcs r3, r3, r9\n\t" - "mov r4, #0\n\t" "adc r4, r4, #0\n\t" #endif /* A[13] * A[14] */ @@ -146772,7 +146742,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "adc r2, r2, #0\n\t" "adds r3, r3, r8\n\t" "adcs r4, r4, r9\n\t" - "mov r2, #0\n\t" "adc r2, r2, #0\n\t" #endif /* A[14] * A[14] */ @@ -146856,7 +146825,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "adc r3, r3, #0\n\t" "adds r4, r4, r8\n\t" "adcs r2, r2, r9\n\t" - "mov r3, #0\n\t" "adc r3, r3, #0\n\t" #endif "str r4, [%[r], #116]\n\t" diff --git a/wolfcrypt/src/sp_cortexm.c b/wolfcrypt/src/sp_cortexm.c index 47729f2baa3..6b1703a6811 100644 --- a/wolfcrypt/src/sp_cortexm.c +++ b/wolfcrypt/src/sp_cortexm.c @@ -14016,7 +14016,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" "STR r3, [sp, #4]\n\t" /* A[0] * A[2] */ @@ -14029,7 +14028,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "ADC r3, r3, #0\n\t" "ADDS r4, r4, r8\n\t" "ADCS r2, r2, r9\n\t" - "MOV r3, #0\n\t" "ADC r3, r3, #0\n\t" /* A[1] * A[1] */ "LDR r10, [r1, #4]\n\t" @@ -14048,7 +14046,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "ADC r4, r4, #0\n\t" "ADDS r2, r2, r8\n\t" "ADCS r3, r3, r9\n\t" - "MOV r4, #0\n\t" "ADC r4, r4, #0\n\t" /* A[1] * A[2] */ "LDR r10, [r1, #8]\n\t" @@ -14071,7 +14068,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" /* A[1] * A[3] */ "LDR r10, [r1, #12]\n\t" @@ -14592,7 +14588,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "ADC r4, r4, #0\n\t" "ADDS r2, r2, r8\n\t" "ADCS r3, r3, r9\n\t" - "MOV r4, #0\n\t" "ADC r4, r4, #0\n\t" /* A[8] * A[10] */ "LDR r10, [r1, #40]\n\t" @@ -14621,7 +14616,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" /* A[9] * A[10] */ "LDR r10, [r1, #40]\n\t" @@ -14644,7 +14638,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "ADC r3, r3, #0\n\t" "ADDS r4, r4, r8\n\t" "ADCS r2, r2, r9\n\t" - "MOV r3, #0\n\t" "ADC r3, r3, #0\n\t" /* A[10] * A[10] */ "LDR r10, [r1, #40]\n\t" @@ -14663,7 +14656,6 @@ WC_OMIT_FRAME_POINTER static void sp_3072_sqr_12(sp_digit* r, const sp_digit* a) "ADC r4, r4, #0\n\t" "ADDS r2, r2, r8\n\t" "ADCS r3, r3, r9\n\t" - "MOV r4, #0\n\t" "ADC r4, r4, #0\n\t" "STR r2, [r0, #84]\n\t" /* A[11] * A[11] */ @@ -48815,7 +48807,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" "STR r3, [sp, #4]\n\t" /* A[0] * A[2] */ @@ -48828,7 +48819,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "ADC r3, r3, #0\n\t" "ADDS r4, r4, r8\n\t" "ADCS r2, r2, r9\n\t" - "MOV r3, #0\n\t" "ADC r3, r3, #0\n\t" /* A[1] * A[1] */ "LDR r10, [r1, #4]\n\t" @@ -48847,7 +48837,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "ADC r4, r4, #0\n\t" "ADDS r2, r2, r8\n\t" "ADCS r3, r3, r9\n\t" - "MOV r4, #0\n\t" "ADC r4, r4, #0\n\t" /* A[1] * A[2] */ "LDR r10, [r1, #8]\n\t" @@ -48870,7 +48859,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" /* A[1] * A[3] */ "LDR r10, [r1, #12]\n\t" @@ -49391,7 +49379,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "ADC r4, r4, #0\n\t" "ADDS r2, r2, r8\n\t" "ADCS r3, r3, r9\n\t" - "MOV r4, #0\n\t" "ADC r4, r4, #0\n\t" /* A[8] * A[10] */ "LDR r10, [r1, #40]\n\t" @@ -49420,7 +49407,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" /* A[9] * A[10] */ "LDR r10, [r1, #40]\n\t" @@ -49443,7 +49429,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "ADC r3, r3, #0\n\t" "ADDS r4, r4, r8\n\t" "ADCS r2, r2, r9\n\t" - "MOV r3, #0\n\t" "ADC r3, r3, #0\n\t" /* A[10] * A[10] */ "LDR r10, [r1, #40]\n\t" @@ -49462,7 +49447,6 @@ WC_OMIT_FRAME_POINTER static void sp_384_sqr_12(sp_digit* r, const sp_digit* a) "ADC r4, r4, #0\n\t" "ADDS r2, r2, r8\n\t" "ADCS r3, r3, r9\n\t" - "MOV r4, #0\n\t" "ADC r4, r4, #0\n\t" "STR r2, [r0, #84]\n\t" /* A[11] * A[11] */ @@ -61404,7 +61388,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" "STR r3, [sp, #4]\n\t" /* A[0] * A[2] */ @@ -61417,7 +61400,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "ADC r3, r3, #0\n\t" "ADDS r4, r4, r8\n\t" "ADCS r2, r2, r9\n\t" - "MOV r3, #0\n\t" "ADC r3, r3, #0\n\t" /* A[1] * A[1] */ "LDR r10, [r1, #4]\n\t" @@ -61436,7 +61418,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "ADC r4, r4, #0\n\t" "ADDS r2, r2, r8\n\t" "ADCS r3, r3, r9\n\t" - "MOV r4, #0\n\t" "ADC r4, r4, #0\n\t" /* A[1] * A[2] */ "LDR r10, [r1, #8]\n\t" @@ -61459,7 +61440,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" /* A[1] * A[3] */ "LDR r10, [r1, #12]\n\t" @@ -62560,7 +62540,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" /* A[13] * A[15] */ "LDR r10, [r1, #60]\n\t" @@ -62589,7 +62568,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "ADC r3, r3, #0\n\t" "ADDS r4, r4, r8\n\t" "ADCS r2, r2, r9\n\t" - "MOV r3, #0\n\t" "ADC r3, r3, #0\n\t" /* A[14] * A[15] */ "LDR r10, [r1, #60]\n\t" @@ -62612,7 +62590,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "ADC r4, r4, #0\n\t" "ADDS r2, r2, r8\n\t" "ADCS r3, r3, r9\n\t" - "MOV r4, #0\n\t" "ADC r4, r4, #0\n\t" /* A[15] * A[15] */ "LDR r10, [r1, #60]\n\t" @@ -62631,7 +62608,6 @@ WC_OMIT_FRAME_POINTER static void sp_521_sqr_17(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" "STR r3, [r0, #124]\n\t" /* A[16] * A[16] */ @@ -75663,7 +75639,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" "STR r3, [sp, #4]\n\t" /* A[0] * A[2] */ @@ -75676,7 +75651,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "ADC r3, r3, #0\n\t" "ADDS r4, r4, r8\n\t" "ADCS r2, r2, r9\n\t" - "MOV r3, #0\n\t" "ADC r3, r3, #0\n\t" /* A[1] * A[1] */ "LDR r10, [r1, #4]\n\t" @@ -75695,7 +75669,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "ADC r4, r4, #0\n\t" "ADDS r2, r2, r8\n\t" "ADCS r3, r3, r9\n\t" - "MOV r4, #0\n\t" "ADC r4, r4, #0\n\t" /* A[1] * A[2] */ "LDR r10, [r1, #8]\n\t" @@ -75718,7 +75691,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" /* A[1] * A[3] */ "LDR r10, [r1, #12]\n\t" @@ -76689,7 +76661,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "ADC r3, r3, #0\n\t" "ADDS r4, r4, r8\n\t" "ADCS r2, r2, r9\n\t" - "MOV r3, #0\n\t" "ADC r3, r3, #0\n\t" /* A[12] * A[14] */ "LDR r10, [r1, #56]\n\t" @@ -76718,7 +76689,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "ADC r4, r4, #0\n\t" "ADDS r2, r2, r8\n\t" "ADCS r3, r3, r9\n\t" - "MOV r4, #0\n\t" "ADC r4, r4, #0\n\t" /* A[13] * A[14] */ "LDR r10, [r1, #56]\n\t" @@ -76741,7 +76711,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "ADC r2, r2, #0\n\t" "ADDS r3, r3, r8\n\t" "ADCS r4, r4, r9\n\t" - "MOV r2, #0\n\t" "ADC r2, r2, #0\n\t" /* A[14] * A[14] */ "LDR r10, [r1, #56]\n\t" @@ -76760,7 +76729,6 @@ WC_OMIT_FRAME_POINTER static void sp_1024_sqr_16(sp_digit* r, const sp_digit* a) "ADC r3, r3, #0\n\t" "ADDS r4, r4, r8\n\t" "ADCS r2, r2, r9\n\t" - "MOV r3, #0\n\t" "ADC r3, r3, #0\n\t" "STR r4, [r0, #116]\n\t" /* A[15] * A[15] */