mirror of
https://github.com/openssl/openssl.git
synced 2025-02-11 14:22:43 +08:00
3712436071
for specialized Montgomery ladder implementations PR #6009 and #6070 replaced the default EC point multiplication path for prime and binary curves with a unified Montgomery ladder implementation with various timing attack defenses (for the common paths when a secret scalar is feed to the point multiplication). The newly introduced default implementation directly used EC_POINT_add/dbl in the main loop. The scaffolding introduced by this commit allows EC_METHODs to define a specialized `ladder_step` function to improve performances by taking advantage of efficient formulas for differential addition-and-doubling and different coordinate systems. - `ladder_pre` is executed before the main loop of the ladder: by default it copies the input point P into S, and doubles it into R. Specialized implementations could, e.g., use this hook to transition to different coordinate systems before copying and doubling; - `ladder_step` is the core of the Montgomery ladder loop: by default it computes `S := R+S; R := 2R;`, but specific implementations could, e.g., implement a more efficient formula for differential addition-and-doubling; - `ladder_post` is executed after the Montgomery ladder loop: by default it's a noop, but specialized implementations could, e.g., use this hook to transition back from the coordinate system used for optimizing the differential addition-and-doubling or recover the y coordinate of the result point. This commit also renames `ec_mul_consttime` to `ec_scalar_mul_ladder`, as it better corresponds to what this function does: nothing can be truly said about the constant-timeness of the overall execution of this function, given that the underlying operations are not necessarily constant-time themselves. What this implementation ensures is that the same fixed sequence of operations is executed for each scalar multiplication (for a given EC_GROUP), with no dependency on the value of the input scalar. Co-authored-by: Sohaib ul Hassan <soh.19.hassan@gmail.com> Co-authored-by: Billy Brumley <bbrumley@gmail.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6690) |
||
|---|---|---|
| .. | ||
| aes | ||
| aria | ||
| asn1 | ||
| async | ||
| bf | ||
| bio | ||
| blake2 | ||
| bn | ||
| buffer | ||
| camellia | ||
| cast | ||
| chacha | ||
| cmac | ||
| cms | ||
| comp | ||
| conf | ||
| ct | ||
| des | ||
| dh | ||
| dsa | ||
| dso | ||
| ec | ||
| engine | ||
| err | ||
| evp | ||
| hmac | ||
| idea | ||
| include/internal | ||
| kdf | ||
| lhash | ||
| md2 | ||
| md4 | ||
| md5 | ||
| mdc2 | ||
| modes | ||
| objects | ||
| ocsp | ||
| pem | ||
| perlasm | ||
| pkcs7 | ||
| pkcs12 | ||
| poly1305 | ||
| rand | ||
| rc2 | ||
| rc4 | ||
| rc5 | ||
| ripemd | ||
| rsa | ||
| seed | ||
| sha | ||
| siphash | ||
| sm2 | ||
| sm3 | ||
| sm4 | ||
| srp | ||
| stack | ||
| store | ||
| ts | ||
| txt_db | ||
| ui | ||
| whrlpool | ||
| x509 | ||
| x509v3 | ||
| alphacpuid.pl | ||
| arm64cpuid.pl | ||
| arm_arch.h | ||
| armcap.c | ||
| armv4cpuid.pl | ||
| build.info | ||
| c64xpluscpuid.pl | ||
| cpt_err.c | ||
| cryptlib.c | ||
| ctype.c | ||
| cversion.c | ||
| dllmain.c | ||
| ebcdic.c | ||
| ex_data.c | ||
| ia64cpuid.S | ||
| init.c | ||
| LPdir_nyi.c | ||
| LPdir_unix.c | ||
| LPdir_vms.c | ||
| LPdir_win32.c | ||
| LPdir_win.c | ||
| LPdir_wince.c | ||
| mem_clr.c | ||
| mem_dbg.c | ||
| mem_sec.c | ||
| mem.c | ||
| mips_arch.h | ||
| o_dir.c | ||
| o_fips.c | ||
| o_fopen.c | ||
| o_init.c | ||
| o_str.c | ||
| o_time.c | ||
| pariscid.pl | ||
| ppc_arch.h | ||
| ppccap.c | ||
| ppccpuid.pl | ||
| s390x_arch.h | ||
| s390xcap.c | ||
| s390xcpuid.pl | ||
| sparc_arch.h | ||
| sparccpuid.S | ||
| sparcv9cap.c | ||
| threads_none.c | ||
| threads_pthread.c | ||
| threads_win.c | ||
| uid.c | ||
| vms_rms.h | ||
| x86_64cpuid.pl | ||
| x86cpuid.pl | ||